The US Department of Justice (DOJ) on 24 April 2024 announced the arrest of two co-founders of a cryptocurrency mixer called Samourai. It seized the service for allegedly facilitating over $2 billion in illegal transactions and laundering more than $100 million in criminal proceeds. Keonne Rodriguez, 35, and William Lonergan Hill, 65, have been charged with conspiracy to commit money laundering and conspiracy to operate an unlicensed money-transmitting business from 2015 through February 2024. Rodriguez and Hill face a maximum sentence of 25 years in prison each.[1]
Rodriguez, the company's CEO, and CTO Hill intentionally designed Samourai to help "criminals engage in large-scale money laundering and sanctions evasion" while ostensibly marketing it as a privacy-oriented service, the DoJ reported. Samourai laundered money from illegal dark web marketplaces, including Silk Road and Hydra, and spear-phishing schemes and scams aimed at defrauding multiple decentralized finance protocols.
The operation, which also involved law enforcement agencies from Iceland and Portugal and Europol, saw its digital infrastructure confiscated and its Android app pulled from the Google Play Store in the US. Hill, who was apprehended in Portugal, is awaiting his extradition to the US. Rodriguez was taken into custody in Pennsylvania.
Samourai offered a cryptocurrency mixing service known as Whirlpool to help users conceal the cryptocurrency transaction trail. It also incorporated an "exclusive transaction type" called Ricochet Send that made it possible to add intermediate hops when sending cryptocurrency from one address to another. Whirlpool was advertised as a way to "mathematically disassociate the ownership of inputs to outputs in a given Bitcoin transaction," which they claimed increases the privacy of the users involved, protects against financial surveillance, and improves the ease of exchange of the Bitcoin network.
See: https://redskyalliance.org/xindustry/closing-the-laundromat
Ricochet defends against Bitcoin blacklists by adding additional decoy transactions between the initial send and eventual recipient," according to the official documentation. "You should consider using Ricochet when sending to Bitcoin Exchanges and companies known to close accounts for flimsy reasons. The feature is engineered to prevent law enforcement and/or cryptocurrency exchanges from recognizing that a particular batch of cryptocurrency originated from criminal activity, the DOJ alleged.
Besides openly courting users (e.g., Russian oligarchs) to circumvent sanctions and launder criminal proceeds through Samourai on their X (formerly Twitter) account, the defendants have also been found transmitting to investors marketing materials that described how its user base was intended to include online gamblers and criminals who need the anonymity to conduct their illegal activities. "Rodriguez and Hill acknowledge that its revenues will be derived from 'Dark/Grey Market participants' seeking to 'swap their bitcoins with multiple parties' to avoid detection," the DoJ said.
The arrests come weeks after a former security engineer named Shakeeb Ahmed was sentenced to three years in prison in the US for charges relating to hacking two decentralized cryptocurrency exchanges in July 2022 and stealing over $12.3 million, which were then laundered using Samourai Whirlpool.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://thehackernews.com/2024/04/doj-arrests-founders-of-crypto-mixer.html
Comments