Cryptoasset investment fraud: inside the investigation

Cases are on the rise and the value of misappropriated assets increasing. This is spurring a growing number of investors to engage legal advisers and asset tracing specialists to trace their cryptoassets and to use civil law procedures to identify the fraudsters, prevent the dissipation of their cryptoassets and to facilitate recovery of the defrauded amounts.

In an exclusive interview with Out-Law, Marlon Pinto, director of investigations at AnotherDay, shares his insights into how criminals are using deceit and digital wallets, bitcoin and the blockchain, to defraud investors out of hundreds of thousands of pounds and the techniques used to trace cryptoassets. He also discusses how engaging highly qualified civil law experts, such as Pinsent Masons, can support the recovery of assets suspected to have been stolen. 

“It is vital for victims to select the right legal and forensics team and to act quickly,” said Jennifer Craven, a specialist civil fraud and asset and recovery lawyer at Pinsent Masons, the law firm behind Out-Law. “Cryptoassets can be moved at speed through the blockchain, and fraudsters will commonly seek to withdraw their value at offshore crypto exchanges. It is possible to seize and recover those assets as long as you know your way around the right civil law remedies and use them to your advantage.”

How the scams operate

“There are a lot of people nowadays looking at the success of early bitcoin investors – many have become millionaires – and locking onto this theory that they too could become rich quick by making investments,” Pinto said. “They do not want to miss the boat by not having invested. This opens up the landscape to fraudsters to target these individuals with what are essentially fraudulent investments.”

According to Pinto, fraudsters often use impressively presented, professionally written, prospectus-style white papers to entice investors and supplement their verbal sales pitch – make no mistake, these fraudsters are highly sophisticated and intelligent.

Building trust and a rapport is important to the fraudsters, according to Pinto. The fraudsters often help investors to make a quick, initial paper profit with the broader objective of persuading those people to invest larger amounts of their money thereafter. Sometimes an element of time pressure is introduced to serve as a catalyst for defrauding further funds from the investor, with the false promise that the investor will see returns if they follow the process, he said.

Pinto said: “The fraudsters initially gain your trust by demonstrating the investment generates returns that makes you think ‘oh, actually, I'm making money here’ and then they entice you to invest more money because the investor thinks, ‘well, the process works’. They make you question your desire to withdraw your funds because you are making a return. They are effectively buying your trust – ‘why withdraw everything when your investment that was originally £2,000 is now worth £10,000?’. They might give you back £1,000 but at the same time convince you to invest another £20,000.”

In many respects, Pinto acknowledged, cryptoasset frauds can be no different to classic investment scams or Ponzi schemes.

The Johns case

“He said he believed he may have been defrauded but wasn't entirely sure,” said Pinto, recalling a conversation he had in late November 2020 with businessman Duncan Johns.

Within three weeks of the conversation, Pinto had produced an expert report on the outcome of a forensic investigation carried out by AnotherDay to trace Johns’ funds – funds he was enticed to invest in cryptoassets.

The expert report was presented to the High Court in London, along with a package of other evidence to support an application for a worldwide freezing order and an ancillary disclosure order against ‘persons unknown’ and for a further disclosure order against two cryptocurrency exchanges, Binance and Kraken.

Case summary

Between February and October 2020, Duncan Johns was persuaded to part with more than £577,000 in purportedly genuine cryptoasset investments.

Things had started well for Johns. He had been contacted about potential investment in cryptocurrency and, despite initial reluctance, was persuaded to invest a modest amount of his own money into the cryptocurrencies ethereum and dimecoin. A woman purporting to be called Marilyn Black and representing an investment company made the investments on Johns’ behalf. Johns achieved returns of around £15,000 from those investments.

Over the following weeks and months, Black was in regular contact with Johns. She introduced him to others who pitched for his investment in two separate initial coin offerings (ICOs) – some businesses have turned to ICOs in recent years as a way of raising capital. Typically, those businesses will develop a digital token, such as their own proprietary virtual currency, and look to sell those tokens to investors. The trade of these tokens is recorded on the blockchain – a digital ledger. The trades are carried out in existing cryptocurrencies, such as bitcoin. In many cases, investors are incentivised into buying the tokens by being given the opportunity to share in profits generated from the business ventures that benefit from their investment.

By the start of September 2020, Black had helped Johns to invest a total of more than £250,000 of Ion Science’s money in the two ICOs. However, to access the apparent $15 million profit from one of his investments, Johns was told that he had to make commission payments. He was subsequently persuaded by Black to transfer a further £250,000, supposedly into an escrow account.

The process of investigation

“He just wanted closure to understand what was going on,” Pinto said of Johns. “Once we had looked at the transactions online, we sat down with him and showed him where the funds were going. I think he was he was relieved that he got us involved at that point and not months later down the line.”

AnotherDay’s investigation in the Johns case was multi-faceted.

Communications data

Though Johns was not to invest any more money, Pinto encouraged Johns to maintain contact with Black, who by this stage was putting increasing pressure on Johns to transfer more commission payments to enable the release of profits.

Pinto said: “The phone calls were still coming in and there were telephone numbers that were being used. We wanted to conduct some first searches against those numbers to pinpoint exactly who was behind it, using our credit consented databases. However, what the supposed Marilyn Black did was kept calling from new numbers. Our assumption was that she was using throw away sims.”

“However, by her staying in conversations with him and sending emails we were able to look at data behind some of the emails. We started looking for IP addresses to see if we could pinpoint what jurisdiction this Marilyn Black was from. In this situation it made sense to keep up the conversations, but we wouldn't say that for every single case – this is something we decide on a case-by-case basis, depending on what the scenario is,” he said.

Analysing the blockchain

One of the advantages of the blockchain, where transactions involving cryptoassets are recorded, is that anyone can access it and see where funds are moved to. However, with millions of transactions recorded every minute, it takes an expert eye and specialist analytics technology to make sense of the information.

AnotherDay use specialist tracing software. to analyse blockchain transactions and trace the movement of funds.

“The platform digests all of the information from the blockchain in a really easy and visible format,” Pinto said.

Pinto said: “On the left-hand side it shows you where the funds have come from – the investor’s cryptocurrency exchange account – and the interactions of each of the wallet addresses, which are all of these little black dots in a vertical line to the right of that. That line of black dots represents a singular wallet address that sits within an exchange service. Within that wallet address there are sub wallets that get generated with each transaction – these are the other black dots to the right of the first vertical line. There are multiple dots shown to represent the singular wallet purely to show visually what is happening with each of the transactions thereafter. It can get quite messy at points, but we break things down into bite sized chunks for our clients to show exactly what is happening with their funds.”

Each transaction is time and date stamped.

“If the suspected fraudsters are saying to investors that their funds are sitting in a particular wallet account, we can disprove that if we can see that within minutes of the funds being placed in that wallet they are transferred off to another account,” Pinto said.

The platform also allows AnotherDay to check “the receiving exposure” – that is, data about the other wallet addresses that have transacted with the single wallet account. The information presented reflects inputs from law enforcement and government agencies from around the world.

“The great thing about the exposure is that we are able to see the origin of where funds have come from,” Pinto said. “Various aspects we can trace back to child abuse material, other recorded frauds and high-risk exchanges, all types of illicit activity like terrorist financing – there will be funds sat within this wallet address that can be traced back to all of those bits of illicit activity. So, if you were to withdraw those funds – as in the assets – and transfer it to another wallet address, you can't be guaranteed that those funds that you are moving across haven't come from terrorist financing, for example.”

Asset recovery

It is crucial to get the right legal and forensic team in place to prevent the dissipation of stolen cryptoassets. A package of evidence can be used in conjunction with civil law methods to stop fraudsters from converting those assets back into fiat currency.

Pinto said: “We can identify the specific wallet addresses that funds are moved to, to inform applications for freezing injunctions. We can help clients with civil claims built around the premise that the funds residing in those wallets belong to them.”

Where worldwide freezing orders are granted, it allows victims’ legal teams to prevent alleged fraudsters from accessing their assets at the locations specified. Applications for freezing injunctions are typically supplemented by applications to the court for a disclosure order to be issued against cryptocurrency exchanges, to help identify the owner of accounts to which the traced funds have been transferred to.

Hinesh Shah, forensic accountant and financial crime investigator at Pinsent Masons, said: “An important step is identifying who owns the accounts or wallets where the defrauded cryptoassets have ended up. The defrauded amounts could end up in a single wallet or many, it just depends on how sophisticated the fraudsters are and how much time and effort they have taken to obscure the misappropriated funds. However, because the blockchain is public, crypto technology enables the tracing of the funds. At some point, the fraudsters are likely to transfer the funds to a cryptocurrency exchange where they can look to realise their proceeds, by converting them back into fiat currency.”

Realising the stolen funds involves a further step. Once a judge has ordered the return of funds back to a fraud victim, the frozen assets are auctioned off in lots and the proceeds returned to the victim.

The success of asset recovery will often depend on the speed with which fraud victims act, Pinto said.

“The blockchain doesn't sleep,” he said. “People can trade on the blockchain instantly, you know, within seconds, so the quicker that you look at tracing digital assets the better because it gives the fraudsters less time to dissipate it.”

The future of cryptoasset investigations

Cryptoasset frauds are growing in number.

In the UK alone, the Financial Conduct Authority (FCA) has reported that the number of enquiries it received about potential cryptoasset scams over the year to the end of March 2021 grew steadily, from 176 enquiries in April 2020 to 566 enquiries in March this year.

Pinto said he is contacted “daily” from cryptoasset investors who are concerned they have been defrauded. He said AnotherDay is working on around five major cryptoasset fraud investigations currently where the value of the client funds allegedly misappropriated in each case runs into the hundreds of thousands and even millions of pounds.

Jennifer Craven of Pinsent Masons said: “The UK courts have shown a real willingness to support the alleged victims of cryptoasset frauds in their attempts to identify the apparent fraudsters and seize funds. The approach taken by the High Court in London in the case of Fetch.AI in July 2021 reiterates this. In that case, the judge granted the application for permission to serve its claims against ‘persons unknown’ outside of the jurisdiction of England and Wales because the evidence presented to the court was persuasive and the supporting legal action pursued speedily enough.”

“This demonstrates the value of engaging the right legal and forensic specialists and in acting expeditiously when there are suspicions a cryptoasset fraud has been perpetuated. We anticipate that cases such as Fetch.AI will come before the courts in the UK in increasing number over the months and years ahead,” she said.