FOGINT: FBI Nabs Alleged Crypto Swindlers
October 23, 2024
Nowhere does the phrase “buyer beware” apply more than the cryptocurrency market. But the FBI is on it. Crypto Briefing reports, “FBI Creates Crypto Token to Catch Fraudsters in Historic Market Manipulation Case.” The agency used its “NexFundAI” token to nab 18 entities—some individuals and also four major crypto firms: Gotbit, ZM Quant, CLS Global, and MyTrade. The mission was named “Operation Token Mirrors.” Snazzy. Writer Estefano Gomez explains:
“The charges stem from widespread fraud involving market manipulation and ‘wash trading’ designed to deceive investors and inflate crypto values. Working covertly, the FBI launched the token to attract the indicted firms’ services, which allegedly specialized in inflating trading volumes and prices for profit. The charges cover a broad scheme of wash trading, where defendants artificially inflated the value of more than 60 tokens, including the Saitama Token, which at its peak reached a market capitalization of $7.5 billion. The conspirators are alleged to have made false claims about the tokens and used deceptive tactics to mislead investors. After artificially pumping up the token prices, they would cash out at these inflated values, defrauding investors in a classic ‘pump and dump’ scheme. The crypto companies also allegedly hired market makers like ZM Quant and Gotbit to carry out these wash trades. These firms would execute sham trades using multiple wallets, concealing the true nature of the activity while creating fake trading volume to make the tokens seem more appealing to investors.”
If convicted, defendants could face up to two decades in prison. Several of those charged have already pled guilty. Authorities also shut down several trading bots used for wash trades and seized over $25 million in cryptocurrency. Assistant US Attorney Joshua Levy stresses that wash trading, long since illegal in traditional financial markets, is now also illegal in the crypto industry.
Cynthia Murrell, October 23, 2024
Flappy Bird Flutters to Life Thanks to the Power of the New Idol, Crypto
October 15, 2024
Just a humanoid processing information related to online services and information access.
Flappy Bird is coming out of retirement after a decade away. Launched in 2013, the original game was wildly popular and lucrative. However, less than a year later, its creator pulled it from app stores for being unintentionally addictive. Subsequently, players/addicts were willing to pay hundreds or thousands of dollars for devices that still had the game installed. Now it has reemerged as a Telegram crypto game. Much better. Decrypt reports, “What Is ‘Flappy Bird’ on Telegram? Iconic Game Returns with Crypto Twist.” Writer Ryan S. Gladwin tells us the game is basically the same as before, with a few additions just for crypto bros:
“Developed by the Flappy Bird Foundation, the Telegram game mixes in elements from other crypto games on the app, including the likes of Hamster Kombat, by allowing players to passively earn in-game points by obtaining upgrades. These are earned through a variety of ways, including watching ads and inviting friends.”
Naturally, a custom Flappy Bird token will be introduced. And, as with most of this year’s “tap-to-earn” games, it will reside on Telegram’s decentralized network, simply named The Open Network (TON). We learn:
"Yes, there will be a FLAP token launched in relation with the Telegram version of Flappy Bird. This has been confirmed in tweets from the official game account on Twitter (aka X), and the game will also offer staking rewards for the future token. Previously, The Flappy Bird Foundation said that it has plans to integrate The Open Network (TON)—the network that most tap-to-earn games launch tokens on. Notcoin, the tap-to-earn game that started the Telegram craze with the largest crypto gaming token launch of the year, is the ‘strategic publishing partner’ for Flappy Bird’s return. This partnership is set to help introduce The Open Network (TON) ecosystem to Flappy Bird with the game starting a ‘free mining event’ at launch called ‘Flap-a-TON.’ A mining event is usually a period of time in which players can make gameplay progress to get a cut of a future token airdrop.”
What a cutting-edge way to maximize engagement. If he was so upset about his game’s addictive qualities, why did creator Dong Nguyen sell it to an outfit that meant to crypto-tize it? In fact, he did not. After the game languished for four years, the trademark was deemed abandoned. A firm called Mobile Media Partners Inc. snapped up the languishing trademark and later sold it to one Gametech Holdings LLC, from whom the Flappy Bird Foundation bought it earlier this year. That must have been quite a surprise to the conscientious developer. Not only were Nguyen’s wishes for his game completely disregarded, he is receiving no compensation from the game’s reemergence. Classy.
Cynthia Murrell, October 15, 2024
FOGINT: A Doggie Telegram Play in the Mists of Crypto
October 8, 2024
The FOGINT team has noticed an uptick about the Simplex messenger. You can download the end to end encrypted application from this link. According to chatter on interesting discussion services, individuals espousing certain beliefs are abandoning Telegram because Mr. Freedom (Pavel Durov is allegedly cooperating with law enforcement and other government officials in certain investigation). The causal link between Simplex and Telegram’s new, flexible approach to allegedly illegal activities may be clear to some people. That’s fine.
Some people will not be aware that the sheep are ignoring a government worker wearing a rather poor sheep disguise. Thanks, MSFT Copilot. How are those Windows updates going? Oh, how about those security changes?
However, Telegram continues to push into territory far more significant than fooling around with the craziness of those who use Telegram to organize traffic jams and sell contraband. The big fish is now on the dock. The fish mongers are crowding around to find out the value of the snatch.
“The First Telegram ICO Is Here: Dogizen, Launches Today” reveals what may be a more significant move in the underground financial ecosystem. The FOGINT teams thinks that Telegram is doing its part to undermine the US dollar, not make weird animal games available to people who want free money. The article reported on October 4, 2024:
This is the first ICO to offer investors the chance to purchase the DOGIZ token directly from within Telegram itself and could open up a whole new slice of the crypto community. DOGIZ will go on sale at $0.00007, with a total of one hundred billion presale tokens available for purchase. Dogizen finds itself in the midst of Telegram gaming’s surge, which has recently gained attention with multiple successful launches, collectively amassing a market cap nearing $2 billion in just six months.
Telegram ran into a brick wall several years ago when the US Securities & Exchange Commission blocked the messaging company’s initial foray into crypto. Now the Telegram plan is coming into focus. There are STARs, TONcoins, and deals with outfits like Tether. This play with doggies is a transactional platform applied to providing for a fee the plumbing necessary to ramp crypto with essentially zero friction. The estimable Durov brothers are demonstrating that there is more to a messaging application than groups, channels, advertising, and faux compliance with government officials.
The Durovs are doggies who want to grow up to be wolves.
Stephen E Arnold, October 8, 2024
Russian Crypto Operation: An Endgame
October 3, 2024
![green-dino_thumb_thumb_thumb_thumb_t[2]](https://arnoldit.com/wordpress/wp-content/uploads/2024/09/green-dino_thumb_thumb_thumb_thumb_t2-2.gif "green-dino_thumb_thumb_thumb_thumb_t[2]")
This essay is the work of a dumb dinobaby. No smart software required.
The US Department of the Treasury took action to terminate “PM2BTC—a Russian virtual currency exchanger associated with Russian individual Sergey Sergeevich Ivanov (Ivanov)—as being of “primary money laundering concern” in connection with Russian illicit finance.” The DOT’s news release about the multi-national action is located at this link. Fogint has compiled a list of details about this action.
The write up says:
Today, the U.S. Department of the Treasury is undertaking actions as part of a coordinated international effort to disrupt Russian cybercrime services. Treasury’s Financial Crimes Enforcement Network (FinCEN) is issuing an order that identifies PM2BTC—a Russian virtual currency exchanger associated with Russian individual Sergey Sergeevich Ivanov (Ivanov)—as being of “primary money laundering concern” in connection with Russian illicit finance. Concurrently, the Office of Foreign Assets Control (OFAC) is sanctioning Ivanov and Cryptex—a virtual currency exchange registered in St. Vincent and the Grenadines and operating in Russia. The FinCEN and OFAC actions are being issued in conjunction with actions by other U.S. government agencies and international law enforcement partners to hold accountable Ivanov and the associated virtual currency services.
Here’s a selection of the items which may be of interest to cyber crime analysts and those who follow crypto activity.
- Two individuals were added to the sanctions list: Sergey Ivanov and Timur Shakhmametov. A reward or bounty has been offered for information leading to the arrest of these individuals. The payment could exceed US$9 million
- The PM2BTC and Cryptex entities has worked or been associated with other crypto entities; possibly Guarantex, UAPS, Cryptex, Hydra, FerumShop, Bitzlato, and an underground payment processing service known as Bitzlato
- Among the entities working on this operation (Endgame) were Europol, Germany, Great Britain, Latvia, Netherlands, and the US
- In 2014, the two persons of interest want to set up an automated (smart) service and may have been working with PerfectMoney and Paymer
- The activities of Messrs. Ivanov and Shakhmametov involved “carding” and other bank-related fraud
Russian regulations provide wiggle room for certain types of financial activity not permitted in the US and countries associated with this take down.
Several observations:
- The operation was large, possibly exceeding billions in illegal transactions
- The network of partners and affiliated firms illustrates the appeal of illegal crypto services
- One method of communication used by PM2BTC was Telegram Messenger.
- “The $9 Million US reward / bounty for those two Russian crypto exchange operators wanted by US DOJ is a game changer due to the enormous reward,” Sean Brizendine, blockchain researcher told the FOGINT team.
Additional information may become available as the case moves forward in the US and Europe. FOGINT will monitor public information which appears in Russia and other countries.
Stephen E Arnold, October 3, 2024
Hamster Kombat: Does It Matter?
October 2, 2024
![green-dino_thumb_thumb_thumb_thumb_t[2]_thumb_thumb](https://arnoldit.com/wordpress/wp-content/uploads/2024/09/green-dino_thumb_thumb_thumb_thumb_t2_thumb_thumb-3.gif "green-dino_thumb_thumb_thumb_thumb_t[2]_thumb_thumb")
This essay is the work of a dumb dinobaby. No smart software required.
The Fogint team pays attention to crypto plays like Hamster Kombat. Those engaged in cyber fraud investigations, analysis, and research may want to take a quick look at what is called a “click to earn” game. I was asked the question at a recent lecture to cyber fraud professionals, “Why should I care about Hamster whatever?” This free, public blog is not the place for a detailed answer. However, I am willing to share several observations offered by Coin Telegraph.
First, check out this chart. From zero users in late March 2024 to a few weeks ago. The hockey stick is what is reported at 300 million users. Anecdotal information suggests that one third may be agentic; that is, bots. And “only” 100 million are people looking to make a quick buck on a crypto play.
Note that the chart only shows growth through June 2024. The number cited above is derived by normalizing user estimates from a range of sources which the Fogint team has compiled and reviews on a daily basis.
Second, the word game does not convey exactly what Hamster Combat and similar “games” offer their users. Cointelegraph.com reports that an expert named Sébastien Borget uses the phrase “play to earn games.” The question some may pose is, “What is a play to earn game?” The clicks on icons or the actions of the user generate money in the form of crypto for those who play them. The easiest way to understand the business model is to get a burner mobile phone, a pay-as-you-go SIM, a disposable email address, and the Telegram app. Search for Hamster Kombat and “play.” If you cannot figure out the interface, ask a mobile-dependent teen.
Third, this facet of Telegram is one that helps differentiate its “games” from those available on other platforms. Everything in Hamster Kombat is about revenue generation, the belief that the HMSTR coin will be increasingly valuable, and the addictive nature of clicks, buying software items from Hamster Kombat, and becoming “addicted” to or dependent upon the Open Network, a “spin off” or “spin up” from Telegram and its plumbing.
The Fogint team believes that Telegram itself will be monitoring more closely than the fate of Pavel Durov (Telegram’s founder who is possibly enjoying the ministrations of the French bureaucracy) how the TON blockchain handles validation. This process is not going to be explained in this blog post, but for those who are curious, just email benkent2020 at yahoo dot and a Fogint professional will respond with options for getting more information about what is likely to be a significant digital fraud event in 2025. “INDOAX Exchange the first Exchange to list Hamster Kombat coin does not allow US residents to open accounts,” Sean Brizendine, blockchain researcher told the FOGINT team.
When this post becomes public, the mining of HMSTR coins will be underway. Hamster Kombat is a combination of old-fashioned online games, crypto mining, and human enthusiasm to get rich quick. And what does one need to join in the craze? The Telegram application and the mini app Hamster Kombat.
Stephen E Arnold, October 2, 2024
Solana: Emulating Telegram after a Multi-Year Delay
September 27, 2024
This essay is the work of a dumb dinobaby. No smart software required.
I spotted an interesting example of Telegram emulation. My experience is that most online centric professionals have a general awareness of Telegram. Its more than 125 features and functions are lost in the haze of social media posts, podcasts, and “real” news generated by some humanoids and a growing number of gradient descent based software.
I think the information in “What Is the Solana Seeker Web3 Mobile Device” is worth noting. Why? I will list several reasons at the end of this short write up about a new must have device for some crypto sensitive professionals.
The Solana Seeker is a gizmo that embodies Web3 goodness. Solana was set up to enable the Solana blockchain platform. The wizards behind the firm were Anatoly Yakovenko and Raj Gokal. The duo set up Solana Labs and then shaped what is becoming the go-to organization Lego block for assorted crypto plays: The Solana Foundation. This non-profit organization has made its Proof of History technology into the fires heating the boilers of another coin or currency or New Age financial revolution. I am never sure what emerges from these plays. The idea is to make smart contracts work and enable decentralized finance. The goals include making money, creating new digital experiences to make money, and cash in on those to whom click-based games are a slick way to make money. Did I mention money as a motivator?
A hypothetical conversation between two crypto currency and blockchain experts. What could go wrong? Thanks, MSFT Copilot. Good enough.
How can you interact with the Solana environment? The answer is to purchase an Android-based digital device. The Seeker allows anyone to have the Solana ecosystem in one’s pocket. From my dinobaby’s point of view, we have another device designed to obfuscate certain activities. I assume Solana will disagree with my assessment, but things crypto evoke things at odds with some countries’ rules and regulations.
The cited article points out that the device is a YAAP (yet another Android phone). The big feature seems to be the Seed Vault wallet. In addition to the usual razzle dazzle about security, the Seeker lets a crypto holder participate in transactions with a couple of taps. The Seeker interface is to make crypto activities smoother and easier. Solana has like other mobile vendors created its own online store. When you buy a Seeker, you get a special token. The description I am referencing descends into crypto babble very similar to the lingo used by the Telegram One Network Foundation. The problem is that Telegram has about a billion users and is in the news because French authorities took action to corral the cowboy Russian-born Pavel Durov for some of his behaviors France found objectionable.
Can anyone get into the generic Android device business, do some fiddling, and deploy a specialized device? The answer is, “Yep.” If you are curious, just navigate to Alibaba.com and search for generic cell phones. You have to buy 3,000 or more, but the price is right: About US$70 per piece. Tip: Life is easier if you have an intermediary based in Bangkok or Singapore.
Let’s address the reasons this announcement is important to a dinobaby like me:
- Solana, like Meta (Facebook) is following in Telegram’s footprints. Granted, it has taken these two example companies years to catch on to the Telegram “play”, but movement is underway. If you are a cyber investigator, this emulation of Telegram will have significant implications in 2025 and beyond.
- The more off-brand devices there are, the easier it becomes for intelligence professionals to modify some of these gizmos. The reports of pagers, solar panels, and answering machines behaving in an unexpected manner goes from surprise to someone asking, “Do you know what’s in your digital wallet?”
- The notion of a baked in, super secret enclave for the digital cash provides an ideal way to add secure messaging or software to enable a network in a network in the manner of some military communication services. The patents are publicly available, and they make replication in the realm of possibility.
Net net: Whether the Seeker flies or flops is irrelevant. Monkey see, monkey do. A Telegram technology road map makes interesting reading, and it presages the future of some crypto activities. If you want to know more about our Telegram Road Map, write benkent2020 at yahoo.com.
Stephen E Arnold, September 27, 2024
Is Crypto the Funding Mechanism for Bad Actors?
December 6, 2023
This essay is the work of a dumb dinobaby. No smart software required.
Allegations make news. The United States and its allies are donating monies and resources to Israel as they fight against Hamas. As a rogue group, Hamas is not as well-funded Israel and people are speculative about how it is financing its violent attacks. The Marketplace explains how the Palestinian group is receiving some of its funding and it’s a very obvious answer: “Crypto Is One Way Hamas Gets Its Funding.” David Brancaccio, host of the Marketplace Morning Report, interviewed former federal prosecutor and US Treasury Department official and current head of TRM Labs, Ari Redford. TRM Labs is a cryptocurrency compliance firm. Redford and Brancaccio discuss how Hamas uses crypto.
Hamas is subject to sanctions from the US Treasury Department, so the group’s access to international banking is restricted. Cryptocurrency allows Hamas to circumvent those sanctions. Ironically, cryptocurrency might make it easier for authorities to track illegal use of money because the ledger can’t be forged. Crypto moves along a network of computers known as blockchains. The blockchains are public, therefore traceable and transparent. Companies like TRM allow law enforcement and other authorities to track blockchains.
The US Department of Justice, IRS-CI, and FBI removed 150 crypto wallets associated with Hamas in 2020. TRM Labs is continuously tracking Hamas and its financial supporters, most appear to be in Iran. Hamas doesn’t accept bitcoin donations anymore:
“Brancaccio: I think it was April of this year, Hamas announced it would no longer take donations in bitcoin.. Perhaps it’s because of its traceability? Redbord: Yeah, really important point. And that’s essentially what Hamas itself said that, you know, law enforcement and other authorities have been coming down on their supporters because they’ve been able to trace and track these flows. And announced in April that they would not be soliciting donations in cryptocurrency. Now, whether that’s entirely true or not, it’s hard to say. We’re obviously seeing at least supporters of Hamas go out there raising funds in crypto.”
What will bad actors do to get money? Find options and use them.
Whitney Grace, December 18, 2023
Crypto and Crime: Interesting Actors Get Blues and Twos on Their Systems
January 31, 2023
I read a widely available document which presents information once described to me as a “close hold.” The article is “Most Criminal Crypto currency Is Funneled Through Just 5 Exchanges.” Most of the write up is the sort of breathless “look what we know” information. The article which recycles information from Wired and from the specialized services firm Chainalysis does not mention the five outfits currently under investigation. The write up does not provide much help to a curious reader by omitting open source intelligence tools which can rank order exchanges by dollar volume. Why not learn about this listing by CoinMarketCap and include that information instead of recycling OPI (other people’s info)? Also, why not point to resources on one of the start.me pages? I know. I know. That’s work that interferes with getting a Tall, Non-Fat Latte With Caramel Drizzle.
The key points for me is the inclusion of some companies/organizations allegedly engaged in some fascinating activities. (Fascinating for crime analysts and cyber fraud investigators. For the individuals involved with these firms, “fascinating” is not the word one might use to describe the information in the Ars Technica article.)
Here are the outfits mentioned in the article:
- Bitcoin Fog – Offline
- Bitzlato
- Chatex
- Garantex
- Helix – Offline
- Suex
- Tornado Cash – Offline
Is there a common thread connecting these organizations? Who are the stakeholders? Who are the managers? Where are these outfits allegedly doing business?
Could it be Russia?
Stephen E Arnold, February 1, 2023
FTX: What Does B Stand For?
December 2, 2022
I am not a krypto kiddie. After the mysterious Nakamoto white paper became available, I made an informed judgment: Bad actors will love this crypto thing. My hunch was correct. The meltdown of a crypto wizard and his merry band of tea totaling worker bees have demonstrated that cyber fraud can be entertaining.
I read “Does B Stand for Bankman-Fried or Bankruptcy?” The write up asks a simple question. I noted this passage from the “real” Silicon Valley write up:
SBF said FTX failed on risk management and he didn’t “knowingly co-mingle funds.”
There you go.
Now what does B stand for? Here are my suggestions:
bamboozle – to rip off, fool, or deceive
bane – a source or ruin, harm, or evil
baseborn – a nice way to question one’s family position in society
bebotherer – one who brings trouble
besotted – drunk and incoherent
bonkers — a few cans short of a six pack
brock—a nasty, little, furred creature
I am leaning toward bamboozle but I think brock has a certain charm. Perhaps a combo; to wit:
The brock bamboozled himself and others.
Close enough for horseshoes as the “we’re not talking” analytics folks like to say among friends at lunch.
Stephen E Arnold, December 2, 2022
Simplifying the Geometry of Conscience
November 14, 2022
My first brush with crypto currency was a request to include the topic in a lecture for an outfit running international training programs for law enforcement and intelligence professionals. In 2013, I was in my first year of retirement and interested in what I called CyberOSINT. My definition of the term pivoted on the companies providing tools and software to deal with was grouped under the category of cyber crime. A decade ago, cyber crime was big, but it was propelled by what now seems to have been bad actor minnows.
The hot topics were the Dark Web, forums offering tips and tricks for hacking, and CSAM (child sexual abuse material). Digital currency, specifically Bitcoin, was the lubricant for cyber crime. Therefore, my team and I had no choice but take a look at the Nakamoto white paper, poke into the universities in England beavering away on techniques to deanonymize individual transactions, and the early research efforts of everyone’s favorite online bookstore Amazon. We attended meet ups about digital currency and spoke with seemingly well meaning people who were excited about doing money things without annoying intermediaries and regulatory authorities.
It became clear at least to me and my team that digital currency would become a replacement for paper and coin currencies because [a] money costs a lot to produce, manage, and make counterfeit resistant and [b] values could be whipped up using the juices that bad actors, money launderers, and financial “innovators” have pumping through their veins.
Today digital currencies have become a big financial play. It works… for a while. Then like the tragedy of the commons, the open green field is trashed. I thought about the current big time mess a whiz kid has created. The scale of the fraud makes those early players look less like minnows and more like clueless paramecia with math skills. “Sam Bankman-Fried and the Geometry of Conscience” is an interesting essay. However, it is difficult for a simple and somewhat dull person like myself to understand.
The write up says (and I urge you to read the complete 1,400 word essay. I want to cite one passage, if I may:
On reflection, maybe I’d just try to convince SBF to weight money logarithmically when calculating expected utility (as in the Kelly criterion), to forsake the linear weighting that SBF explicitly advocated and that he seems to have put into practice in his crypto ventures. Or if not logarithmic weighing, then at least some concave utility function—something that makes, let’s say, a mere $1 billion in hand seem better than $15 billion that has a 50% probability of vanishing and leaving you, your customers, your employees, and the entire Effective Altruism community with less than nothing.
Interesting, right.
Here’s my take. The SBF innovator attended MIT. In theory, he was exposed to MIT thinking, which as you may recall, involved taking money from everyone’s favorite poster child for questionable behavior Jeffrey Epstein. Several questions:
- What’s up with an MIT education and inculcation of such quaint concepts as moral behavior?
- Why are individuals willing and able to commit financial fraud when it is comparatively easy to deanonymize some crypto activities?
- Do we need big thoughts like “linear and concave utilities” to explain criminal behavior?
My take. Effective altruism is word salad. Say crypto to me I think of cyber crime. End of story. No Hopf fibration or wordsmithing needed, thank you very much.
Stephen E Arnold, November 14, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
