Security Brief: Illicit Finance and Economic Threats Week of March 27, 2022
March 27 - 30, 2022 | Issue 1
Jennifer Kelly, Illicit Finance and Economic Threats (IFET) Team
Justin Maurina, Editor; Jennifer Loy, Chief of Staff
Money on a washing line
Date: March 28, 2022
Parties involved: French authorities; German authorities; Luxembourg authorities; EU Agency for Criminal Justice Cooperation (Eurojust); Lebanon; Riad Salameh; Five unidentified individuals
The event: French, German, and Luxembourg authorities seized properties and frozen assets connected to a money-laundering investigation in Lebanon worth a combined $130 million USD. Eurojust stated the investigation involves five unidentified individuals suspected of embezzling public funds in Lebanon worth over $330 million USD between 2002 and 2021. Eurojust did not confirm if the probe or assets were linked to Riad Salameh, the Lebanese central bank governor recently charged in Lebanon for money-laundering operations.
Analysis & Implications:
The five unidentified individuals almost certainly use the real estate market to launder money by inflating the prices of property and renovation materials. The Euro being the common currency between France, Germany, and Luxembourg very likely enables swift and consistent transactions between European banks, meaning law enforcement is unlikely to identify money-laundering operations easily. Easy transportation between EU countries also likely allows individuals to transport illicit funds over borders with minimal law enforcement interference.
The Lebanese economic crisis very likely encouraged national law enforcement to coordinate and investigate illicit financial flows with international authorities. The five unidentified individuals suspected of embezzling public funds in Lebanon are likely connected to Riad Salameh due to his recent Lebanese money-laundering charges. If the ongoing European investigation identifies more assets related to money laundering operations in the Middle East, European law enforcement agencies will very likely coordinate more with Middle Eastern authorities. Greater collaboration will likely identify and disrupt further illicit financial flows including terrorist financing operations.
Date: March 29, 2022
Parties involved: Sky Mavis; Ronin Blockchain; Axie Infinity; Cryptocurrency Hackers; NFT-based Online Gamers; Federal Bureau of Investigation (FBI) Virtual Asset Exploitation Unit
The event: Unidentified cryptocurrency hackers targeted the Ronin Network, a gaming-focused blockchain that supports the Axie Infinity game, and stole approximately $625 million USD of Ethereum and USDC, two crypto-coins. Axie Infinity attracts over two million everyday users, with millions of dollars in daily transactions. The hackers forged fake withdrawals from the online game, which went unnoticed until a user could not make a withdrawal and filed a report. Sky Mavis, the game developer, stated most of the stolen cryptocurrency remains in the hackers’ crypto wallet.
Analysis & Implications:
The hackers almost certainly targeted the Ronin Network due to its popularity and high volume of daily cryptocurrency transactions. Cryptocurrency’s decentralized nature very likely enables crypto-hackers to successfully steal cryptocurrency without immediate detection from companies. The lack of regulations on the cryptocurrency market likely makes users more vulnerable to cryptocurrency crimes and impedes law enforcement’s actions to prevent cryptocurrency hacks and scams.
The FBI Virtual Asset Exploitation Unit will likely track some of the stolen cryptocurrency by tracing cryptocurrency blockchains. However, it is unlikely they have the proficiency in retrieving all the funds, as the newly established unit likely lacks the experience to contend with advanced cyber-crime. The crypto-hackers will likely evade detection from law enforcement by ‘washing’ the stolen cryptocurrency, quickly moving it through several crypto-coins, and transferring it to more secure crypto-coins that are difficult to trace. Cyber-hackers will also likely liquidate the stolen funds through online sites that accept cryptocurrency transactions, such as gambling sites or unregulated cryptocurrency ATMs.
________________________________________________________________________ The Counterterrorism Group (CTG)
 EU countries freeze assets worth $130m in Lebanon probe, Deutsche Welle, March 2022, https://www.dw.com/en/eu-countries-freeze-assets-worth-130m-in-lebanon-probe/a-61285115
 Hackers steal over $600 million from video game Axie Infinity's Ronin network, CNN, March 2022, https://edition.cnn.com/2022/03/29/tech/axie-infinity-ronin-hack/index.html