Liberty Reserve Case Exposes New Frontiers in Laundering Digital Cash

The takedown of a global currency exchange that prosecutors say was the largest online money laundering operation in history has exposed digital currency as a surprisingly effective method of washing money, including drug trafficking profits.

More than $6 billion was laundered through Liberty Reserve, a Costa Rica-based company that allowed its more than one million customers, of which 200,000 were U.S. citizens, to open accounts and move money anonymously using its virtual currency. From 2006 through 2013, Liberty Reserve was the “bank of choice for the criminal underworld,” serving computer hackers, identity thieves, child pornographers and drug traffickers, according to a US federal indictment unsealed last week.

Although the indictment did not state who, exactly, was using Liberty Reserve to launder money, Tom Kellermann, a vice president at security company Trend Micro, said that recent investigations have shown that international drug cartels have “migrated” online to launder money. “This is just the tip of the iceberg,” Kellermann told InSight Crime by e-mail.

The shutdown of Liberty Reserve’s website, along with new federal rules that aim to make digital currencies comply with money laundering laws, has made it clear that US law enforcement has digital currencies within its sights. But policing them is hardly simple: Liberty Reserve is just one of many online currency exchange systems that require little more than an e-mail address to sign up. Panama-based Perfect Money and Russia-based WebMoney are two more, although both no longer take dollars from US customers in an apparent attempt to not run afoul of the new laws. And exchangers of Bitcoin, a crypto-currency used in some forms of e-commerce, have also found themselves under increasing government scrutiny.

“You will see after a couple of weeks that the system will be rebooted,” said Aditya Sood, a senior consultant for computer security firm IOActive who has published extensively on cyber crime. Criminals, he said, “will shift to other systems because this is such a huge market, and there will be a rise in other e-currencies.”

Liberty Reserve was, in effect, a bank that issued its own digital currency. The key to Liberty’s system was that it never actually received deposits, but instead used a series of middlemen, or money exchangers, who bought the currency in bulk and then sold smaller portions to people looking to convert money into the digital currency.

It worked like this: customers opened an account with Liberty Reserve, using an e-mail address, along with a name and physical address, both of which could be fake. They then transferred money to one of the money exchangers, who deposited an equivalent amount of Liberty Reserve currency in the account for a five percent transaction fee. The illegal money exchangers tended to be in countries with little government oversight, such as Malaysia, Russia, Nigeria, and Vietnam, according to the indictment.

Once the money was in the Liberty Reserve currency, it could be exchanged between other Liberty Reserve customers, for anything from hacking services to stolen credit card information to drugs. One undercover agent, listing his name as “Joe Bogus,” went so far as to classify his transactions as “for the cocaine,” without attracting notice. Liberty Reserve charged a one percent fee for every transaction, far below any bank rate, and a 75 cent privacy fee to ensure untraceability.

“Once it gets into the e-currency model, it’s untraceable. It’s just a number,” said Sood.

To withdraw money, the process was reversed, with the Liberty Reserve currency going back to a money exchanger who then turned it into any standard currency — dollars, euros, rubles. “You don’t have to be technology-savvy to do this,” said Sood. “With Liberty Reserve, you simply reserved your account.”

Hackers were among those who took full advantage of Liberty Reserve. One group used it to wash and divide proceeds from a $45 million heist of two Middle Eastern banks. That group, whose suspected ringleader was shot dead in the Dominican Republic in April, hacked into prepaid debit cards, raised their limits, and then pulled out enormous sums at ATMs around the world. Sood said other hackers had even targeted Liberty itself, exploiting a hole in the system that set off “money warfare among the cybercriminals.”

Liberty Reserve was incorporated in 2006 in Costa Rica by Arthur Budovsky, an American who renounced his citizenship after marrying a Costa Rican national in 2008. Budovsky was arrested last week in Spain, and the Associated Press has since reported that he may have paid his Costa Rican wife to marry him as a way to gain citizenship in a country that lacks an extradition treaty with the United States. Before moving to Costa Rica in 2006, Budovsky and his partner Vladimir Kats — also arrested and charged in the indictment — were prosecuted for running an unlicensed money transmitting business that used E-Gold, a popular digital currency that is now defunct.

The US government has seized a number of bank accounts worldwide, worth $25 million, that belonged to Budovsky, Kats, and other defendants in the case. Including Budovsky and Kats, a total of seven former and current employees of Liberty Reserve were charged in the indictment, including four from Costa Rica. Two of the Costa Ricans charged remain at large.

Juan Carlos Esquivel, a Costa Rican lawyer and expert on international money laundering, told InSight Crime that nothing about Costa Rica’s e-commerce laws would have made Costa Rica more attractive to Budovsky than other countries.

“It could have been Panama, Guatemala, or any island in the Caribbean,” he said. “Obviously there could have been more regulations, but with money laundering you are always one step behind.”

For anyone with money in Liberty Reserve when the company was taken down, it is likely gone forever, Sood said. But the shutdown of Liberty Reserve does not signal the end of digital currencies being used to launder money: far from it, say experts.

Brian Krebs, a former Washington Post journalist and cyber security analyst, wrote on his blog that the cyber crime underground has already turned its attention to figuring out “what virtual currency would be the safest going forward.” Krebs expects the Russia-based WebMoney will be the likeliest to prosper in the short term.

What’s likely to emerge over time, Krebs wrote, are more independently run, forum-specific currencies and exchanges without ties to a particular country, or based in countries hostile or cool to the United States.

And then there is the question of Bitcoin, another digital currency that has been grabbing headlines for its wild swings in value. But Bitcoin is very different from Liberty Reserve, WebMoney, or the Panama-based Perfect Money. These virtual currencies are pegged to the U.S. dollar, whereas Bitcoin is a currency wholly invented by an anonymous hacker. The Bitcoins themselves — which are in no way hard coins but bits — can be transferred in a peer-to-peer network of users, without resorting to a centralized system such as Liberty Reserve had. There are currently about 11 million Bitcoins in circulation.

“Bitcoin can’t be shut down. It is a distributed protocol for moving bits around,” Nicolas Christin, a computer and information security researcher and professor at Carnegie Mellon University, told InSight Crime in an email. “That those bits are assigned a monetary value has nothing to do with the protocol itself, but with market forces.”

In theory, Bitcoin could be used to launder money: it provides anonymity, which is why it is popular among customers of Silk Road, a $1.2 million-a-month online marketplace for illegal drugs. Bitcoin’s coding traces the movement of every coin as a fraud-protection measure, but special “laundries” of Bitcoins have been set up to obscure this tracing feature. Still, the same market forces that cause Bitcoin values to fluctuate make it a less attractive option for launderers.

Will Bitcoin exchanges be targeted next? There’s some evidence to suggest so. The largest Bitcoin exchange, Mt. Gox, had its US accounts seized recently because it was not in compliance with anti-money laundering laws for money transmitters.

“Whether, in practice, Bitcoin could survive without functioning semi-central exchanges, like Mt. Gox, is anyone’s guess, but the protocol provides flexibility,” Christin said.

Clearly the US government is applying the narcotics model — that is, going after the illicit money first, as it will be difficult, if not impossible, to target the criminals themselves. Sood explained that the users of Liberty Reserve were so well hidden through false identities and the untraceable virtual currency that “it’s hard to figure out who to prosecute.” And they will move on to other virtual currencies that will be much more complex. “It’s an arms race,” he said.