Cryptohack Roundup: Geosyn Fraud Lawsuit

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, the SEC filed suit against Geosyn, prosecutors fought dismissed Tornado Cash criminal charges, an analyst tracked North Korean crypto laundering, the European Parliament approved an anti-money laundering law, the FBI warned of unregistered crypto entities and South Korea may make its crypto investigative unit permanent.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

The U.S. Securities and Exchange Commission filed a civil lawsuit against Texas-based cryptomining and hosting company Geosyn and co-founders Caleb Ward and Jeremy McNutt, alleging involvement in a $5.6 million fraud scheme. The complaint says the defendants misled more than 60 investors between November 2021 and December 2022 by misrepresenting their miner purchases and operations and that many aspects of their representations contained falsehoods. Geosyn failed to disclose to new investors that previous investors had not received the mining machines promised, and the company did not fulfill the services outlined in its offering documents, the lawsuit says.

The defendants also allegedly fabricated lucrative contracts with electricity providers, inflating costs by 40% to 50% compared to what was disclosed to investors. Ward and McNutt also allegedly misappropriated $1.2 million for personal expenses, including family vacations, guns and watches. They made “periodic bitcoin distributions” to investors to conceal the operational deficiencies, the suit says, and raised only $320,000 from mining but distributed $354,500 in bitcoin. This, the lawsuit alleges, required McNutt to purchase bitcoin himself to cover the difference.

The SEC is seeking a permanent injunction, repayment of misappropriated funds and penalties against the defendants.

In response to Tornado Cash co-founder Roman Storm’s motion to dismiss his criminal case in the United States, federal prosecutors filed a 111-page motion arguing against the dismissal. Storm and company co-founder Roman Semenov face charges including conspiracy to commit money laundering, conspiracy to violate the International Emergency Economic Powers Act and conspiracy to operate an unlicensed money transmitting business.

Prosecutors said that Storm wasn’t just a coder and that he promoted and profited from the service knowing that it facilitated money laundering. Despite claims that users could access Tornado Cash’s underlying smart contracts directly, many customers used the native interface, and a majority relied on the relayer network controlled by Tornado’s co-founders, they said. The indictment alleged that Storm and Semenov continued to support Tornado Cash, even after becoming aware that it was being used for illicit activities.

North Korea’s Lazarus Group laundered $200 million worth of cryptocurrency into fiat money between August 2020 and October 2023, according to an investigation by crypto analyst ZachXBT. He examined more than 25 exploits across various blockchains to trace the path of illicitly obtained funds and found that the funds processed through mixers, peer-to-peer marketplaces and centralized exchanges ultimately were withdrawn in traditional fiat currency.

The European Parliament approved new anti-money laundering regulations that establish due diligence obligations for cryptocurrency companies. The regulations focus on due diligence measures and identity checks for customers and extend these requirements to entities such as crypto asset managers. These entities will also need to report suspicious activities to relevant authorities.

The legislation, passed on April 24, will affect crypto-asset service providers, including centralized crypto exchanges and other entities such as gambling services. A new agency dubbed the Anti-Money Laundering and Countering the Financing of Terrorism Authority will oversee and supervise the implementation of the new rules. The legislation still technically requires approval by the European Council, a committee of direct representatives of trading bloc countries.

The FBI’s Internet Crime Complaint Center cautioned Americans against using unregistered cryptocurrency money transmitting services and advised them to verify that the firms providing the services are registered as money services businesses under federal law and adhere to anti-money laundering regulations. IC3 suggested using a Financial Crimes Enforcement Network tool to do so – the tool currently lists firms such as Coinbase and Kraken as being compliant.

The FBI said that individuals who use unlicensed crypto services to transmit money might face financial disruptions during law enforcement actions, particularly if their cryptocurrency is mixed with illegally obtained funds. It also cautioned against relying solely on app store listings for legal compliance, as some apps may not meet federal requirements.

South Korea is reportedly looking to turn its temporary crypto investigative unit into a permanent department to combat crimes and fraud related to cryptocurrencies. The ministries of Justice and the Interior will start discussions in early May to elevate the Joint Virtual Asset Crime Investigation Unit to an official department. Currently operating under the Seoul Southern District Prosecutor’s Office, the unit faces the risk of being disbanded. The proposed change will also include appointing new prosecutors and allocating dedicated budgets.

Launched in July 2023, the unit comprises 30 experts from seven financial and tax regulatory authorities, making it South Korea’s first specialized investigative body targeting digital asset crimes.

The move comes amid a surge in crypto-related criminal activities in South Korea. According to a February report by the country’s Financial Intelligence Unit, local crypto firms reported 16,076 suspicious transactions in 2023, representing a 49% increase from the previous year.

In addition to establishing a permanent investigative unit, South Korea will implement crypto regulations on July 19, including stricter criminal penalties for market manipulation. Certain cases will potentially carry life sentences.

With reporting from Information Security Media Group’s Jayant Chakravarti in Pune, India.