This is an automated archive made by the Lemmit Bot.
The original was posted on /r/monero by /u/Unimamo on 2024-01-24 18:56:41.
The article is in Finnish, and for my knowledge there are no English articles (yet, the news is 3 hours old).
KRP (Keskusrikospoliisi, Finnish National Bureau of Investigation), said that they successfully traced Monero transaction. The cyber criminal, the KRP were after, got ransoms in Bitcoin and then sent them to a non-KYC exchange. KRP made an information request to the exchange. He exchanged his ransom Bitcoins to Monero and sent those Moneros to his own private wallet. After that, he sent Moneros to Binance and again exchanged them to Bitcoin.
All sections of the investigation report where KRP discloses its methods of tracing have been redacted. They don't want to reveal anything about the analysis of Monero transactions.
Here is the article translated:
In the Vastaamo case, a big revelation: KRP traced the cryptocurrency that was considered "untraceable".
According to KRP, the money paid to the counter extortionist ended up with Julius Aleksanteri Kivimäki and a man living in Estonia. KRP believes that it has found out how Vastaamo's extortionist laundered money. At the same time, KRP says that it has traced a cryptocurrency that was considered "untraceable". This is what it's all about.
On Monday, a news bomb was dropped in the large trial regarding the data breach and extortion of the front office.
Regional prosecutor Pasi Vainio revealed that KRP has investigated the virtual currency transfers of Vastaamo's extortionist and is able to prove that the ransom money sent to the extortionist ended up in Julius Aleksanteri Kivimäki's personal bank account.
The matter was resolved in an additional investigation, which the prosecutor requested from KRP last November. The studies were completed about two weeks ago. KRP had sorted out the matter in complete silence.
The prosecutor described the additional investigation as a significant demonstration against Julius Aleksanteri Kivimäki. According to the prosecutors, this is yet another piece of evidence that Kivimäki, accused of numerous crimes, really is Vastaamo's extortionist.
Kivimäki's defense naturally disagrees. The content of the KRP's report has been strongly disputed. According to the defense, it has not been possible to find out the movements of the money as claimed by the police. Kivimäki has generally denied all criminal charges.
What exactly did KRP find out and how? MTV Uutiset got acquainted with the additional investigation report prepared by KRP.
Old trick
Although the prosecutor requested an additional investigation into virtual currencies only in the middle of the trial, the matter had already been clarified in the KRP at the very beginning of the preliminary investigation of the Vastaamo case.
In October 2020, when the big data breach had not yet been revealed to the public, KRP decided to use an old trick to find a person who tried to extort a large sum of money from Vastaamo by threatening to publish customer information. A fake purchase was made.
KRP sent 0.1 Bitcoin to the virtual address where the extortionist had requested ransom money.
Julius Aleksanteri Kivimäki, who was accused of extortion, was finally tracked down by other means, and the fake purchase is not even mentioned in the actual preliminary investigation protocol of the case.
In the additional investigation that started last November, however, the trick was significantly useful.
The money was transferred immediately
In further investigation, KRP traced the amount transferred to a Bitcoin address beginning with bc1q using virtual currency analysis. So the purpose was to follow digital traces and find out where or to whom the money had ended up.
The investigation revealed that soon after the fake purchase of KRP, the extortionist had transferred the money from the Bitcoin wallet.
It was probably easy for the police to figure this out, because the Bitcoin virtual currency is based on transparency. All transfers made in the blockchain are public and leave a trace. Anyone can browse transfers in various online services.
The trail led to the virtual currency exchange service, where KRP sent a request for information. The service in question does not require its customers to register, and does not collect, for example, personal data.
So there was no decisive lead, but a lead nonetheless.
The Monero Challenge
The service replied that the sender of the money had exchanged the Bitcoin funds for the Monero virtual currency and then sent them on to a private Monero wallet.
Monero is largely based on the same principles as Bitcoin. It is also a blockchain-based so-called cryptocurrency that can be used as a medium of exchange.
But there are also significant differences.
Fund transfers on the Monero blockchain are not public in the same way as Bitcoin. Features are also built into the blockchain, which are intended to make transfers as difficult as possible to trace.
Within Monero, tracking money flows is therefore significantly more difficult than Bitcoin. In advertising, Monero is even considered "untraceable".
Now KRP claims to have succeeded in just that.
All sections of the additional investigation report where KRP discloses its methods have been encrypted. We don't want to reveal anything about the analysis of Monero traffic.
According to the head of the investigation, Marko Leponen, the information is secret, because it is about the police's technical methods.
In Finnish, it's about the fact that the police don't want to tell criminals or anyone else how the anonymous cryptocurrency could have been traced. Working tracing methods could be of significant help to KRP in other ongoing or future criminal investigations.
Monero is known to be popular among cybercriminals, for example, because of its features.
According to Leponen, investigating Monero traffic was still not easy.
In KRP's report, the Monero analysis is described as heuristic, i.e. the purpose is mainly to find out the most likely or best option as a payment recipient. Sometimes the conclusions are very certain, sometimes not.
A man living in Estonia was interviewed
Based on the KRP's classified report, it can be considered "very likely" that the money sent from the exchange service to a private Monero wallet then ended up in another virtual currency exchange service. It's about Binance, which is one of the most internationally known and largest companies offering virtual currency services.
The same transfer unexpectedly resulted in a multiple, several thousand euros larger amount of virtual currency than the 0.1 Bitcoin originally sent by KRP.
KRP's investigations did not find out where the other money came from.
Instead, KRP tried again to find out the recipient's identity with a request for information, but once again no identifiable personal information other than the email address had been attached to the account.
According to Binance, the funds entered into the account were exchanged from Moneros back to Bitcoins. According to KRP's report, most of them were moved forward again, this time in two different directions.
KRP followed another path to the account of a man living in Estonia. It's about the right person who has also been reached. According to the head of the investigation, Leponen, the Estonian police have spoken to the man.
- An investigation has been requested from the Estonian police about the person, Leponen commented.
KRP currently does not suspect the man of any crime, but the receipt of the money and at the same time the man's part in the matter are being investigated. Leponen is tight-lipped in these respects.
According to the KRP's additional investigation report, the man's role is still unclear.
Money mules
Another of the paths followed by KRP led the police from Binance to an online service that promises to exchange virtual currency for money instantly.
According to KRP, the idea of the service is that the customer sends virtual currency to the service, and private individuals acting as "money mules" of the service then transfer the corresponding amount of euros as a bank transfer to the bank account indicated by the customer.
Several account transfers made by persons suspected of being money mules were found in Julius Aleksanteri Kivimäki's personal account.
The police concluded that the people behind the account transfers were money mules, because cryptocurrencies had been sold in the names of those people in another service. The receipts advertised a service that Kivimäki is suspected of using.
The timing of the transfers also coincided perfectly with the payments tracked by KRP.
According to the KRP report, it can't be a coincidence that the traces led to Kivimäki's account.
Other explanations
In addition to the fake purchase, KRP's additional investigation examined a cryptocurrency wallet seized from a server located in Tuusula, connected to Vastaamo's criminal network.
A large amount of virtual currency had been sent from the wallet to another Binance account that emerged in the investigation. In total, it is about tens of thousands of euros.
*There was also no official personal information reported for that Binance account. However, KRP found out that an attempt had previousl...
Content cut off. Read original on https://old.reddit.com/r/Monero/comments/19emsfe/finlands_national_bureau_of_investigation_claims/
