How can hackers cash out stolen bitcoin?

Question

I've read about a lot of Bitcoin Heists and Thefts: from hackers that stole bitcoin from Exchange (Due to their poor security measures) or from Bitcoin users, to scam websites and so forth.

Some of these Heists and Thefts involve huge sums of Bitcoin.

So, I was wondering: how can the hackers that had done these Heists/Thefts, be able to "cash out" the stolen bitcoin?

For example, let's say that an hacker has stolen 1000 bitcoin from Bob's wallet, and he wants to sell the bitcoin for USD (With the current exchange rate: 1000 bitcoin = $445.000), so that he will be able to "enjoy" the money in his real life. But how?

1) Obfuscating the transactions:

Thanks to the Blockcahin, everyone will be able to see all the transactions from the address (Or addresses) where the 1000 stolen bitcoin are (So Bob can try to track him down). I guess that the hacker could use a mixing service, but: can he trust the mixing service? (There is the risk that the mixing service is just a scam; or that the mixing service turns into a scam, when the hacker try to launder the 1000 bitcoin and instead of launder the bitcoin, the owner of the Mixing service just steals the hacker's bitcoin). Or probably, he has already created his own "network" of bitcoin addresses, so that he can launder the stolen bitcoin by himself? (but could this be possible to set up? Or it would require too much time and efforts?).

2) Selling the bitcoin:

Then, he has to sell the bitcoin. Where? The vast majority of Bitcoin exchange require ID verification to be able to withdraw from them (Although there are few exchange that allow their clients to have unverified accounts, but they have strict limits such as 5000 USD o 10.0000 USD yearly, for example. And there is still the possibility that the exchange, being suspicious of these transactions, decides to froze the hacker's account.)

Probably he can sell the bitcoin to other people that want to buy bitcoin, on forums and so on; but wouldn't be too risky? Firstly, the hacker will have to find a lot of users that want to buy bitcoin (I don't think that he will find a user that wants to buy 1000 bitcoin on a forum); moreover, there is the risk that the hacker gets scammed by one of the buyer. Lastly, the transactions will be displayed on the blockchain, so Bob can still track him down (if the hacker hadn't used a mixing service or something similar) and try to contact the users that have bought the bitcoin, asking them information about the hacker.

Or probably the whole thing is much easier and hacker can have a bank account or a credit card (Obtained with Fake ID) that is not connected with his real identity? In this way, he could easily sell all the bitcoin that he wants to an exchanger and withdraw all the profits from the sale.

What do you think about?

Answer 1

Interesting points Paper, here some of my thoughts...

As you said, on the underground (i.e. TOR) there are forums where thieves are selling dirty coins, with a favorable exchange rate (1 clean coin for 2 dirty coins for example). But to avoid scam I suppose they will use some kind of anonymous escrow service to perform the exchange, to guarantee that both parties are willing to complete the transaction.

Mixing service are also risky since they only guarantee anonymity if there are actually other user's coins to mix with. I remember some time ago, when a thief sent a huge amount of stolen coins at once to a mixing service, the returning coins were practically the same since on the mixing service there wasn't other users mixing such big amounts.

I don't get the point about "his network of Bitcoin address" what you mean? You can generate thousands of addresses and send coins back and forth, but this will actually just obfuscate (you can always track from start address to destination). The only way to really mix them, is to mix with other user's coins.

Furthermore many stolen coins are probably used to purchase illegal items from hidden markets (drugs, weapons, pretty much anything). So they are actually "enjoying" them without the need to exchange them in "real" currencies.

And last but not least, in person exchange (for example thorough localbitcoins.com or another local directory for Bitcoin buyer and sellers)

Cheers

Answer 2

In the meantime there are many DEX (decentralized cryptocurrency exchanges). There is no CEO to whom a regulator can address any guidelines. The hacker can try to obfuscate the traces by exchanging the flagged coins at a DEX into a privacy coin like Monero and again back to Bitcoin (the DEX software is open source). Afterwards he can cash out the 'clean' coins he got from the DEX. This is less risky compared with using mixers (because he doesn't know if the mixer software doesn't store the relation between the old and the new Bitcoins). So he can obscure the traces to a large extent.

There are even DEX where you can cash out anonymously and directly. Either by using the payment method face to face (people meet personally and exchange coins against cash) or via normal bank transfer. Then you see on the blockchain the Bitcoins moving from A to B and parallel there is a bank transfer from Bob to Alice, but nobody brings both activities together. The purpose of the bank transfer looks like an invoice or shopping card number.

Since there are more and more Bitcoin acceptance points, it is not necessary to cash-out any more as pointed out before. The scammer simply spends the Bitcoins.