Sanctions caused cybercriminals to lose $15M in potential revenue in 2 months

The largest crypto-related sanctions by the U.S. Office of Foreign Assets Control (OFAC) in 2022 have significantly reduced potential earnings for illegal actors. found.

The US has sanctioned a number of crypto-related individuals and entities over the last year for drug trafficking, money laundering and ransomware activities. Chainalysis explored the impact of sanctions on criminals using his three main entities: Russian cryptocurrency exchange Garantex, darknet marketplace his Hydra, and cryptocurrency mixer Tornado Cash.

Chainalysis found that 20 cybercriminal administrators who used the above services lost $14.99 million in potential revenue within 60 days of being sanctioned. Cybercriminal administrators refer to addresses attached to individuals with links to cybercriminal organizations.

Additionally, Chainalysis estimates that 42 entities dealing with stolen cryptocurrencies may have lost $1.8 million in the two months since the service under investigation was sanctioned.

Additionally, 23 entities involved in fraud and 11 entities with darknet links could lose more than $306,000 and about $271,000 respectively. Another $52,227 and $57,727 were lost by 10 fraudsters and 6 ransomware-linked entities, respectively, according to Chainalysis estimates.

However, the average estimated loss of potential earnings after two months of sanctions were imposed in each category of cryptocurrency crime was significantly lower. On average, cybercriminal administrators suffer the most losses, pegging the estimated lost revenue at around $750,000.

Darknet markets, stolen funds entities, and scammers lost $25,000, $43,000, and $13,300 in potential revenue on average, respectively. In contrast, Chainalysis estimates that his two months post-sanctions increased potential fraud shop revenue by an average of $5,000.

Sanctions impact on Hydra, Garantex and Tornado Cash

Both Hydra and Garantex were sanctioned on April 5, 2022. Earlier the same day, German police seized his Hydra server. This was primarily facilitating drug trafficking. This effectively closed the illegal market.

However, Russia-based Galantex said it was operating freely even after the sanctions designation.Ethereum-based Tornado Cash Licensed August and November. The website has been taken down and the Decentralized Autonomous Organization (DAO) behind the Decentralized Finance (DeFi) protocol has been shut down.

Approximately 68.2% of all funds flowing into Hydra in the two months prior to the sanctions came from fraudulent addresses. In addition, 12.6% of funds flowed to Hydra from risky addresses. Risky addresses are addresses with links to risky entities, such as risky exchanges.

However, Hydra closed on the same day sanctions were imposed, resulting in zero inflows two months later.

On the other hand, the inflow to Galantex has steadily increased in the two months since the sanctions designation. Before the sanctions, he received 6.1% and 16.1% of his funds from fraudulent and unsafe addresses respectively.

In the four months before the sanctions, Garantex averaged $620.8 million in monthly inflows. But after sanctions, monthly inflows jumped to about $1.3 billion through October.

Tornado Cash received 34% of its funds from fraud prior to sanctions. Stolen funds accounted for 99.7% of all illicit funds received by Tornado Cash over the two-month period. Cryptocurrencies stolen in the Harmony Bridge attack accounted for 65.7% of all stolen funds received by mixers. Thirty days after the sanctions designation, inflows into Tornado Cash dropped by 68%, Chainalysis noted.

Effectiveness of Crypto Sanctions Depends on Jurisdiction and Technical Constraints

In the case of Hydra, German law enforcement agencies worked with US authorities to effectively shut down the illegal market. Chainalysis therefore noted that sanctions could be very effective against entities with major operations in cooperating jurisdictions.

However, the impact of sanctions on Garantex was virtually non-existent as Russia did not enforce US sanctions. Chainalysis wrote:

“in this case [of Garantex] It has proven difficult to effectively sanction entities in their home jurisdiction that do not have a formal channel of cooperation with OFAC.

Finally, Chainalysis said sanctions against DeFi platforms like Tornado Cash would be less effective as smart contracts could continue to run indefinitely even without a website. Therefore, sanctions against DeFi services “act as a tool to discourage use of the service” rather than to stop its use outright.