Nobody does the dark side of the internet better than the Russians. From AllOfMP3.com, once the world's most popular piracy site, to the campaign to disrupt the U.S. presidential election, Moscow's hackers have long been world leaders in cybercrime. So it's no wonder Russian computer geniuses are heavily involved in the internet's latest craze: virtual currency. And it's not just attracting cybercriminals—the Kremlin wants to get in on the cryptocurrency revolution by issuing state-backed "bit-ruble."
Cryptocurrencies, such as bitcoin, work on a technology known as blockchain, a decentralized network of synchronized online registries that track the ownership and value of each token. They can be used as virtual cash and traded like currency. Private companies can issue their own virtual currencies to finance specific ventures, similar to crowdfunding or bonds. And their future value can also be traded, like options.
With approximately $70 billion in bitcoins in circulation and more than 100,000 merchants around the world—including Russia's largest online retailer, Ulmart—accepting similar forms of payment, "suddenly everyone has to take cryptocurrency seriously," says Richard Titus, an investor of cybermoney. Virtual currencies are also a potential bonanza for money launderers, online blackmailers and cybercriminals—especially in Russia. And with the market still basically unregulated, Titus warns, "it's definitely the Wild West." Even JPMorgan Chase CEO Jamie Dimon, usually a bull on tech innovation, warned in September that virtual currencies are "a fraud.… It won't end well. Someone is going to get killed. It will blow up."
Russians have been involved in cryptocurrencies since their inception in the mid-2000s. Criminals used the first virtual currencies, such as e-gold, to commit cross-border credit card fraud. The original technology was "mostly U.S.-based, but it was always linked to Russia," where 80 to 90 percent of global card fraud activity took place, says Alexander Klimburg, author of The Darkening Web, a newly published examination of cybersecurity threats.
Related: A Russian accused of using bitcoin to launder $4 billion is indicted by a U.S. jury
The Kremlin has long been wary of cryptocurrencies, which are technically illegal in Russia—yet the government recently signaled it's changing its stance. At the St. Petersburg International Economic Forum in June, President Vladimir Putin announced that Russia was considering launching its own "digital ruble" and praised the possibilities of virtual currencies. A group of financial institutions under the supervision of the Russian Central Bank is testing a proprietary "master chain" based on a popular platform called Ethereum that could be used to issue bit-rubles.
There's even been talk of creating a supranational cryptocurrency for the emerging BRICS nations—Brazil, Russia, India, China and South Africa—as "a good alternative to the dollar," Kirill Dmitriev, head of the Russian Direct Investment Fund, told state-run news agency Ria Novosti in August. Though the entire sum of cryptocurrencies in the world remains under $100 billion, a long way off the estimated 10.2 trillion U.S. dollars, the idea of undermining America's dominion as owner of the world's chief reserve currency appeals to Putin, who recently called for the BRICS nations "to overcome the excessive domination of the limited number of reserve currencies."
There are other legitimate reasons Moscow is interested in cashing in on cryptocurrencies. The Kremlin is keen to attract the enormous cash flow being poured into blockchain projects around the world. It also wants to open up Russia to the bitcoin mining industry, in which anyone can claim newly issued bitcoins—generated automatically by a preprogrammed, blockchain-based computer network—by solving extremely complex codes that unlock each new coin.
China is the world leader in bitcoin mining, with miners deploying huge power-hungry computer server banks to crunch the necessary numbers—and Moscow is eager to get into that business. Putin aide Dmitry Marinichev predicts that "Russia has the potential to reach up to 30 percent share in global cryptocurrency mining in the future," which at current values would mean a $100 million annual market share for Russia.
The Russian Central Bank is also exploring the use of cryptocurrency to help regulate the country's notoriously corrupt banking system, with dubious financiers frequently making loans to fake companies, then closing down, leaving the government to return depositors' money. Cryptocurrencies are traceable, which would allow closer oversight of where a bank's money is going.
It's the third reason for Russia's interest in virtual currencies that has international law enforcement agencies worried: their use as money laundering tools. Unlike with cash, all cryptocurrency transactions are recorded. That makes them perfectly trackable, so it's easy to monitor dealings between legitimate businesses. However, the problem is that ownership of virtual cash isn't necessarily attributable to people or businesses. And digital currency units can be anonymized by putting them through what's known as a tumbler, a service that changes the owner's identity by exchanging the tokens with ones belonging to other users also seeking anonymity. That gives virtual money the potential to become the perfect klepto-currency for anyone with shady motives—and it can be moved around the world with a few keystrokes.
One of the most high-profile Russian fans of cryptocurrencies is lawmaker and former KGB officer Andrei Lugovoi, the prime suspect in the fatal 2006 poisoning of former Russian spy Alexander Litvinenko in London. Lugovoi is one of dozens of Russian officials and businessmen who are forbidden from traveling to or holding assets in Europe or the United States. Some have been the target of international sanctions because of their support of Moscow's annexation of the Crimea, or their role in the 2009 killing of anti-corruption lawyer Sergei Magnitsky, or, like Lugovoi, their outstanding arrest warrants for crimes in the West. Despite being a murder suspect in the U.K., Lugovoi is deputy chair of the Duma committee on security and anti-corruption—and in this role, he appeared at an April cryptocurrency forum in Moscow to praise blockchain-based currencies. He argued that virtual money would allow Russian companies—he tactfully didn't mention individuals—to get around Western restrictions. "This is a rare situation where the sanctions policy of the West gives rise to the opportunity for our own businesses to create something new," he said.
Russians have certainly been prolific at creating new—and often bizarre—cryptocurrencies. ZrCoin, for instance, raised over $7 million from its "initial coin offering" (the crypto equivalent of an initial public offering) in April for a project to recover zirconium from industrial waste in Magnitogorsk, Russia. The value of each ZrCoin is backed, says the company, by a kilogram of synthetic zirconium.
Earlier this year, one Moscow region farmer, Mikhail Shlyapnikov, raised over $2 million in two months by issuing his farm's virtual currency. Known as the Kolion—named after Shlyapnikov's village of Kolionovo and based on the agricultural production of his farm—the currency had doubled in value since it was launched in May. Even Russian Burger King has gotten involved, issuing loyalty tokens called Whoppercoins, which can be exchanged for burgers but also swapped and traded on the peer-to-peer Waves blockchain platform.
Many of these virtual currencies look like gimmicks. But money launderers are poised to take advantage of Russia's cryptocurrency revolution too. The Organized Crime and Corruption Reporting Project, a nongovernmental organization, recently updated its 2014 study titled "The Russian Laundromat Exposed" to include the latest details of a vast and sophisticated network of offshore banks and shell companies that Kremlin-connected oligarchs use to flout sanctions and park stolen money—so far, in conventional ways. Between 2011 and 2017, the NGO reported, more than 20 Russia-connected shell companies fired out 26,746 transfers to launder some $20.8 billion—through a single scheme.
Blockchain currencies could make that type of laundering much easier. Virtual currencies "are a potential nightmare for investigators," says one former U.S. law enforcement official with experience in Moscow, who asked for anonymity because of his ongoing consulting work for government clients. "It's pretty easy to trace how money goes from bank to bank. Same for bitcoins…. You know what online entity owned them at what time. But [who] is behind that online identity? Laundering is all about creating fake ownership. That's where cryptocurrency's anonymity becomes a problem."
It's a strange irony that both Russian criminals and the government should favor cryptocurrencies—one as a means of money laundering, the other as a way to trace government money. But blockchain technologies are flexible enough to do both. The U.S. Treasury and the Russian Central Bank have announced plans to regulate the market, though it's not clear how new rules would control virtual currency trading conducted outside their national jurisdictions. "The Russians are drafting legislation, but that is laughable," says Klimburg. "The whole country is a massive money laundering and tax-evasion operation."
Blockchain technologies have other criminal applications too. They're a gold mine for hackers with access to giant networks of computers known as botnets. A bot is a computer that has been infected with a type of virus known as a Trojan horse that allows the botnet's owner to remotely control the machine. Botnets can number in the hundreds of thousands of machines and are normally used to generate enormous traffic that can crash websites. Their disruptive power allows them to be weaponized to demand ransom money or wage political warfare.
Back in 2007, Russian hackers showed the offensive capability of botnets for the first time when they attacked and briefly crashed much of tiny Estonia's e-infrastructure. Most recently, though, botnets have been put to a different use: stealing computer capacity to crack the codes of new bitcoins.
Legitimate bitcoin miners have to invest in expensive, power-hungry computer equipment and cut deals with power companies to buy their spare electricity. (Russian energy giants Gazprom and EuroSibEnergo recently announced that they were negotiating the sale of cheap megawatts to around 70 bitcoin-mining companies.) But bot masters simply steal that computing capacity by hijacking strangers' computers. The latest example was a group of hackers—"probably North Korean actors based in China," according to Klimburg—who in late April used a vulnerability in the Windows operating system to create a botnet they used for bitcoin mining.
That vulnerability—known in the trade as an "exploit"—was most likely discovered by the U.S. National Security Agency as a hacking tool that could be used to get into computer systems via faults in programs. The exploit, dubbed "EternalBlue," was probably one of thousands of hacking tools stolen from the agency's highly sensitive Tailored Access Operations by Navy reservist Harold Martin III, a former contractor for Booz Allen Hamilton indicted in October 2016 for absconding with approximately 50 terabytes of secret hacks and other data from the NSA and CIA. Exactly how the EternalBlue exploit got into the hands of a hacker group called Shadow Brokers—closely linked to Russia's Federal Security Service—isn't clear. But on April 14, hackers leaked the exploit code online, free for any hacker who wanted to use it. Within two weeks, over 230,000 computers in 150 countries had been infected with viruses using EternalBlue.
The North Korean bitcoin miners were the first to take advantage of this backdoor. But others soon followed, using EternalBlue to distribute viruses called WannaCry and NotPetya. Both so-called ransomware programs threatened to destroy the infected computer's system unless they received a payment in bitcoins. By May 12, WannaCry had frozen large parts of the computer systems of Britain's National Health Service, Spain's Telefónica, Germany's Deutsche Bahn and FedEx.
Cryptocurrencies may not be inherently dubious. But it's clear that there's a deep crossover between the worlds of hacking and the darker corners of the cryptocurrency world. As huge sums of money start to pour into the market—bitcoin grew 7.5 times in value over the past year alone, and Ethereum's flagship token, the ether, was up 4,000 percent for the year earlier this summer—it is turning into a playground for brilliant entrepreneurs, risk-hungry investors and inventive criminals. Russia, with its unique nexus of computer genius and money laundering expertise, looks set to become the new cryptocurrency world's Wild East.
