Binance sued for money laundering over stolen bitcoin.

[bitsurfer2014]

Let's admit that Binance has partly fault here.
First off, they have weak KYC protocols.
Second, they have high withdrawal limits.

That was few reasons why users grab the opportunity and took advantage of it. With those everyday withdrawals of 2 btc, haven't the Binance suspected some suspicious activity here? It's pretty obvious that money laundering activity is on going and they can actually freeze those transactions. However, I still doubt they can do such if the suspected users used different or multiple accounts.

I think Binance's alibi would be that they had acted in good faith, hence the 2 BTC daily withdrawal for unverified accounts. Morever, Binance is not the only exchange imposing more or less on such withdrawal limit for unverified accounts.

In this regard,  Binance would only be accountable and liable if the aggrieved party could prove that they have previously informed them of such illegal activity and Binance didn't do any action such as freezing those accounts involved to mitigate the situation.

[1715425790]

1715425790

[1715425790]

1715425790

[1715425790]

1715425790

[o_e_l_e_o]

I wonder what this exchange would have done if the criminals had sent all the coins directly to a mixer or via coinjoin. Would they be trying to sue wallet developers? Or perhaps the bitcoin developers themselves for coming up with coinjoin?

2 BTC every 24 hours. It will take a lot of time for them to launder it.

Read the article I shared above. They did not move all the coins through a single account over several months. Rather, they created multiple accounts and used them all simultaneously.

This is one of the reasons why privacy and security advocates frequently tell people to take their internet security and privacy seriously.

If you have your identity stolen and used in a money laundering or similar scam, you can end up with a criminal record and serving a punishment for a crime you did not commit. It can take years and tens of thousands of dollars of your own money to get your name cleared, all the time leaving you with a criminal record, unable to get a job, get insurance, and so on. It's difficult enough when the crime is in fiat and you can show account statements and similar which prove you had nothing to do with it. How much harder do you think it will be for bitcoin? How do you prove you do not own a bitcoin address?

Every time you complete KYC anywhere you are taking a risk.

[Japinat]

Probably the OP source: https://www.coindesk.com/japan-cryptocurrency-exchange-zaif-fisco-binance-laundering-hack, for complete details.

So they actually did take advantage of the 2 BTC limit..

Correct me if I'm wrong, but assuming that the 1,451 BTC came from one wallet address, I was expecting better security measures from Binance knowing that it's one of the biggest cryptocurrency exchanges we have atm. You'd expect such move from the hackers would automatically raise huge red flags on Binance's side.

They did, but can they sue Binance for that.

Binance has been operating with a license and if they have an anti money laundering policy, that should be based on what the regulators are directing them to follow and implement, so I don't think that Binance is guilty for this case since they have their policy and it was not  penalize by the regulators.

If they will do that to Binance, then the rest of the exchanges are also not implementing their anti money laundering policy based on standards.

[NotATether]

Even Bisq has a 0.01BTC trading limit for unverified accounts, and Binance has withdrawal limits as high as 2BTC?? What's the point of blocking access to whole countries if they can just transfer it to someone abroad who can withdraw it to a bank account they control?
If you're going to implement AMLs then at least do it properly, false impressions of compliance are worse than no compliance at all.

I wonder what this exchange would have done if the criminals had sent all the coins directly to a mixer or via coinjoin. Would they be trying to sue wallet developers? Or perhaps the bitcoin developers themselves for coming up with coinjoin?

Legally they can't file a lawsuit against a collection of open-source developers if they have a legal complaint with the software they're developing, because an open-source project is not a legal entity. Instead they usually go after major corporate users of said software, like how SCO sued IBM (or was it Novell?) to claim Linux kernel source code as their intellectual property. In this case if they were to initiate such a hare-brained case they'd be going after Blockstream, who sponsored some of the bitcoin devs at the time Coinjoin was made.

This is one of the reasons why privacy and security advocates frequently tell people to take their internet security and privacy seriously.

If you have your identity stolen and used in a money laundering or similar scam, you can end up with a criminal record and serving a punishment for a crime you did not commit. It can take years and tens of thousands of dollars of your own money to get your name cleared, all the time leaving you with a criminal record, unable to get a job, get insurance, and so on. It's difficult enough when the crime is in fiat and you can show account statements and similar which prove you had nothing to do with it. How much harder do you think it will be for bitcoin? How do you prove you do not own a bitcoin address?

Every time you complete KYC anywhere you are taking a risk.

Agreed, KYC is fundamentally broken. If you complete KYC for your bitcoin services you are effectively using a less useful form of payment than credit cards, since those are accepted practically anywhere, whereas Bitcoin isn't. You need to give your documents to every single vendor you want to buy from, versus a centralized bank or payment processor.

AML regulations seem to have been hastily written as soon as regulators noticed that bitcoin was being used for illegal things like Silk Road. They are playing a game of whack-a-mole if they put KYC requirements on the top 50 exchanges but you can just withdraw your BTC to a credit card on Yobit or <insert other shady exchange here>.

I've never completed KYC before, and probably never will, because I can't afford to lose my identity. But, I also feel bad for bank account commoners whose bank documents are stolen and used for identity theft but they are not even aware that their identity has been stolen.

[ropyu1978]

Even Bisq has a 0.01BTC trading limit for unverified accounts, and Binance has withdrawal limits as high as 2BTC?? What's the point of blocking access to whole countries if they can just transfer it to someone abroad who can withdraw it to a bank account they control?
If you're going to implement AMLs then at least do it properly, false impressions of compliance are worse than no compliance at all.

I wonder what this exchange would have done if the criminals had sent all the coins directly to a mixer or via coinjoin. Would they be trying to sue wallet developers? Or perhaps the bitcoin developers themselves for coming up with coinjoin?

Legally they can't file a lawsuit against a collection of open-source developers if they have a legal complaint with the software they're developing, because an open-source project is not a legal entity. Instead they usually go after major corporate users of said software, like how SCO sued IBM (or was it Novell?) to claim Linux kernel source code as their intellectual property. In this case if they were to initiate such a hare-brained case they'd be going after Blockstream, who sponsored some of the bitcoin devs at the time Coinjoin was made.

This is one of the reasons why privacy and security advocates frequently tell people to take their internet security and privacy seriously.

If you have your identity stolen and used in a money laundering or similar scam, you can end up with a criminal record and serving a punishment for a crime you did not commit. It can take years and tens of thousands of dollars of your own money to get your name cleared, all the time leaving you with a criminal record, unable to get a job, get insurance, and so on. It's difficult enough when the crime is in fiat and you can show account statements and similar which prove you had nothing to do with it. How much harder do you think it will be for bitcoin? How do you prove you do not own a bitcoin address?

Every time you complete KYC anywhere you are taking a risk.

Agreed, KYC is fundamentally broken. If you complete KYC for your bitcoin services you are effectively using a less useful form of payment than credit cards, since those are accepted practically anywhere, whereas Bitcoin isn't. You need to give your documents to every single vendor you want to buy from, versus a centralized bank or payment processor.

AML regulations seem to have been hastily written as soon as regulators noticed that bitcoin was being used for illegal things like Silk Road. They are playing a game of whack-a-mole if they put KYC requirements on the top 50 exchanges but you can just withdraw your BTC to a credit card on Yobit or <insert other shady exchange here>.

I've never completed KYC before, and probably never will, because I can't afford to lose my identity. But, I also feel bad for bank account commoners whose bank documents are stolen and used for identity theft but they are not even aware that their identity has been stolen.

Why have to worry for lost your identity with rusted exchange like Binance, maybe for withdrawing under 2 btc every day is not have to kyc and bigger investor will submit KYC for allowing withdraw more than 100 btc every day, right now many people always try to KYC because some time have good chance to get profit when arbitrage.

[NeuroticFish]

Withdrawing 2BTC / day can be risky, any custodian wallet, including Binance can easily seize the funds if they get the chance.
Binance has also some bad guys caught in their history (see here or recently here). Of course, catching a few rotting fish when half of the pond stinks, is not enough.

However, what Zaif exchange does is not so much related to Binance doing anything wrong. They try to deflect public eyes from them to somebody bigger. They want to hide their incompetence, which is .. childish.

[Debonaire217]

Basically if they confirmed that their exchange was hacked, they will be cautious already and the very first thing that a person will do for this kind of fraud is to investigate the wallet address of the recipient. I wonder why it took a long time for them to see receiving address as Binance account or report it to Binance too late. Knowing that Binance could freeze the account and investigate too to avoid the funds being withdrawn. They literally waited for the funds to be completely stolen then sued Binance for it. Is it just a possible attack to Binance?

[NotATether]

Why have to worry for lost your identity with rusted exchange like Binance, maybe for withdrawing under 2 btc every day is not have to kyc and bigger investor will submit KYC for allowing withdraw more than 100 btc every day, right now many people always try to KYC because some time have good chance to get profit when arbitrage.

If I wanted to make money from arbitrage trading bitcoin, I would be signing up with an FCA-regulated CFD broker and hedging on BTCUSD prices, not with a crypto exchange with little oversight and a history of security breaches while trading the same cryptocurrency you're holding your capital in, it prevents you from profiting on shorts without complex BTC <--> Tether swaps.

[bitsurfer2014]

I wonder why it took a long time for them to see receiving address as Binance account or report it to Binance too late. Knowing that Binance could freeze the account and investigate too to avoid the funds being withdrawn. They literally waited for the funds to be completely stolen then sued Binance for it. Is it just a possible attack to Binance?

Good point! May they had sued Binance knowing its a losing case but hoping they will come to a settlement and ultimately recover their lost funds - assuming Binance would submit to their demand and  that is only possible if Binance will opt for a compromise but I doubt they would not do it since the case lacks merit and it could damage their reputation within the crypto-community. Imho.

[KingsGambet19]

So who is having fault now? Binance or the bitcoin system itself. I know that bitcoin was built for a digital or cashless transaction making it anonymously as an option for this feature but still one can find ways to get identity verified if it is needed for both parties before proceeding into the transaction. However, this issue is clearly the for binance mismanage loopholes in their system and making it clear that there is a violation in their system not getting detected or just leave that way without them apprehending the users behind this activity. Pretty that they got profit from the transaction and probably does not think no one will going after them.

[kryptqnick]

Probably the OP source: https://www.coindesk.com/japan-cryptocurrency-exchange-zaif-fisco-binance-laundering-hack, for complete details.

So they actually did take advantage of the 2 BTC limit..

Correct me if I'm wrong, but assuming that the 1,451 BTC came from one wallet address, I was expecting better security measures from Binance knowing that it's one of the biggest cryptocurrency exchanges we have atm. You'd expect such move from the hackers would automatically raise huge red flags on Binance's side.

I don't understand how a 2 BTC limit could be used for almost 1.5k BTC... It's, like, at least over 700 accounts to pull this off. And if the KYC really the issue here? Maybe some other rules could be enforced instead. Such as a VPN ban and obligation to share real geolocation. Making 700 accounts would be way more difficult in that case. I understand that 700 KYCs is even better for this case, but simply because some manage to abuse the system, I don't think it's fair to impose KYC on everyone. Not to mention what's been pointed out about identity theft. Lowering the limit to 1 BTC or even 0.5 BTC would make sense, but also some additional measures like geolocation or the MAC address, idk. There must be something apart from KYC that could be enforced, right?

[Stedsm]

Seriously speaking, what would Binance do when the thieves weren't so scared of going for a KYC when it's about millions of dollars and what will the victim exchange gain by trying to defame Binance over this saying that they don't meet the industry standards when it comes to KYC?

If the thieves would have already had done fake KYC over Binance and redeemed the coins into another exchange or simply went for an OTC deal? Even if they sold their coins, don't you think it's be easier for them to just get a fake bank account which is not theirs but on someone else's name? And at some places, even the bank guys are guilty because too much money is involved here, so their integrity can easily be bought.

[ReiMomo]

I wonder why it took a long time for them to see receiving address as Binance account or report it to Binance too late. Knowing that Binance could freeze the account and investigate too to avoid the funds being withdrawn. They literally waited for the funds to be completely stolen then sued Binance for it. Is it just a possible attack to Binance?

Good point! May they had sued Binance knowing its a losing case but hoping they will come to a settlement and ultimately recover their lost funds - assuming Binance would submit to their demand and  that is only possible if Binance will opt for a compromise but I doubt they would not do it since the case lacks merit and it could damage their reputation within the crypto-community. Imho.

I guess and I have doubt that will be the reason behind the scene. They know that Binance is a large exchange and most of traders use this Binance for years. The point is, why they don't report and until bitcoin was successfully withdrawn. It's obviously they want to ruin the repuation of Binance which is possible to happen because they are also against from fraudulent activity.

You guys think that if they were successfully ruin the reputation of Binance there is a chance to increase traders. It sound s like a trap.

[TedMosby]

It's funny how they are seeking for compensation for the losses as if it's Binance that was responsible for the poor security protocols in their shit exchange that led to hackers being able to steal all that bitcoin in the first place.

The 2 BTC rate per day is too small to launder such amounts of money unless they used so many fake accounts which brings the question of, how were they able to trace that all the bitcoins the claim went through Binance?

What kind of hacker would move such amounts of BTC to a centralized exchange where they can easily seize it without thinking of mixing it?

Yeah, agree with. Everytime I read news about a person/group suing an exchange as the destination of the hacker, it looks like they want to split the bill. 
Nowadays, you can buy fake accounts with KYC. I saw it on a facebook crypto group.

[Bttzed03]

~
So if I anonymously trade peer-to-peer and buy some bitcoin which happens to have come from a hack, through no fault of my own I deserve to have my coins seized and my account frozen as soon as they touch an exchange? Whatever happened to fungibility?

No, it's not fair to block an 'honest' buyer's account because of the origin but that's another matter. Was I implying that it should be blocked? I certainly wasn't thinking about that when I said they still came from the same exchange.

~
I talked about crystal ball because I doubt anyone would transfer so much stolen money to an exchange where he could only withdraw 2 bitcoins a day, while that person could simply use many mixers that all his work would be much easier. 

Based on the links shared in this thread so far, hacker/s actually created multiple accounts.
Some of the stolen funds were also mixed.

Let's admit that Binance has partly fault here.
First off, they have weak KYC protocols.
Second, they have high withdrawal limits.

Their KYC protocol and withdrawal limit are just fine to me. IIRC, they even partnered with Chainalysis and Ciphertrace to improve their AML/KYC compliance. Are they partly at fault here? I'd rather leave that to the court with jurisdiction of the case.

[pawanjain]

Obviously that had to come into limelight since the total amount is about $15.2 million which is a lot. The 2 BTC unverified withdrawal limit was considered good since it helped to keep the anonymity aspect of bitcoin safe but hackers have used it to their advantage and I am quite sure now that the lawsuit is raised this limit will be removed too. Now onwards people will have to do a KYC just to create an account on Binance and I guess other exchanges will follow the suit.
Binance should have thought a work around for such an attack earlier since it is quite obvious that even if a hacker tries to create 500 fake accounts and uses 2 BTC unverified withdrawal for each account then he will be able to withdraw 1000 BTC without any KYC.

[BlackFor3st]

This is kinda fishy if the Binance didn't do something about it because they will surely be accountable if they allowed the hacker to exchange the money and freely cashout it. I will just hope that Binance team are not part of the hack or to what happened because they should have taken an action to it either they freeze the account or do some legal stuff in order to freeze the money and return it to the right owner.

9.4 million dollar is not a joke amount and Binance should rather check carefully all the big transactions that comes in their exchange so hackers cannot use their exchange freely and for the hackers to have a difficulty in cashing out their loot.

[Tipstar]

Obviously that had to come into limelight since the total amount is about $15.2 million which is a lot. The 2 BTC unverified withdrawal limit was considered good since it helped to keep the anonymity aspect of bitcoin safe but hackers have used it to their advantage and I am quite sure now that the lawsuit is raised this limit will be removed too. Now onwards people will have to do a KYC just to create an account on Binance and I guess other exchanges will follow the suit.
Binance should have thought a work around for such an attack earlier since it is quite obvious that even if a hacker tries to create 500 fake accounts and uses 2 BTC unverified withdrawal for each account then he will be able to withdraw 1000 BTC without any KYC.

It looks like there would be no exchanges left that would allow users to exchange without KYC. With giving so much value and importance to bitcoin, it's sad to see an important expect of it dying. Though no one is forcing anyone to use such exchanges but when you have no means left to buy and sell your coins and your funds are all legit, you'd be compelled to give up your identity as that would be the easy way to do it.

[Stedsm]

--snip--

I'm extremely surprised the way they would have divided this money into parts and had the guts to send these coins directly to Binance (as they probably knew that if they mix their coins and send them to Binance, Binance would either block or seize their coins until a KYC would have been conducted). So, no mixing services involved, how the hell were they able to transfer such a big amount to Binance without coming into limelight is what's crushing my brain atm.

If KYC gets mandatory, we'll probably see a bit drop in the number of users adopting crypto (maybe because their sole intention of using it is remaining anonymous while trading and gambling it, but if such rights will also be taken away from those users, I don't think people would use exchanges but may go more for things like uniswap and p2p).

[o_e_l_e_o]

If KYC gets mandatory, we'll probably see a bit drop in the number of users adopting crypto (maybe because their sole intention of using it is remaining anonymous while trading and gambling it, but if such rights will also be taken away from those users, I don't think people would use exchanges but may go more for things like uniswap and p2p).

I don't think so. As much as I constantly espouse privacy and decry KYC, I am under no delusion that the majority of people involved in bitcoin today do not share my mindset. Further, if someone is looking to get involved in crypto solely to remain anonymous, then monero is probably a better choice for them than bitcoin is. And if they do want to use bitcoin and remain anonymous, then using a centralized exchange, even without completing KYC on it, is a terrible choice.

If KYC becomes mandatory, then we will likely see a proliferation in the number of DEXs and a growth in the volume they are dealing with, which would be great for everyone who is interested in their privacy.