IRS-CI: Following the Financial Crime Trail

You may be asking yourself, “Why is someone from the Internal Revenue Service Criminal Investigation (IRS-CI) division writing about the cyber world?” Well, let us put it this way: As money moves around the world, IRS-CI is following the money used by criminals to build criminal financial investigations. While the majority of cases worked by our special agents may be tax-related, we can be involved in any case that requires the detailed tracking of money and data. That tracking can be the decades-old “paper trail” or now, more commonly, found on digitally distributed, decentralized, public ledgers known as blockchains.

In the depths of the dark web, criminals partake in corruption, drugs, guns, health care fraud, romance scams, bank fraud, money laundering or even high-tech international cybercrimes that use cryptocurrency. Attached to all their criminal activity is money. Whether it is funneled through legitimate banks, a mixing service or through the blockchain, IRS-CI special agents follow the money. We follow the data. We follow the DNA in the cyber world. Everything leaves a trail, and we are the experts in following the metaphoric breadcrumbs.

When we begin to look at emerging threats, it makes sense to look at past cases. While the way a fraud is carried out may change, the basics of the fraud are still basic.

Let us explore a few cases from the IRS-CI New York Field Office that you may not have known were worked on by IRS-CI. These cases were highly publicized because the fraud was egregious, innovative (if we can say that about fraud) or high value.

The first, One Coin,¹ was a case investigated by IRS-CI working with the Federal Bureau of Investigation. It was described by The Times as “one of the biggest scams in history.”² Prosecutors in the Southern District of New York alleged the scheme brought in approximately $4 billion worldwide. IRS-CI investigators used their ability to follow the money and trace the cryptocurrency while working on complex frauds. Ruja Ignatova, the “Missing Cryptoqueen,” has absconded and a red notice was issued. Sabastian Greenwood, a coconspirator, received 20 years in prison.³ At the core of the fraud was the century-old Ponzi and pyramid scheme.

The Frosties non-fungible tokens (NFT) case was worked by IRS-CI and multiple federal agencies. This is a case where the founders of the NFT Frosties were arrested after allegedly executing a $1 million fraud scheme in January 2022.⁴ At the time, NFTs represented a new era for financial investments, but the same rules apply to an investment in an NFT or a real estate development. You cannot solicit funds for a business opportunity, abandon that business and abscond with money investors provided you. This was publicized as the first-ever NFT rug-pull case. While the idea is not new, the way in which the fraud was carried out certainly was.

While it is possible to base future endeavors based on past experience, technology has advanced so rapidly that cyber unit investigators must remain forward-looking. A good example of this is the Samourai Wallet case. Two developers were charged for developing, marketing and operating Samourai, a cryptocurrency mixing service that executed over $2 billion in unlawful transactions and served as a haven for criminals to engage in large-scale money laundering.⁵ Those arrested for this scheme allegedly facilitated the laundering of over $100 million of criminal proceeds from Silk Road, Hydra Market and a host of other computer hacking and fraud campaigns.⁶ Special agents with IRS-CI New York and IRS-CI Los Angeles’s Cyber Units worked with our federal and international law enforcement (LE) partners to not only arrest the founders and CEO but also to seize their domain.

Another case worked by the IRS-CI New York Cyber Unit is MEV Bot Exploit. Two brothers allegedly committed a first-of-its-kind manipulation of the Ethereum blockchain by fraudulently gaining access to pending transactions, altering the movement of the electronic currency, and ultimately stealing $25 million in cryptocurrency in 12 seconds from their victims.⁷ Although this case was complicated and fast-moving, special agents did what IRS-CI investigators do: follow the money.

Regardless of the complexity of the case, IRS-CI continues to lead the effort in financial criminal investigations with cutting-edge technology and good old-fashioned investigative work, on and off the blockchain.

However, it is important to note that much of what we can do is because we have strong partnerships, both in the public and private sectors. Collaboration is essential in the way we do business these days. We (not the royal we, but all of us) must be on the same page in understanding the rules, laws and priorities of the government. Each component can bring unique expertise to the table, enhance resources and increase cybersecurity. Partnerships allow us to combine our strengths to develop more effective cyber strategies and crime prevention and detection techniques. Sharing this information allows for a more comprehensive view of cyber threats, helping both sectors identify and respond to suspicious activities more effectively. Especially in money laundering―which often occurs across borders―collaboration facilitates international information sharing and coordination, making it more difficult for criminals to exploit jurisdictional gaps.

Cybercriminals are evolving, and they are getting more resources as they get paid for their efforts. As the criminal world evolves, it is imperative that LE does as well. IRS-CI is investing in its Cyber Units to ensure that no matter how age-old or how brand-new a scheme is, we can get the perpetrator and continue to protect the integrity of our financial systems.