The Fascinating Paradox of Cryptocurrency

This is Recorded Future, inside threat intelligence for cybersecurity.

Dave Bittner:

Hello everyone, and welcome to episode 179 of the Recorded Future podcast. I'm Dave Bittner from the CyberWire.

Our guest this week is Kim Grauer, head of research at Chainalysis, a blockchain intelligence platform provider. She shares the story of her rather whimsical initial interest in blockchain technology, and how it quickly shifted to a serious academic and professional pursuit. We’ll hear her views on cryptocurrency and the impact it’s having on monetary policy around the world, it’s use by criminals, and how initial enthusiasm from investors for anything and everything blockchain related led to a credibility gap that serious researchers are still working to overcome.

Kim Grauer:

I have been working at Chainanalysis for, I just celebrated my three year anniversary, which I was very excited about. I joined right in mid-2017, right before the big cryptocurrency bubble. So I was really excited to change into this industry and for the first few months, be like, all right, I made the right decision here.

I came previously from an economics background, working for the City of New York, the mayor's office in his economic development initiatives. So thinking about how we can fund certain industries and subsidize them, or give them land contracts in order to help with economic development. We did a lot of cost benefit analysis. One thing I focused on and started to get people to pay attention to is blockchain. I'm happy to say now there's actually endorsed Blockchain Week in New York. The consensus event is co-hosted by the organization I used to work for. I got into cryptocurrency when I was studying in graduate school, studying economics. I was forced to take a game theory course, which I actually, now, I appreciate, but at the time, I didn't appreciate it. I had trouble understanding its usefulness.

I had been following cryptocurrency and Bitcoin for a while and decided I was just going to do a paper on Bitcoin. It sounded like a kooky thing to focus an entire year researching. And I came out and I went down the rabbit hole, came out the other end, being really fascinated by this. And then I started to just pay attention to things as the industry developed. And then I went and joined the New York City mayor's office and started to continue to think about cryptocurrency, met up with the co-founder and we talked and he told me they want to start doing research, economics research, can you come on board? And so I left and I've been doing that for three years.

Dave Bittner:

And so what is your day-to-day like these days? What sort of things take up your time and attention?

Kim Grauer:

Right now today, today literally, the past week has been starting to kick off our annual crypto crime report, which is a big project that we take on every year. I don't know if you've seen it or if you're familiar with it, but we try to look at the year in review, see what's going on with crime and educate people to the best of our abilities. Because we're sitting from this point of view where we have access to some of the best data on what's happening in cryptocurrency, to educate people on how criminals are changing, adapting. What's the biggest type of crime, who are the most victims, what type of money laundering infrastructure are we seeing?

And when I'm not focusing on crypto crime, we just completed a really rigorous effort to start talking about the geography of cryptocurrency. Where is the most grassroots level adoption? We spent a long time building out a methodology to pair with our data, to speak more authoritatively about which countries are using cryptocurrency the most.

And this was really born out of a desire to answer what people are using cryptocurrency for. From our crime report we have this high level go to number, about 1 percent of all transfers are associated with illicit activity. And we know what's going on there, but our CEO is asking us, okay, what about the other 99 percent of activity? So we're like, "Yeah, that's a really good point, so let's branch out."

And aside from these two sprint reports, I do a lot of data requests for people who are just trying to learn about the industry, work with journalists, work on writing one-off blogs on criminal activity or things that people should be paying attention to in this space. If there's a big Twitter hack, we go all hands on deck and follow the funds, publish up a blog. And so it's really just focusing on research, cryptocurrency space, and typically criminal activity, but more so generally, economic activity.

Dave Bittner:

You mentioned your own, I guess, skeptical beginnings when it came to cryptocurrency, as you were going through your own learning process. Can you share that story with us of how you went through that from starting out, having a limited amount of knowledge, and it sounds like some skepticism, to something that you really had a deep interest in?

Kim Grauer:

Well, when I first started to think about Bitcoin and I'm going to write this paper, it was genuinely kind of a kooky thing to talk about. I remember my roommate in graduate school rolled her eyes when I said I was going to take on this project. My professor, my graduate school professor wrote it off a little bit as just being this, I don't know exactly if we thought at that time that maybe it was just a bubble, people are bored or just generally not taking it very seriously. And that's what I went into it with the intention of thinking about that. I had read an article about how it might take over as a global currency. I wanted to see if I could apply game theory to definitively answer from our perspective whether or not that's possible. And I went and started just educating myself on first, the technical side of things. How does the blockchain work, how are transfers validated and what is mining, how does mining work?

And then once I had that foundation, not that you need that foundation, but once I had it, I felt more comfortable being able to think about how sustainable this ecosystem is and what it would mean for it actually to become a meaningful asset. Now, I didn't answer whether or not, I think what it would take to become a global currency reserve or to become broadly accepted, broadly utilized, in a way similar to gold, but I did start to take it really seriously. I started to think after spending a long time educating myself and talking to people that there's some really legit technology behind this, and it's paired with a general interest by people. So I started to think that it has potential, whether or not it's going to get to that place. So, what everyone talks about is not something even today I have a strong answer about, but it's something that is interesting to continue to follow.

And especially when you're interested in following criminal activity, when you start to realize the power that this has in following criminal activities, starting to be able to think about what money laundering looks like, who are the biggest money launderers? This is all transparent. This is all registered on the blockchain. You can answer some of these big questions that have been plaguing financial institutions for a long time.

Dave Bittner:

I remember that as the enthusiasm for cryptocurrency and the blockchain really took off, a couple of years ago, that it almost suffered from being a punchline, because it seemed there were so many organizations who are just using the words, cryptocurrency and blockchain to get funding for a company or as part of a marketing or PR thing. Is that still lingering? Is that a challenge for those of you who are doing serious work in the space that it went through that period of over exuberance?

Kim Grauer:

I do still struggle with being taken, with people understanding the industry, especially with family, older family and friends who don't understand. I mean, those Thanksgiving conversations of, “What's the Bitcoin?” Just, there is still a lot of education that needs to be done. I think of it as, you don't explain what technically is happening on the internet, every time you have to have a conversation about what the internet is right now. But we're held to a higher burden at the moment and I think it's because people are still proving use cases, but it is a punchline and I'm excited. I'm hopeful that one day the conversations won't be so much around people trying to be like, I don't understand what it is, it seems like it's just a bubble and just writing it off and feeling like people feel without much exposure to the space that they know exactly what's going to happen with it.

But I definitely see that with a certain type of person who I'm talking to, but also other people are more fascinated by it. I mean, I don't see people at the dinner table asking my friends working in finance so many questions, with such interest, it's also a fascinating topic. And I think that a lot of people, even if they have the stigma, they still find themselves fascinated asking more questions. I mean, I'm definitely the one interrogated the most at the dinner table about what I'm doing in a way that my lawyer friends aren't asked about. And so that interest I find to be kind of cool.

Dave Bittner:

It seems to me like, there's this contrast, in that, as you say, blockchain has this record, this immutable record, which is part of how it works. But at the same time, the criminals and the bad guys are using it because it provides a certain amount of anonymity for them again, as you say, to do the money laundering. I mean, to me, that's an interesting tension between those two things, both of which are true.

Kim Grauer:

Yeah. I'm actually working on a presentation called the paradox of cryptocurrency that simultaneously tries to address how both of these things can be true at once. And I think crucial to that is just understanding technically what we're doing. And just technically what we're doing is we're not de-anonymising people's use of cryptocurrency, you can still go and download an Exodus Wallet and it's not going to be associated with who you are, but what we're doing is taking advantage of this public record by associating addresses together in a way that can identify when one service is controlling many addresses, and then we actually can see who those services are. And that is similar to, let's see how much money is going in and out of manufacturing in the Fiat world. And let's see how much money is going in and out of, in this case, darknet marketplaces. And so it's not that we're de-anonymising, it's that we're exploiting the permanence of the public ledger and associating addresses together in order to try to see which services are the biggest, and what types of things do those services engage in?

You can go to coinbase.com and you can see what they're doing, it's not hidden, or it's not something they're trying to prevent people from knowing what they're doing. You go on, you make an account, you know you can send a transfer. So we're just working together with all of this already public information. And in fact, that is the source of a lot of what we do is public information, aggregating stuff that we know that there's a service that's come online, they're saying, "Hey, will you come and join? Will you come and start an account here on our service?" And just working with that public information to try and establish what our CEO calls, the phone book of cryptocurrency.

Dave Bittner:

What are some of the things that excite you as you look forward to possibilities, things that this technology might be applied to?

Kim Grauer:

Right now you have me in a crime mentality. I've been doing some research today. So I'll answer first about crime, but one of the things that was really striking for me when I first started to research criminal activity on the blockchain, was when you think about how big of a problem money laundering is in the world. I mean, just look at what has gone on breaking news recently, with the FinCEN files, where people have seen just how big of a problem this really is. With cryptocurrency, you can actually ... We found that there are off-ramps where criminals tend to offload their money. So we know that there are these hotspots where people can actually send their money to, and they do send their money to, especially the really big criminal activity, the really big scams, the hacks, the coupon hacks, the plus token scams. These are all a small number of scammers who have a lot of money, and they have to move that money through permanent blockchain to turn it into something that they want to use, probably Fiat currency. And they have to do that.

And a lot of places have a rigorous KYC environment, so they tend to take those funds to certain hotspots, maybe two or three years ago, it was a certain type of exchange, and you have your BTC-e, which is an exchange that was known for money laundering. Criminals would just go to this exchange because they knew that they could send their funds through, that is always changing and we are always trying to stay on top of which services money launderers are using. And so, in a way it's inspiring to think that if this becomes really broadly used, then we can actually start to be more empowered to tackle some of these questions about where are those money launderers going. They're going to OTC desk on X exchange. Okay, let's inform that exchange, let's get law enforcement involved.

So that's one of the most exciting things for me when it comes to criminal activity. And then when it comes to regular activity, people using cryptocurrency day-to-day, what was really exciting from the geography report that we just put out, we found that the cryptocurrency right now is actually used across the entire world. There's only a few countries where we weren't able to find activity within. And to run all of our numbers, pair it with the web traffic data, which is one of the key ways that we identified who's using what services. So for example, OKcoin might have 98 percent China web traffic, so we're going to attribute 98 percent of that to China. But to see that this is actually a global phenomenon and that it's serving different use cases, depending on which part of the world you happen to be situated in. And depending on which country, the infrastructure of whatever country you're sitting in, to see that it's really actually, organically growing has been really exciting to see as well.

Dave Bittner:

What insights do you have on the robustness of cryptocurrency and the blockchain? In particular what I'm thinking of is, obviously there's the technical side of it, but it strikes me as very interesting that we've really seen for the most part, governments have been hands-off when it comes to this, they've taken a wait and see attitude, but that could change at any time.

Kim Grauer:

Yeah. It's disjointed and different. The approaches different countries take are having a real impact on the businesses. We talk to businesses in Latin America who, when there was the banking ban where they're not going to bank any businesses, cryptocurrency businesses. We've talked to people who they had to shut down their shop and that put everything on hold and it's of course, really impactful. And these, I don't know if people realize just how impactful regulations can be. And I know it might seem obvious to say, but these real-time decisions that regulators are making have a strong impact on the services that are actually trying to grow. So I think that things are unfolding, there are certainly some leaders in this space, people who are starting to say, yes, we need to grapple with this. And that was one of the reasons why we put out the geography research so that we can go to countries who say, "We don't have any cryptocurrency activity."

And say, "No, you do and you have to deal with this. And you have to realize that there's user demand and people are starting to use cryptocurrency. So you have to think about how you're going to regulate this. And you can look to these other countries that are doing it in this way." And there are actually even businesses popping up to try and consult with people, with companies, not companies, with governments to try and show them, let's align with our neighbors on regulations, let's do this together and let's look to the future, let's be forward-thinking here.

But it's definitely not at that place now there's a lot of disjointedness in different countries. And it's something that changes day-to-day. Every day you go into the news, into the crypto world of news, and you see a new article about a government, India talking about maybe banning cryptocurrency today, maybe not. So things change really fast and hopefully, it's directionally heading to the right place, but it's definitely still extremely disjointed.

Dave Bittner:

Yeah. What's your advice for those people who are charged with the defense of their own organizations, who are protecting the cybersecurity of organizations around the world. Any tips for how they should best keep themselves informed for the things about cryptocurrency in the blockchain that may affect them?

Kim Grauer:

Well, the first thing that comes to mind is going to be related to ransomware. Definitely ransomware is something that, as we're writing this crime report, as we're doing research for this crime report, I'm thinking that ransomware is going to be the biggest issue that we're going to talk about in this report. The biggest source of not only financial problems for companies, but also the potential to sow political unrest. And I look at ransomware data all the time, and it's hard because it's a chronically underreported problem. People get hit by a large ransomware and they either pay or they don't pay the ransomware. Maybe they'll hire a business to do this, they often don't then figure out a way to submit that address to an authority so that people can actually be following those funds. We need to be better at accumulating this ransomware data, because the more data we have on who these ransomware addresses are, the more likely we are to be able to either A, recoup your funds, but B, also, there's not that many ransomware experts in the world.

If we can actually investigate these cybercriminals, that's a really powerful tool because on top of that, it's not that a cybercriminal just does ransomware. They're also probably doing other exploits, maybe hacking, most likely extortion attempts. There's this seedy underbelly of cybercriminal activity that we have the tools to start to dismantle if we just have more data. And so I would just really encourage people who are hit by ransomware attacks to be proactive and to let us know what that address is. In terms of fighting and preventing ransomware attacks, I'm actually not a cybersecurity individual, so I don't have the go-to, here's the checklist of things you need to do to protect yourself. But if you are listening, I mean, definitely educate yourself on how to protect your computer, because people are going to ask for Bitcoin and potentially lock up your ransomware.

And also, for people who don't know what ransomware is, they pretty much exclusively are asking for cryptocurrency payments. And so once you get an address or you send money to a cryptocurrency payment, you can just give us that address and then we can track those funds.

Dave Bittner:

Our thanks to Kim Grauer from Chainanalysis for joining us.

Don't forget to sign up for the Recorded Future Cyber Daily email, where every day you'll receive the top results for trending technical indicators that are crossing the web, cyber news, targeted industries, threat actors, exploited vulnerabilities, malware, suspicious IP addresses, and much more. You can find that at recordedfuture.com/intel.

We hope you've enjoyed the show and that you'll subscribe and help spread the word among your colleagues and online. The Recorded Future podcast production team includes Coordinating Producer Caitlin Mattingly. The show is produced by the CyberWire, with Executive Editor Peter Kilpe, and I'm Dave Bittner.

Thanks for listening.