Cointime

Download App
iOS & Android

KYC'd Wallet Sales on Dark Net Markets

Validated Project

The sale of cryptocurrency exchange accounts that have passed Know Your Customer (KYC) verification happens across a multitude of platforms, including Telegram and Discord. While one might expect a similar volume of sales to occur on dark web markets, our examination of KYC'd account sales shows this is likely not the case. Our analysis of fraudulent sales of KYC'd accounts across 300 dark web markets shows that just 4% of markets host ads for crypto related KYC services.

Background

Know Your Customer rules are one of the legal requirements that financial services providers must adhere to when selling financial services products to new customers. These regulations require customers to prove their identities – using identification documents and other personal records – so that financial institutions can better assess risk and monitor for all types of financial crimes, including fraud, money laundering, terrorism financing, and identity theft. Depending on the nature of the financial services provided, these rules can require institutions in the US and their international affiliates to:

  • Collect the identities of their customers;
  • Monitor their customers through periodic identity documentation updates;
  • Screen customer transactions;
  • Closely monitor Politically Exposed Persons (PEPs); and
  • Screen their customers against sanctioned entities lists

Those who have used centralized exchanges are most likely familiar with some of these practices. However, the semi-anonymous nature and relative newness of the Web3 ecosystem have made the industry a particularly difficult one for traditional financial regulators to enforce KYC rules on. There are multiple reasons for this, including the fact that many major exchanges operate in jurisdictions with looser financial regulations than the US and the lack of international coordination around regulating these platforms.

The current regulatory environment creates opportunities for bad actors to take advantage of centralized exchanges (CEX) to launder and move funds. One method used to launder funds involves obtaining a fraudulently KYC'd account. You can read more about CertiK’s investigation into over-the-counter KYC sales here. This particular investigation focuses on the sale of fraudulent KYC sales primarily on Telegram, Discord, and other social media sites. However, we also wanted to take a deeper dive into how much of this activity takes place dark web markets.

Dark web markets are often associated with criminal services, including the sale of stolen data, credit card information, malware, hackers-for-hire, drugs, and weapons.

Analyzing KYC Sales on Dark Web Markets

It is important to note here the difficult nature of conducting research on the dark web. Research must be conducted using a special browser known as the Tor browser, or by configuring another web browser like Firefox to access the Tor network. The browser allows one to access website URLs ending with the extension .onion. These URLs change frequently and often are often left inactive when domain owners move a market’s online location for security purposes. This makes finding and maintaining access to dark web markets much complex than on the surface web. A market URL can be working today, and replaced with a scam or non-functional URL tomorrow.

We started with a database of over 300 links to dark web markets and assessed them for sales of KYC’ed accounts. Of the original 300 URLs only 182 were transcribed correctly, meaning they contained the correct number of characters in a .onion address. Of the 182 full addresses, 102 were dead links and 80 were working. Of the remaining working links, only 12 markets had advertisements related to KYC account sales or fraudulent KYC services for other money transfer platforms, such as PayPal.

Graph: Shows the number of links from our dark web market database both live and inactive.

Only 27% percent of the links in this database were live. The number of links that worked for markets where KYC’d accounts or KYC services were being sold were only 4% percent of the total.

Not only were the number of markets hosting KYC'd CEX account advertisements quite small, but the total number of ads on each platform were also minimal. The chart below shows the distribution across all markets where we found vendors selling KYC services.

Graph: The total number of KYC service ads on each market examined in this sample

A Closer Look at KYC Ads

We looked at the ads and vendors on the three most active markets by total number of ads currently listed. This includes Nemesis Market, MGM Grand Market, and the Ares Market, each of which had 10 ads or more. It should be noted that even though these markets had the highest number ads around half of the ads had broken links and appeared to be reposts from the same vendors.

Markets that contained KYC ads vary in their structure but all provide the following basic pieces of information about the vendors providing these services:

  • Vendor Usernames
  • Total Vendor Sales
  • Total Vendor Reviews
  • Vendor Ratings
  • Product Price
  • Product Descriptions
Image: Example advertisement for a Paxful.com KYC’ed account. Source: Ares Market

What also becomes clear when examining these ads is that the vast majority are cross-posts from the same vendors. In our examination of the big three markets mentioned above we identified six vendors with unique usernames, however, the content of these ads suggests there are only four unique actors, two of which use different usernames on different markets. We based this conclusion on the content of these ads being word-for-word exactly the same. Below is is list of these actors and their associated vendor stats for the Nemesis, MGM, and Ares markets.

Image: Actors across dark web markets with live KYC ads do not have many metrics by which to judge their activity

The vendor data we have on these actors does not provide much information for identifying or assessing the efficacy of these vendors' sales. While most vendor scores are ranked quite high out of five, there are not enough sales or reviews to truly assess the impact or overall activity of the vendors. The one exception is vendor mikedoesittoo who has over 100 sales and 37 reviews on Nemesis market. Multiple of these reviews include positive five star ratings specifically for his KYC'ed account sales, making them the most active and effective actor selling KYC’ed accounts.

Conclusion

Overall, the KYC'd CEX account market on the dark web appears to be small and likely statistically irrelevant in terms of its overall contribution to fraud in the cryptocurrency industry.

It it likely that we continue to see this activity predominate on Telegram and Discord, as these channels are already used heavily by individuals and projects in the crypto space. These social platforms are not only more readily accessible than dark web markets, but cryptocurrency enthusiasts as a whole are almost certainly more familiar with navigating these platforms from doing research on projects or connecting with project communities. While this is not to say that finding these types of markets on social media platforms is simple, their ease of use without a doubt creates greater accessibility to both fraud peddlers and enablers in these circumstances.

Read more: https://www.certik.com/resources/blog/3bUwDt2r8azcC7cqddl6rZ-kycd-wallet-sales-on-dark-net-markets

Comments

All Comments

Recommended for you

  • State of the Network’s Q1 2024 Mining Data Special

    Our quarterly update on Bitcoin mining, zeroing in on recovering revenues, public miner strategies, and increased energy usage

  • Introducing Accrual-Based Recurring Payments for Decentralized Platforms

    Automatic recurring payments have become a critical revenue stream for businesses in almost every sector, providing a reliable incremental cash flow to support business processes. Some real-world use cases are displayed in the following figure.

  • Blob Preconfirmations with Inclusion Lists to Mitigate Blob Contention and Censorship

    In this post, we describe an out-of-protocol mechanism for blob inclusion preconfirmations. It allows preconfirmation providers to bid in an auction to become the leader for the subsequent slot. The auction winner can then accept bids on blob inclusions and issue preconfirmations to the bidders.

  • Bitcoin Layer 2 Project Bitlayer Launches $50 Million Ecosystem Incentive Program

    Bitlayer, a Bitcoin Layer2 infrastructure project based on the BitVM paradigm, announced the launch of a $50 million ecological incentive plan to promote the development of its mainnet ecosystem. The first phase of the incentive program, named "Ready Player One," will begin registration at 09:00 UTC on March 29th, 2024 and end at 09:00 UTC on April 29th, 2024, and will officially start after the Bitlayer mainnet is launched. Specific rules and reward allocation guidelines for the event will be disclosed in subsequent announcements. Through the "Ready Player One" and other ecological incentive plans, Bitlayer aims to accelerate ecosystem development and incentivize projects to deploy on the Bitlayer mainnet. In addition, Bitlayer promises comprehensive ecosystem support for all projects, including potential foundation and institutional investment, initial liquidity support, comprehensive product development resources, guidance and investment opportunities from top incubators, support from the Bitcoin community and OGs, ecosystem cooperation, and co-creation.

  • Stablecoin protocol Ethena on BNBChain has been hacked

    The stablecoin protocol Ethena on BNBChain has been hacked, causing a loss of 480 BNB, worth about $290,000, as monitored by PeckShieldAlert.

  • Singapore-based Bitcoin Layer2 Project BEVM Raises Tens of Millions in Seed and Series A Funding

    Singapore-based Bitcoin Layer2 project, BEVM, has completed its seed round and part of its Series A round, raising tens of millions of USD from over 20 investors including RockTree Capital, Waterdrip Capital, and ViaBTC Capital. The project's Series A valuation has reached $200m and aims to accelerate its international development and roll-out. BEVM is an EVM-compatible Bitcoin Layer2 network built on Taproot Consensus, which uses $BTC as gas and aims to bring 10% of $BTC into its Layer2 network environment. The project's mainnet is scheduled to launch on March 28th and has already implemented decentralized Bitcoin cross-chain custody services through Schnorr Signature, MAST, and Bitcoin SPVs.

  • Ethereum on-chain DEX transaction volume exceeded $2.1 billion yesterday

    According to DeFiLlama data, the trading volume of DEX on the Ethereum blockchain on March 28th was 2.111 billion US dollars, ranking first. The daily trading volume of DEX on the BSC chain was 1.398 billion US dollars, ranking second; the daily trading volume of DEX on the Solana chain was 1.097 billion US dollars, ranking third.

  • Taiwan’s Ministry of Interior has approved the establishment of a cryptocurrency industry association

    Taiwan's Ministry of the Interior has approved the application of the local cryptocurrency industry to establish an industry association. The local cryptocurrency industry working group, which was established last year to prepare for the establishment of the industry association, said that the working group now needs to complete all preparations and officially establish the cryptocurrency industry association by the end of June as required by the government. The working group is currently composed of 22 cryptocurrency companies, including Taiwan's major exchanges such as MaiCoin and BitoPro. The working group pointed out that ACE Exchange has been expelled from the group because the troubled exchange is under investigation by prosecutors for improper behavior by its former executives.

  • Grayscale ETH Trust negative premium rate is 22.77%

    According to ChainCatcher news and Coinglass data, the Grayscale Bitcoin Trust Fund (GBTC) has a premium rate of 0.02%. The Grayscale ETH Trust has a negative premium rate of 22.77%, and the ETC Trust has a negative premium rate of 36.58%.In addition, the Grayscale BCH Trust has a premium rate of 238.13%, the LTC Trust has a premium rate of 380.60%, the SOL Trust has a premium rate of 515.93%, the MANA Trust has a premium rate of 726.65%, the LINK Trust has a premium rate of 713.66%, and the FIL Trust has a premium rate of 3057.89%.

  • Net inflows into spot Bitcoin ETFs reached $179 million on March 28

    Spot on Chain, a blockchain data monitoring platform, posted on social media that the net inflow of spot bitcoin ETF on March 28th reached 179 million US dollars, a decrease of 26.9% compared to the previous trading day. After 54 trading days, the total net inflow accumulated to 12.13 billion US dollars, which is the level before the last fully negative trading week. BlackRock's iShares Bitcoin ETF (IBIT) and Grayscale's GBTC both saw a significant slowdown in daily inflows and outflows on March 28th.