Cybercriminals have created their own block analysis tool

A blockchain analysis tool has launched on the dark web, allowing Bitcoin addresses to be checked for links to criminal activity. Known as Antinalysis, it allows cryptocurrency forefathers to test whether their funds will be identified as proceeds of crime on regulated exchanges.

Crypto assets have become an important tool for cybercriminals. I like it ransomware and darknet markets they rely on payments in Bitcoin and other cryptocurrencies. However, laundering and monetizing these revenues is a big challenge. Cryptocurrency exchanges are used blockchain analytics toolssuch as those provided by Elliptic, to check customer deposits for links to illegal activities. By tracing a transaction back through the blockchain, these tools can identify whether funds originate from a wallet associated with ransomware or any other criminal activity. The launderer therefore risks being identified as a criminal and being reported to the police whenever they send funds to a business using such a tool.

Antinalysis seeks to help cryptocurrency launderers avoid this by giving them an overview of what a blockchain analysis tool will do with their bitcoin wallet and the funds it contains. The site runs on Tor, an anonymous version of the web commonly used to host darknet markets and other illegal services.

Antinalysis users are charged about $3 to verify a single bitcoin address. An example of the obtained results is shown below. The site provides an overview of where it thinks bitcoins came from, categorizing by risk. Proceeds from darknet markets, ransomware and theft are considered “extreme risk”, while funds from regulated exchanges and freshly mined coins are classified as “no risk”. In the example below, 2.7% of the bitcoins held at the address were returned to the darknet market.

The creator of Antinalysis is also one of the developers of Incognito Market, a darknet market specializing in the sale of narcotics. Incognito launched in late 2020 and accepts payments in both Bitcoin and Monero, a cryptocurrency that offers increased anonymity. The launch of Antinalysis likely reflects the difficulty the market and its vendors are facing in monetizing their Bitcoin revenues.

Antinalysis claims to offer highly accurate results and has confirmed this by comparing them to those generated by commercially available block analysis tools. However, Elliptic’s own assessment of results for a range of bitcoin addresses shows that it was poor at detecting links to large darknet markets and other criminal entities. This is perhaps not surprising – providing accurate blockchain analytics requires significant investment in technology and data collection, over long periods of time.

Regardless, the tool represents a significant new opportunity for cryptocurrency launderers. They can now test their own laundering methods, whether using mixers or layering techniques, by checking their own Bitcoin wallet, before taking the risk of making a deposit with an exchange or other service provider. Compliance professionals should be aware of this new tactic.

It is also significant because it makes blockchain analytics available to the public for the first time. To date, this type of analysis has primarily been used by regulated financial service providers. Individuals or retailers concerned about receiving the proceeds of crime could now begin verifying addresses before accepting bitcoin payments.

For exchanges and other crypto businesses, the launch of services like Antinalysis means it’s more important than ever to use cutting-edge blockchain analytics tools such as offered by Elliptic. As our own testing has shown, such a tool cannot match the sophistication of solutions based on several years of research and development and data collection – enabling our clients to see links to crime that are invisible to the criminals themselves.

UPDATE: As first suggested in Brian Krebs’ article, we can now confirm that the results provided by Antinalysis are identical to those provided by AMLBot. Therefore, it is likely that Antinalysis uses the AMLBot API. AMLBot is itself a reseller for Crystal Blockchain, an analytics provider.