A crypto con exchange, and soaring ticket scams

**Graham Cluley** (0:03)
Don't believe what you've read in the press, he says. They say I was staying at a luxury hotel. I certainly wasn't. It was an ordinary hotel, he said, with no stars. No stars, I think he means...

**Carole Theriault** (0:14)
No celebrities?

**SPEAKER_3** (0:25)
Smashing Security, Episode 405, A Cryptocon Exchange, and Soaring Ticket Scams, with Carole Theriault and Graham Cluley.

**Graham Cluley** (0:35)
Hello, hello, and welcome to Smashing Security, Episode 405 My name's Graham Cluley.

**Carole Theriault** (0:39)
And I'm Carole Theriault.

**Graham Cluley** (0:41)
Now, Carole, it's just you and me this week. I'm heading off to the States for a conference.

**Carole Theriault** (0:46)
Very exciting.

**Graham Cluley** (0:47)
Busy, busy, busy. Let's kick the show off, shall we?

**Carole Theriault** (0:50)
Yes, but first, let's thank this week's wonderful sponsors. OnePassword, Harmonic and Scanner.dev. It's their support that helped us give you this show for free. Now, coming up on today's show, Graham, what do you got?

**Graham Cluley** (1:04)
I'm going to be talking about a very different kind of cryptocurrency exchange.

**Carole Theriault** (1:08)
And I'm talking big concert tours, the likes of Ozzy, Beyonce and Oasis. Plus, I chat with Cliff Crosland. He's the CEO and co-founder of Scanner.dev. And we talk about how to turn raw log data into searchable resources. All this and much more coming up on this episode of Smashing Security.

**Graham Cluley** (1:36)
Now, chums, chums, I promised I was going to speak about a very special kind of cryptocurrency exchange.

**Carole Theriault** (1:42)
I think they'd all say that they're pretty special.

**Graham Cluley** (1:44)
Oh, this particular exchange, as you'll find out towards the end of the story, is a little bit different. But anyway, I want to tell you about a cryptocurrency exchange called BTC-e. And it was one of the world's largest and widely used cryptocurrency exchanges, BTC-e. And it processed several billion dollars worth of transactions during its lifetime. And unfortunately, it was also one of the principal exchanges used by hacking gangs and fraudsters and drug lords and the like to launder their criminal proceeds.

**Carole Theriault** (2:18)
They were propping up the exchange, is that what you're saying?

**Graham Cluley** (2:21)
Well, I think they were primary users. So if you were into hacking, if you're into ransoms, if you're into fraud and identity theft and those tax refund fraud emails, quite possible that any money which was being made was going through BTC-e.

**Carole Theriault** (2:36)
Okay.

**Graham Cluley** (2:36)
And perhaps unsurprisingly, the most commonly traded regular currency, so the non-cryptocurrencies. Have you got any ideas what people were paying in in terms of real currencies and what maybe they were taking the money out in?

**Carole Theriault** (2:49)
No. I'm guessing they're getting out some currency, some crypto of some sort.

**Graham Cluley** (2:53)
Yes. Those were the digital currencies, but then they were translating them into real world currencies because you don't want things to permanently be in digital currency, do you?

**Carole Theriault** (3:02)
Well, you could tell that to many, many, many users. No idea.

**Graham Cluley** (3:06)
US dollars and Russian rubles. They were the ones which were ruling the roost. So they've been swapped back and forth with Bitcoin and Litecoin. Yeah.

**Carole Theriault** (3:16)
Those are pretty big geographies as well with lots of people.

**Graham Cluley** (3:19)
Yes. Yes. Yes. But it sort of fits into a model, doesn't it, of where a lot of the cryptocurrency bad guys and the cybercriminal bad guys might be based. And like other cryptocurrency exchanges, BTC-e charged transaction fees. I mean, that's the way to make money, isn't it? Is just to have a little bit of a crust which you're scraping off the top. So every time you used BTC-e to exchange your digital currency into regular money, they would take a percentage.

**Carole Theriault** (3:47)
Sure. Like every bank in the planet, I'm sure.

**Graham Cluley** (3:50)
It's estimated that they handled over nine billion dollars. That was the figure by 2017 Absolutely enormous. So why did the cybercriminals love BTC-e so much? Well, it was because it lacked even the most basic anti-money laundering controls. So if you wanted to conceal the money which you had stolen through an identity theft, for instance, or through a cryptocurrency scam or through a ransomware attack, you may well have chosen to use BTC-e because it made it more tricky for the police to track and attribute funds and who owned what wallets because they weren't finding out anything about you.

**Carole Theriault** (4:33)
So you're basically effectively anonymous in doing these transactions?

**Graham Cluley** (4:36)
Pretty much. So to use BTC-e, you could create an account on their website, and you didn't have to provide even the most basic identifying information. You didn't have to give it a name or date of birth or an address. All it required was a username and a password and an email address. And of course, that could have been an anonymized email address.