From payday to payoff: exploring the money laundering strategies of ransomware actors

• In Event: The variety of money laundering: empirical research and criminological perspectives (EUROC)

Abstract

Cybercriminals are commonly assumed to engage in cybercrime for monetary rewards. Like traditional offenders, they must launder their illicit proceeds to obscure the permanent trails in online environments. In this regard, the mainstream narrative is that these offenders engage in complex ways of laundering illicit proceeds because of both the large amounts of their proceeds and the use of new technologies. However, empirical research on the money laundering activities associated with cybercrime has been surprisingly scarce. To address this knowledge gap, the present study analyzes the money laundering of illicit proceeds from 182 Bitcoin addresses belonging to 56 members of the Conti ransomware group by the means of blockchain analysis. The results show that offenders are quite unsophisticated when laundering their illicit proceeds. Most of them (70%) directly transacted with an entity and tend to concentrate 80% or more of their illicit proceeds in one service (69%). In terms of destinations, exchanges and darkweb services are the preferred choice, being involved in 71% and 30% of the transactions respectively. Conversely, the use of mixers is minimal (7%). Implications for research and policy are discussed.

Author

• Mirko Nazzari, Università Cattolica - Transcrime (Milan)