1 USDT ≠ 1 USDT
Stablecoins are one of the most important infrastructures in Web3 industry. They achieve value stability by pegging to the fiat currency of a real-world country. Ordinary users use them as an important means of storing value and making payments, while Web3 institutions use them as operational tools. The diverse demand has created a thriving stablecoin market. Consequently, stablecoins have also been exploited by illegal activities such as cybercrime, gambling, and money laundering. If ordinary investors or web3 enterprises accidentally receive stablecoins associated with illegal activities, they may face enforcement risks.
Bitrace’s research has found that criminals, in their pursuit of quick transactions or to evade detection, tend to accept significant deviations in the relative market exchange rates of stablecoins of different risk categories during the process of laundering risky crypto funds. Here, we take Tether (USDT), the stablecoin with the highest market share, as an example.
Sources of Risk for Blacklisted USDT
“Reverse freezing” is a term commonly used among cryptocurrency exchangers. It means that if an exchange address receives USDT involved in a case, the exchange account may be frozen by law enforcement authorities. Unlike bank accounts receiving illicit funds leading to account freezing, this enforcement action on crypto funds tracing is known as reverse freezing.
Such enforcement freezing activities are not limited to centralized cryptocurrency trading platforms. On decentralized on-chain addresses, the issuer of USDT, Tether, can also legally assist global law enforcement agencies in sanctioning certain addresses involved in cases. This means that by selectively “blacklisting” an address, Tether can effectively freeze the funds at that address.
A few days ago, the cryptocurrency trading platform OKX announced that it had collaborated with Tether to complete the targeted freezing of multiple on-chain addresses, totaling assets of up to 225 million USDT. These funds were alleged to be associated with illegal activities such as pig butchering scams and human trafficking.
Bitrace conducted a funds audit on the disclosed addresses. In the analysis of the sources of funds, we found that the criminal organization did not only use OKX for fund transfers. Well-known cryptocurrency exchanges like FTX and Binance were also exploited, with substantial amounts of funds involved.
Subsequent funds tracking revealed that more centralized exchanges, payment platforms, and even gambling platforms were also drawn in, unfortunately becoming money laundering hubs for criminals.
Clearly, even if OKX did not cooperate with law enforcement, the aforementioned web3 enterprises might assist law enforcement agencies in sanctioning the addresses hoarding the involved funds for the sake of compliant operations. In other words, neither fiat currency nor compliant stablecoins are “safe” value storage tools for criminal organizations. They often need to quickly launder involved assets to eliminate risk or liquidate them in a timely manner.
We believe that this need for laundering and risk avoidance is the main reason for the significant deviations in exchange rates observed in illegal transactions.
Scenarios of USDT Premium
“USDT Laundering” is a term used by criminals to refer to money laundering activities. The purpose of such activities is to transfer payments from high-risk users to accounts of low-risk users, thereby circumventing risk control measures of payment institutions. Traditional USDT Laundering involves transferring, splitting, and cashing out illicit funds through personal accounts such as banks, WeChat, and Alipay. However, in recent years, cryptocurrencies — especially stablecoins — have become a new tool for score-running.
The typical pattern involves USDT Laundering platforms recruiting various individuals to register accounts on cryptocurrency exchanges and link them to their bank cards. These platforms allow individuals to take orders and purchase a specific quantity of USDT at market prices from the exchange’s OTC section, then sell it back to the USDT Laundering platform at a higher price. The difference is the profit for the individuals. The funds used by the USDT Laundering platform to buy back USDT are illicit funds. Through this method, the USDT Laundering platform can launder funds without directly handling fiat currency.
The profits of USDT Laundering platforms come from upstream activities, including online gambling, illicit activities, and money laundering. The commission rates for different risk categories of illicit funds vary. For example, gambling funds are considered lower risk, so the commission is lower, while fraudulent funds are often seen as higher risk, resulting in higher commissions. Some USDT Laundering platforms even refuse to accept certain types of funds.
The different commissions are reflected directly in the exchange rate of USDT transactions. Higher-risk funds mean higher price premiums. In practice, investigations have encountered illegal USDT transactions priced at over 8 or even 10 RMB above market rates.
Scenarios of USDT Discount
So far, the vast majority of various low-priced USDT transactions based on reasons such as “black U arbitrage” and “black/white capital receiving U” are fraudulent activities. Bitrace has previously discussed black U pig-killing scams and offline cash transaction robberies in earlier articles, which you can refer to in past posts for more information.
However, there are still many scenarios of black-market USDT transactions below the market exchange rate, such as illegal proxy payment platforms. For example, some proxy payment platforms accept USDT deposits and use fiat currency to help users make payments on other platforms, including topping up gambling platforms, settling funds for capital pools, sending gifts on live broadcasting platforms, placing orders on e-commerce platforms, or even paying salaries to employees.
Proxy payment platforms do not differentiate the source of users’ USDT or have a comprehensive KYC mechanism, leading to an influx of a large amount of high-risk funds. This is why the fee sources and destinations of illegal proceeds in some cases appear as addresses associated with online gambling platforms on the blockchain. By using this almost anonymous transaction method for cashing out, operators in the black and grey markets do not need to register accounts on centralized compliant cryptocurrency trading platforms, greatly reducing the possibility of being “reverse frozen.”
Investigations have shown that USDT involved in these illegal proxy payment activities often trade below market rates by 0.05 to 0.3 RMB. The specific discount depends on the source of fiat funds for the proxy payment platform and the scale of users’ funds.
Be Alert to the Risk of Money Laundering Using USDT
Bitrace conducted a fund audit for addresses on the Tron network that were flagged as having money laundering risks and had a fund size exceeding 1 million USDT. The audit period was from September 2021 to March 2023, focusing on USDT inflows.
The data shows that from September 2021 to March 2023, a total of over 642.5 billion USDT flowed into addresses on the Tron network flagged as having money laundering risks. Interestingly, the fund size did not seem to be affected by the bear market in the cryptocurrency secondary market, indicating that the participants in these transactions were not genuine investors.
Combining the two risk scenarios mentioned above, this indicates that cryptocurrencies, especially stablecoins, are being maliciously exploited by money laundering groups. In order to avoid sanctions from centralized trading platforms and law enforcement agencies, criminals use illicit entities’ crypto addresses to obscure the origin of funds or use over-the-counter trades to disrupt the fund analysis chain. Illegal USDT transactions that significantly deviate from market exchange rates are a typical characteristic of these activities.
For more detailed information, you can refer to Bitrace’s earlier report,”The Use of Cryptocurrency in Cybercrime.”
Closing Note
According to The Block’s report, the issuing company of USDT has published a letter to the U.S. Senate Committee on Banking, Housing, and Urban Affairs and the U.S. House Committee on Financial Services, outlining its “commitment to security and close working relationship with law enforcement agencies,” and announcing its intention to include the U.S. Secret Service, as well as the FBI, which “are doing the same thing,” in its platform.
This fully demonstrates Tether’s compliance intentions in the stablecoin business. For web3 enterprises serving a large number of ordinary C-end customers, optimizing platform anti-money laundering risk control strategies for high-risk cryptocurrencies, establishing law enforcement cooperation and compliance departments serving various national government departments, has become an important matter that cannot be ignored.
Contact us:
Website: https://www.bitrace.io/
Email: bd@bitrace.io
Twitter: https://x.com/Bitrace_team