The Crypto Detectives Are Cleaning Up

Before a new breed of cryptocurrency detectives helped bring him down, Ryan Felton marketed his crypto scheme with a grandiose promise: He was creating “Netflix on the blockchain.”

He called the crypto-themed streaming service FLiK. For a small amount of the popular digital currency Ether, customers could purchase a FLiK token, which would give them access to shows and movies broadcast on the new platform. Mr. Felton described the project as an “entertainment revolution”; crypto enthusiasts bought more than $2 million worth of FLiK coins.

But the streaming business never materialized. Instead, Mr. Felton bought a $1.5 million house, along with $32,000 in diamonds. He spent $180,000 more on a red Ferrari.

When cryptocurrencies hit the mainstream in the 2010s, the technology was widely viewed as a perfect vehicle for crime. A drug dealer or scam artist could transfer large quantities of money instantly, without relying on a bank to validate the transaction. To early advocates, crypto was appealing because it promised the secrecy and anonymity of cash, without the inconvenience of face-to-face exchanges.

That secrecy was an illusion. Crypto transactions are inscribed on a publicly viewable ledger called a blockchain. To the untrained observer, blockchain records are unintelligible — a jumble of meaningless letters and numbers. But a growing industry is dedicated to deciphering them.

At the center is the New York analytics start-up Chainalysis, which was valued at $8.6 billion after a funding round last year. With tens of millions of dollars in federal contracts, Chainalysis has built a reputation as one of the crypto industry’s leading detectives — a team of blockchain analysts that helps the government track crypto transactions.

As federal agencies orchestrate an aggressive crackdown on crypto fraud, Chainalysis has come to occupy an increasingly important position in the industry. The company markets itself to the government and private companies as a force for good in a badly behaved sector — a firm whose business is solving crimes and cooperating with public officials.

After the FTX exchange imploded, its bankruptcy lawyers hired Chainalysis to disentangle the web of entities at the center of Sam Bankman-Fried’s empire and track the $400 million in crypto that a hacker stole from FTX’s accounts. Chainalysis has also been conducting some light diplomacy: In April, it hosted a conference in Manhattan to bring together government officials and the newly chastened crypto executives who are trying to win back their trust. Guests received socks stitched with the Chainalysis logo.

But that ambassadorial role has also put Chainalysis at odds with some of crypto’s most passionate advocates, who envisioned digital money as a private, anonymous financial network. That clash is a battle for crypto’s future, and it’s unfolding at a turbulent moment in the industry’s short history.

From the government’s perspective, Chainalysis is arguably the most trusted company in the industry — but only because it sells powerful tools aimed at penetrating the veil of secrecy that made crypto attractive in the first place.

The blockchain is “oftentimes the key to unlocking a case,” said Jonathan Levin, 32, one of the founders of Chainalysis. “It’s more traceable and more conclusive.”

In late 2020, Mr. Felton was indicted on charges that he had used investors’ funds to finance his extravagant lifestyle. He went on trial in Atlanta last summer. Testifying for the prosecution was Beth Bisbee, a Chainalysis investigator who once worked for the Drug Enforcement Administration. In 2014, her analysis of blockchain records helped the D.E.A. track down an internet drug dealer in Arizona.

That investigation was relatively low-tech: Ms. Bisbee pasted Bitcoin transaction logs into a spreadsheet, which she searched for clues. These days, crypto fraud is more complicated, involving multiple types of currencies, each with its own blockchain. Chainalysis makes software that can do the time-consuming work automatically.

In the courtroom, Ms. Bisbee presented a colorful diagram mapping the movement of the millions of dollars’ worth of Ether that investors spent on Mr. Felton’s tokens. The funds had been routed to a series of crypto wallets, digital repositories where people can store their holdings. Using a forensic technique called clustering, Ms. Bisbee showed that all those wallet addresses belonged to the same person: Mr. Felton. From those accounts, he had moved his investors’ Ether to one exchange before transferring it to another. Then he’d converted the Ether into cash.

“What was the source of the vast bulk of those funds before they were wired out?” one of the prosecutors asked Ms. Bisbee.

“The FLiK token sales,” she replied.

The prosecution presented its case over four days in July. On the last day, Mr. Felton pleaded guilty.

A new kind of crypto business

About a decade ago, Mr. Levin, then a master’s student in economics at Oxford University, was at a pub with a friend when the conversation turned, naturally, to the topic of cryptocurrency arbitrage. Variations in the price of Bitcoin across two exchanges had created a moneymaking opportunity: Buy Bitcoin at the lower price, then sell it for a profit.

The arbitrage trade proved too time-consuming and logistically complicated for Mr. Levin to execute. “I probably had, like, 100 pounds to my name,” he said. But the conversation ignited Mr. Levin’s fascination with Bitcoin. The digital currency was invented in 2008 by a mysterious figure named Satoshi Nakamoto, who envisioned a private, decentralized form of commerce that would operate outside the supervision of any government or financial institution.

Mr. Levin was no radical libertarian, however. A 20-something from the United Kingdom, he was interested in the inner workings of the technology, and he saw an opportunity for professional advancement: Not many other people seemed to be studying cryptocurrencies. At the time, Bitcoin was still considered the domain of hackers and drug dealers; none of Mr. Levin’s professors wanted to supervise his research.

Undeterred, Mr. Levin started attending crypto conferences and eventually wrote a master’s thesis titled, “Creating a decentralised payment system: A study of Bitcoin.” But he still had questions.

“No one understood how and why people were actually using crypto,” Mr. Levin said. “If you could package that information up and supply that to all of the most important stakeholders, you can build systemically one of the most important companies.”

While he was still at Oxford, Mr. Levin started a blockchain analytics company called Coinometrics, but it soon fizzled. (“It’s probably not the best idea to meet your co-founders on Reddit,” he said.) Then, in early 2015, he was introduced to Michael Gronager and Jan Moller, Danish entrepreneurs who were working on a similar project. Mr. Gronager had been using blockchain analysis to track crypto lost in the collapse of Mt. Gox, an early exchange. Together, the three men founded Chainalysis.

As the crypto industry has expanded, blockchain tracking has become increasingly important. These days, some of the largest crypto companies hire blockchain analytics firms to help monitor their customers’ activity and comply with laws designed to stop money laundering. In bankruptcy proceedings, analytics firms sort through the remains of collapsed crypto companies, investigating public transaction logs to locate missing funds.

The crypto industry’s recent downturn has taken a toll on the tracking business. Elliptic, one of Chainalysis’ competitors, cut 10 percent of its staff in February. The same month, Chainalysis laid off about 40 employees, a roughly 5 percent cut.

But blockchain analysis companies have been insulated from the worst effects of the market crash. Chainalysis declined to reveal its exact sales figures, but Mr. Gronager said the company’s revenue increased 70 percent last year despite the crisis in crypto markets. That growth is partly a function of the company’s business model: Two-thirds of its revenue comes from partnerships with public institutions, including law-enforcement agencies, the company says, a source of income that remains relatively stable even when the market implodes.

The Justice Department paid Chainalysis $12,500 for its work on the Ryan Felton case, according to federal records. But that assignment was a drop in the bucket. The Justice Department, the Treasury Department and other federal agencies pay for the ability to use Chainalysis’ blockchain-tracing software, including a tool called Reactor, which maps transactions. In total, Chainalysis has active contracts with the federal government worth about $65 million, according to an analysis of federal records by Jack Poulson, the executive director of the nonprofit Tech Inquiry, which tracks contracts.

Lately, though, Chainalysis has faced competition from smaller rivals including TRM Labs, a tracking firm that has gained prominence by selling software for new types of cryptocurrencies with names like Solana.

In 2021, an official at TRM emailed the Treasury Department to question its decision to award an exclusive contract to Chainalysis, according to email logs obtained through a public records request.

The TRM representative asked for a “rationale as to why this procurement isn’t following a competitive bid process,” according to the emails. “There are multiple providers with analogous capabilities that meet” the requirements, the representative wrote. By early last year, TRM had secured its own contract with the Treasury Department, according to a company spokeswoman. And TRM was hired alongside Chainalysis to work on FTX’s bankruptcy.

“We went from a Bitcoin world to this multi-chain world, and people needing tools to follow illicit activity no matter where it happens in the crypto economy,” said Esteban Castaño, TRM’s chief executive. “There’s constantly going to be new assets, new blockchains.”

Fighting for privacy

At times, the transparency of the blockchain has been a boon to law enforcement. In 2020, Chainalysis worked with U.S. investigators to bring down the largest child-pornography website on the dark web. By analyzing the blockchain, agents located the digital addresses of customers who were using Bitcoin to buy the illegal pornography. The trail led to the crypto exchanges where the customers had bought their Bitcoin in the first place; the government could then subpoena those firms to establish the wallet owners’ identities.

Despite those kinds of law-enforcement victories, the rapid growth of blockchain-tracking firms has provoked some uneasiness in the crypto world. One of Chainalysis’s government clients is Immigration and Customs Enforcement, which has an active contract with the company worth a total that could rise to roughly $12 million, according to federal records. An I.C.E. spokesman did not respond to requests for comment; Mr. Gronager, the Chainalysis founder, said the agency tracks blockchains to combat drug trafficking, and that he’s not aware of any cases in which I.C.E. has used his company’s tools for immigration enforcement.

To privacy advocates, the company’s relationship with I.C.E. looks like a slippery slope.

“It’s pretty trivial to use a blockchain analysis tool to see what transactions are sending money back to El Salvador,” said Justin Ehrenhofer, an executive at the crypto privacy firm Cake Wallet. “That gives them a new angle to specifically target immigrants.”

Mr. Ehrenhofer discovered virtual currencies when he was a teenager; at the time, he was using private browsers to look up L.G.B.T.Q. content on the internet, because he hadn’t yet come out to his parents. His interest in the technology stemmed from its potential use as a privacy tool. But that viewpoint is increasingly old-fashioned. In recent years, the radical, idealistic traditions of the technology have largely given way to a more pragmatic approach, as Wall Street traders and Silicon Valley venture capitalists have flocked to the crypto world, in search of new ways to generate wealth online.

“The initial impetus for what we think of as digital cash and currency was privacy,” said Finn Brunton, the author of a 2019 book about the history of crypto. “It’s flipped all the way around.”

Cake Wallet is one of a handful of companies still developing tools to make crypto transactions less traceable, a kind of counteroffensive against the blockchain-tracking industry. One of the firm’s main products is a crypto wallet compatible with Monero, a so-called privacy coin that’s harder to track than other cryptocurrencies. Every exchange of funds is recorded publicly, but the transaction information is obscured, making it much harder to see which wallet sent or received the money.

Investors aiming to evade blockchain-tracking software can also move funds through services known as mixers, which receive multiple strands of transactions and then combine them to obscure the source and destination of the money. In August, the Treasury Department barred Americans from using a popular mixer called Tornado Cash, saying it had been used to launder more than $7 billion in virtual currency, including hundreds of millions of dollars stolen by North Korean hackers.

The sanctions provoked an outcry from crypto investors. A group of Tornado Cash customers sued the Treasury Department to block the prohibition, arguing that mixers are essential to protecting privacy. One of the plaintiffs said he used the service to donate to the Ukrainian war effort, hoping to stay anonymous for fear of retaliation from Russia.

Chainalysis says little publicly about the techniques it uses to combat technologies like Monero or another crypto privacy service called Wasabi Wallet. But the company is trying to trace those transactions: Chainalysis has offered “Wasabi Demixing services” to the Office of Foreign Assets Control, a unit of the Treasury Department that oversees sanctions, according to documents obtained through a public records request.

The government’s access to such tools has alarmed old-school crypto advocates. “Bitcoin could be the worst surveillance nightmare that we’ve ever imagined — a world where everyone uses Bitcoin, but everybody’s transaction history is totally public and everyone knows how much money everyone has,” said Max Hillebrand, the chief executive of zkSNACKs, the company behind Wasabi Wallet. “That’s not a world I’d be comfortable living in.”

One morning in April, Mr. Gronager walked onstage at the Marriott Marquis hotel in Manhattan, welcoming a roomful of guests to Links 2023, an industry conference hosted by Chainalysis. He wore an orange Chainalysis T-shirt, matching his orange sneakers and orange watch strap. A line of glowing orange lights hung overhead.

“It’s time to build things,” Mr. Gronager proclaimed. “And we’re actually doing that.”

Blockchain analysis was once just a nerdy subculture of a nerdy industry, but recently it’s gained a sheen of mainstream glamour. On Twitter, armchair sleuths with hundreds of thousands of followers use tracking software to expose crypto scams. Chainalysis has hosted the Links conference since 2019, but the most recent edition was the largest, with 900 attendees gathered at a venue that once hosted the N.F.L. Draft.

In November, the technology journalist Andy Greenberg published “Tracers in the Dark,” a cinematic account of the rise of Chainalysis that details several of its highest-profile early investigations. Many of the law-enforcement figures profiled in the book have achieved celebrity status in the blockchain-tracking world and parlayed their knowledge of the technology’s inner workings into high-paying corporate jobs.

Tigran Gambaryan, a former Internal Revenue Service agent who helped crack the child pornography case, attended the Links conference in his new capacity as a compliance executive for Binance, the embattled cryptocurrency exchange. “I feel like I’ve met a legend,” one admirer said as he shook Mr. Gambaryan’s hand.

Mr. Gambaryan and other government investigators used Chainalysis’s technology to pursue terrorists and dark-net drug dealers. But the worst behavior in the crypto industry today is arguably even more difficult to combat: fraudulent offshore firms run by secretive executives, companies that engage in complex financial engineering to cover up holes in their accounts. Mr. Levin said Chainalysis is considering offering new product features that would help customers evaluate business risks in the crypto world.

“Everyone, after FTX, started to ask a lot more questions about counterparty risk,” he said. “We’re thinking about how do we present even better forms of information to them so that they can make informed decisions.”

But Chainalysis is deeply enmeshed in the industry it’s trying to clean up. A third of its revenue comes from the private sector; other blockchain companies use its software to gather market information. The firm’s long-term prospects depend on crypto’s continued growth. At the Links conference, Mr. Gronager clicked through a slide presentation full of graphs and statistics that he said showed the industry’s resilience during the market downturn. “We believe all value will move on the blockchain,” one slide read.

On the sidelines of the conference, some of the company’s guests privately expressed apprehension. By trying to legitimize crypto in the eyes of the government, was Chainalysis simply providing cover for companies that violate securities law or engage in widespread fraud?

The stories of crime-busting blockchain tracers have become part of the crypto industry’s public-relations playbook, said John Stark, a former Securities and Exchange Commission official and frequent crypto critic. “The idea that ‘Hey, we’re using these people to help us with our compliance,’ it’s just more subterfuge,” he said. “Some kind of masquerade.”

On the first day of Links, Mr. Levin appeared onstage for a friendly Q. and A. with Noah Perlman, a former federal prosecutor who was hired in January as Binance’s new chief compliance officer. Two months after Mr. Perlman joined, the Commodity Futures Trading Commission sued Binance, saying that gross compliance failures had allowed the exchange’s customers to launder money.

But Binance claims it’s turning over a new leaf. The company has hired former investigators like Mr. Gambaryan. And it has invested in blockchain tracking, buying more than 50 software accounts from Chainalysis.