blockchain analysis

Analyst Honored for Exposing South Korean Dark Web Crypto Child Pornography and Blackmail Site

Criminal analyst, Kim Reece, has been named as a finalist for the Samuel J. Heyman Service to America Medal for her role in the takedown of the South Korean ‘Nth Room’ child pornography chat rooms that hosted the vile content of the ‘Welcome to Video’ dark web site.

US Immigration and Customs Enforcement (ICE) Homeland Security Investigations (HSI) Criminal Analyst, Kim Reece was named as a finalist for the Samuel J. Heyman Service to America Medal.

According to the announcement on May 27, Reece’s blockchain analysis led to an international criminal investigation of the largest dark web child pornography sites—’Welcome to Video’ that leveraged cryptocurrency to cloak their payments on over one million video downloads.

Working alongside cross-agency partners Christopher M. Janczewski, IRS- Criminal Investigations, and Zia M. Faruqui of the US Department of Justice (DOJ), Reece’s contribution led to the arrests of the site’s operator, Jong Woo, and more than 300 users, as well as the rescue of 25 exploited children.

250,000 Child Porn Videos

The sexual exploitation of underage school-going girls in South Korea has been happening for years on the “Nth Rooms” dark web site. Notably, they would be filmed undertaking violent self-harm and sexual acts, and the videos taken were made available via Telegram chat rooms after members made crypto payments.

It is reported that at least 10,000 people utilized these chatrooms after paying fees ranging from $200 to $1,200 in Bitcoin, with trades completed through a separate protected forum.

According to the law enforcement agencies who spearheaded the investigation, the amount of child sexual pornography content seized was close to 8 TB or more than 250,000 videos.

Let’s Rape

According to the indictment, on March 5, 2018, agents from HSI, IRS-CI, the National Crime Agency in the United Kingdom, and the National Police in South Korea arrested Jong Woo Son, 23, a South Korean national. The authorities also seized the servers he used to operate a darknet market place exclusively advertising child sexual exploitation videos available for download by site members.

The dark web site was called Welcome to Video: the ‘nth rooms’ refers to a series of Telegram chat rooms where users would illegally produce and trade sexually exploitative footage of women and children. The core of the business was to turn real-life assaults into online content, with the site itself boasting over one million downloads.

As the business grew from 2018 to 2019, the Telegram chat rooms became more bespoke for its depraved clientele. The users could have their pick of the “slave room” or perhaps the “violate your acquaintance room” and a variety of rooms dedicated exclusively to child rape and sexual abuse.

In the chat rooms where underage girls were degraded, forced to behave like animals and violated in public unsanitary areas, it was common for the users to greet each with the phrase, “let’s rape.” Victims were often manipulated into giving out personal information that could be used to blackmail them into obeying the commands of the chat users.

Kim Reece Honored and Recognized

Analysis of the platform revealed that it generated close to one million BTC addresses.ICE HSI Criminal Analyst Kim Reece – Image Via ICE.Gov

“It is a great honor and privilege to recognize Kim Reece for her nomination for the Samuel J. Heyman Service to America Medal,” said Deputy Director and Senior Official Performing the Duties of Director, Matthew T. Albence. “Even more important than this prestigious acknowledgment, however, is her continued dedication and use of her expertise to protect exploited children. The efforts of Ms. Reece and her interagency partners were instrumental to the takedown of this international criminal organization.”

At the end of the announcement, Homeland Security noted some hotlines and encouraged members of the public to report any suspected child predators or exploitation. The 24 hr toll-free hotlines are 1-866-347-2423 and TTY for hearing impaired at (802) 872-6196.

Image via Shutterstock

Debunking Overblown Claims on Crypto and Terrorism Financing

In light of the recent terrorist attack in Israel orchestrated by Hamas, Chainalysis, a blockchain analysis company, addresses the misconceptions surrounding cryptocurrency’s role in terrorism financing in a blog post dated October 18, 2023. The analysis reveals that terrorism financing represents a minuscule portion of the already marginal illicit cryptocurrency transaction volume. While terrorist groups do utilize cryptocurrencies, they predominantly rely on traditional fiat-based financing channels like financial institutions, hawalas, and shell companies.

Blockchain technology, known for its inherent transparency, renders cryptocurrency less suitable for illicit activities, including terrorism financing. This transparency enables government and private sector entities equipped with blockchain analysis tools to collaboratively identify and impede fund flows, a feat challenging to achieve with traditional value transfer methods. Chainalysis particularly discusses the common pitfalls when analyzing terrorist fund flows on the blockchain, especially concerning service provider identification and tracing.

Two essential aspects form the crux of analyzing terrorism-related fund flows: quantifying the funds directly held by terrorist organizations, and identifying the service providers facilitating fund movements. Instances of terrorism financing often involve service providers like money services businesses, with the recently sanctioned Gaza-based business, Buy Cash, cited as an example. These service providers handle fund volumes larger than a typical individual yet smaller than a standard exchange, resembling over-the-counter (OTC) brokers or street-level money businesses like hawalas to varying extents.

The recent sanctions by the US Treasury Department on October 18, 2023, against nine individuals associated with Hamas and a Gaza-based cryptocurrency exchange are part of a broader effort to staunch the revenue flow to the group. These measures specifically target senior Hamas officials and members managing a clandestine Hamas investment portfolio, alongside the implicated virtual currency exchange. Besides the funds Hamas receives from Iran, its global investment portfolio, valued at hundreds of millions of dollars, significantly contributes to its revenue. This portfolio, managed under the guise of legitimate businesses in various countries including Sudan, Algeria, Turkey, and the United Arab Emirates, forms a crucial part of Hamas’s financial network.

Parallel to the US actions, Israeli authorities have been proactive in clamping down on cryptocurrency channels funding Hamas. On October 10, 2023, the cyber branch of the Israel Police’s Lahav 433 unit froze cryptocurrency accounts belonging to Hamas. Additionally, multiple social media posts over the preceding week soliciting cryptocurrency donations for Hamas-related organizations were noted by Israeli law enforcement.

In a noteworthy development, Hamas declared the cessation of its cryptocurrency donation program in April 2023, indicating a potential shift in its fundraising strategies amidst increasing international scrutiny.

The narrative surrounding the role of cryptocurrencies in terrorism financing often leads to overblown claims, mainly when tracing funds on the blockchain. The recent actions by both US and Israeli authorities highlight the challenges posed by cryptocurrencies in curbing terrorism financing while also emphasizing the adaptability of regulatory measures to counter illicit crypto operations.

The collaborative efforts between law enforcement, intelligence agencies, and private sector organizations, exemplified by the recent actions against Hamas’s cryptocurrency operations, showcase the potential in leveraging blockchain technology to understand and disrupt terrorism-supporting financial networks. The developments emphasize the need for a nuanced approach in assessing the role of cryptocurrencies in terrorism financing, reinforcing the assertions by Chainalysis on the limited scope of crypto in fueling terrorist activities.

Elliptic Debunks Claims of Substantial Crypto Funding to Hamas

On October 25, 2023, blockchain analytics firm Elliptic released a statement clarifying misconceptions surrounding the extent of cryptocurrency funding received by Hamas. The firm emphasized the absence of substantial evidence supporting claims that Hamas has garnered significant crypto donations. This follows heightened scrutiny on cryptocurrency’s role in financing terrorism, especially in the wake of the tragic incidents on October 7, orchestrated by Hamas.

Elliptic’s clarification comes amidst a wave of reports suggesting that cryptocurrencies have become a substantial financing tool for Hamas. On October 10, a narrative was fueled by an article in the Wall Street Journal, titled “Hamas Militants Behind Israel Attack Raised Millions in Crypto”. This narrative gained traction when, on October 17, over a hundred US lawmakers referenced the article in a letter to the White House and the U.S. Department of the Treasury, asserting that Hamas and Palestinian Islamic Jihad (PIJ) raised over $130 million in cryptocurrencies between August 2021 and June 2023, a claim Elliptic argues lacks evidentiary backing.

Analysis indicates that public crypto fundraising campaigns by Hamas have not received substantial donations. The disclosure reveals that Gaza Now, a pro-Hamas news outlet, only received $21,000 in cryptocurrency donations since October 7, with $2,000 being sent to an exchange on October 9, and around $9,000 in stablecoin donations being frozen by Tether. This contrasts starkly with the reported $130 million figure cited by lawmakers.

Historically, Hamas sought Bitcoin donations starting in 2019, peaking during the May 2021 regional violence outbreak. However, by April 2023, the group ceased public crypto fundraising, citing donor safety concerns. The halt followed US and Israeli law enforcement actions, including the issuance of seizure orders for Hamas-associated crypto wallets and collaboration with exchanges to freeze related accounts.

Further analysis by both Elliptic and Chainalysis, another blockchain forensics firm, underscores the exaggerated figures in media reports. For instance, one wallet purported to have received $82 million over seven and a half months had only $450,000 associated with terrorism, as per Chainalysis. The analysis reveals a significant misrepresentation of facts concerning the extent of cryptocurrency’s role in funding terrorism.

Notably, the scrutiny on Hamas’s crypto funding coincides with thriving crypto fundraising for humanitarian causes in Israel. As of October 19, Crypto Aid Israel amassed over $185,000 in cryptocurrency donations to aid those affected by the attacks, showcasing the potential positive impact of cryptocurrencies.

Elliptic stressed the importance of nuanced blockchain analysis to avoid misinformation, emphasizing its long-standing commitment to preventing crypto assets’ illicit use. The firm advocates for a balanced understanding and reporting on the multifaceted issues surrounding cryptocurrency and terrorism financing.