Seminar Sidelights | Practical Analysis of Virtual Asset Crimes: International Trends in Digital Financial Crime

According to the interpretations by the Central Bank and the Financial Supervisory Commission (FSC), virtual currencies are classified as virtual commodities in Taiwan. Holding or using virtual commodities is not inherently illegal; the issue arises when virtual currencies are used to commit illegal acts such as fundraising fraud or scams. Addressing the background and international trends of virtual currencies being abused for criminal purposes, the speaker first introduced virtual currency economic activities and explained their various classifications. Next, the speaker discussed several types of virtual currency crimes derived internationally from these economic activities, and finally shared benchmark incidents for each type of crime.

I. Types of Economic Activity Involving Virtual Currency

1. Initial Coin Offering (ICO)

Refers to enterprises raising funds from specific or unspecified persons by issuing exclusive virtual tokens based on blockchain technology. ICOs first emerged in 2013. Because this fundraising method is easy, many fraud syndicates also exploit the issuance of virtual currencies to carry out scams.

2. Businesses Involving Virtual Currency Commerce

Businesses involving virtual currency commerce include acting as virtual currency intermediaries. Due to the diverse types of virtual currencies, many people use on-exchange trading platforms or over-the-counter (OTC) dealers to conduct virtual currency transactions. Taiwan's top three representative on-exchange trading platforms include MAX Exchange, BitoPro, and ACE Exchange, which feature centralized order-matching functions. The operating model of OTC dealers involves executing transactions outside of exchanges and matching trades on a one-to-one basis through intermediaries or middlemen. Related businesses involving virtual currency also include spot leverage, lending, debt investment, and grid trading.

3. Decentralized Finance (DeFi)

Past financial services all required intermediary institutions such as banks or exchanges, whereas DeFi utilizes smart contracts deployed on the blockchain to provide financial services. Taking lending as an example, borrowing through a bank in the past required identity verification, making the entire process cumbersome and generating many additional fees. However, DeFi uses blockchain technology to automatically execute transactions once the trading parties meet the conditions set in the smart contract, making the process relatively streamlined.

4. Non-Fungible Token (NFT)

An NFT is a digital asset that uses a smart contract paired with a single token to anchor the token to a specific digital asset. Such digital assets can be tracked on the blockchain and transferred to serve as a medium of exchange.

II. Types of Virtual Currency Crimes

Between 2017 and 2018, due to the booming development of ICOs, virtual currency thefts began to emerge, with a small number of criminals even extracting approximately USD 1.21 billion in criminal proceeds from them. Although criminal proceeds from scam cases declined slightly after 2020, fraudulent amounts began to climb again with the advent of NFTs in 2021. Because virtual currencies possess characteristics such as anonymity, untraceability, and transparency, they have become a breeding ground for crime. Below are several common international types of virtual currency crimes and their benchmark cases.

1. Fraudulent Conduct

(1) Concept: Intentionally employing deceptive tactics to acquire specific virtual currencies from victims.
(2) Benchmark Incident: PlusToken was a platform established in 2018 that lured victims into a smart cross-exchange arbitrage platform by requiring a threshold of USD 500 or more to activate a "smart dog." Investors could store virtual currencies in the platform to receive high returns through corresponding proportional dividends paid in Plus coins, and designed a reward mechanism for promoting users following a multi-level marketing model. However, PlusToken actually lacked the smart-dog arbitrage function it claimed; the entire incident was essentially a typical pyramid scheme scam. PlusToken collapsed in 2019. In September 2020, the People's Court of Yancheng Economic-Technological Development Zone in Jiangsu Province sentenced 16 individuals involved in the PlusToken case to prison terms ranging from 2 to 11 years, with fines ranging from RMB 120,000 to 6 million. The confiscated amount from the entire case was preliminarily estimated to exceed RMB 52.15 million, with the majority of the confiscated assets being Bitcoin.

2. Cyber Hacker Theft

(1) Concept: Maliciously acquiring access to others' computer systems or sending phishing emails to steal virtual currencies.
(2) Benchmark Incident: In September 2020, a hacker coin-theft incident occurred at KuCoin, a Singaporean cryptocurrency exchange. The amount involved in the entire incident reached as high as USD 281 million, making it the largest virtual currency theft case of 2020. As soon as the KuCoin incident broke out, KuCoin immediately cooperated with global mainstream cryptocurrency platforms such as Huobi, Binance, and Bitmax, security organizations, and Interpol. Through transaction records left on the chain during virtual currency transactions, KuCoin has recovered USD 201 million in cryptocurrency. This case demonstrates that the untraceability of virtual currencies is gradually being broken, and international exchanges have slowly learned how to respond quickly to cyber hacker issues and urgently protect existing assets.

3. Cyber Extortion

(1) Concept: Hijacking computer systems and encrypting files using ransomware, forcing victims to pay virtual currency to obtain the decryption program.
(2) Benchmark Incident: In 2020, the immigration entry and exit document review system of the National Directorate of Migration of Argentina was implanted with NetWalker ransomware. Hackers stole and encrypted the data of Argentina's immigration authority using NetWalker ransomware and demanded a USD 2 million ransom. Seven days later, because the Argentine government refused to pay the ransom, the hackers increased the ransom to 355 Bitcoins (worth approximately USD 400 million at the time [Translator's note: source text states about 4 million USD]).

III. Conclusion:

As the transaction patterns of virtual currencies continue to update, investors must repeatedly vet related operators before making investments. Currently, pursuant to Article 5, Paragraph 2 of Taiwan's Money Laundering Control Act, virtual currency platform operators are included within the scope of regulation under the Money Laundering Control Act. Investors can also query the list of compliant operators through the "List of Virtual Currency Platforms and Transaction Business Enterprises that Have Completed Anti-Money Laundering Legal Compliance Statements" published by the FSC. Investment invariably carries risks; there is no such thing as a sure-win investment. Whether investing domestically or abroad, one must pay close attention to the trading counterpart and trading platform, and be particularly mindful of whether the investment process might involve criminal provisions related to money laundering.