red 
In a series of blogs to coincide with the publication of our report on cryptocurrency sanctions, we have identified a number of steps that compliance teams can take to protect their organizations from exposure to sanctioned entities.
This included managing your country’s risk exposure, advice on how to identify red flags, using effective blockchain monitoring solutions and embedding a risk management framework.
In the final post in this series, we’ll explore the importance of defining your research strategy. In this way, if a risk is identified, you will be equipped to detect potential sanctions violations and report them to the relevant authorities.
I dig deeper
In case of potential exposure to sanctioned entities, compliance teams need an investigative strategy that allows them to take a deeper look at user activities and investigate them in detail.
This is especially true in cases involving sanctions, as even indirect and allegedly remote connections between sanctioned parties can lead to serious regulatory consequences.
Fortunately, there are a number of steps compliance officers can take to stay safe. These include:
- using crypto-forensic analysis software – such as Elliptic Investigator – to map the flows of funds related to suspected sanctions cases;
- the existence of documented investigative procedures and record keeping policies;
- maintaining internal escalation processes to raise alerts where positive hits are identified;
- ensuring that all relevant personnel have the necessary skills to conduct crypto investigations; and
- clearly documenting investigation findings in final reports that can be shared with relevant parties.
Case Study: The $100M Horizon Hack
In June 2022, over $100 million in cryptoassets was stolen from Horizon Bridge – a service that allows funds to be transferred between the Harmony blockchain and other blockchains.
Multiple cryptoassets were stolen, including wrapped Bitcoin (WBTC), Tether (USDT), Ether (ETH), and BNB. The attacker(s) then used decentralized exchange (DEX) Uniswap to convert the Ethereum-based funds into a total of 85,837 ETH.
Elliptic’s analysis of the break-in and laundering of stolen digital assets also found it consistent with the activities of the Lazarus Group – a North Korean state-sponsored cybercrime organization.
Using Elliptic Investigator – our multi-asset crypto forensics tool – we were able to map the flow of funds from Harmony Hack to Tornado Cash, and further through the blockchain to crypto exchange services. Using these same capabilities, investigators can map the trail of assets related to sanctions evasion cases.
The image above from Elliptic investigators shows the flow of funds from the Lazarus Group’s crypto wallet linked to the $100 million Harmony Horizon Bridge hack. The arrows indicated where the funds were sent through other wallets (indicated by white circles) before being sent through Tornado Cash.
Summary
Complying with sanctions is by no means an easy task. The rapidly evolving threat landscape and increasing regulatory scrutiny make it almost certain that the sanctions-related challenges facing the cryptocurrency industry will only grow in complexity over time.
Compliance officers must tackle these challenges head on and manage them successfully. Failure to do so can result in significant fines and regulatory convictions that businesses cannot afford.
Fortunately, Elliptic’s extensive suite of solutions can equip teams with the necessary tools to ensure sanctions compliance.
How we can help
Having access to the analytics capability of the blockchain backed by robust data is essential to achieving effective sanctions review for any cryptocurrency compliance operation.
Users of Elliptic Lens – our crypto wallet verification solution – can use our industry-leading dataset to identify additional addresses controlled by sanctioned individuals and entities.
Meanwhile, our transaction verification tool Elliptic Navigator is used by many of the largest crypto exchanges in the world to detect suspicious transactions. With configurable risk scoring features, compliance teams can establish the monitoring parameters they need in Navigator to align with their business model and risk appetite.
They can also use Elliptic Discovery, our database of comprehensive due diligence profiles on more than 1,000 virtual asset service providers (VASPs) located around the world.
In addition, our holistic review capabilities enable the identification of risks associated with crypto wallets and transactions, even when funds have passed through cross-chain services.
Finally, compliance teams should be equipped with the capabilities to conduct in-depth investigations into suspected sanctions violations involving mixers and other covert services. Using Elliptic Investigator, analysts can map the flow of funds to visualize complex transactions involving mixers, helping them determine whether sanctions avoidance is possible.
To learn more about achieving sanctions compliance and how you can protect your organization from exposure, download our Guide to Cryptocurrency Sanctions Compliance 2023.
