$75B Crypto in Pig Butchering is Not "F*cking Absurd", Actually
Number met with incredulity, denial and outrage, outrage, outrage by crypto boosters. Is the number plausible?
***********
For those who missed, I had an op-ed on The Diplomat: Why the US and China Should Work Together to Solve the Global Scam Crisis.
***********
A recent study titled “How Do Crypto Flows Finance Slavery? The Economics of Pig Butchering” stoked some outrage in the crypto space, because of its finding of $75 billion in potentially criminal proceeds, by tracing ~4,000 cryptocurrency addresses from pig butchering scams (PBS). It is sensational. News headlines say $75B has been lost to PBS. Even crypto-skeptics were skeptical. If one looks deeper into PBS and illicit crypto though, the scales mentioned shouldn’t be too surprising.
https://twitter.com/tayvano_/status/1767019490796314824
I’ll put the technical arguments at the end, because it’s best to tackle head-on first the biggest herring that critics of Griffin & Mei find hardest to swallow: that cryptocurrency associated with PBS is at least $75B.
SECTIONS:
Is $75B Plausible?
The Appeal to Chainalysis Fallacy
The Long Short of $75B
Is $75B Plausible?
As someone who has been writing about the PBS industry since early 2021, I also initially thought that $75B in cryptocurrency is too big, but I knew then that they must be counting the total flows through the addresses just before stolen PBS funds exit on crypto exchanges. The addresses could belong to professional money launderers and informal OTC brokers that service other illicit needs, like illegal online gambling and Chinese capital flight. Nevertheless, I think the tens of billions of dollars in criminal cryptocurrency suggested in the paper have basis (to be discussed later), and the existence of a tight crypto laundering network has been found in this paper and by others. So this is more about what to call the funds being counted there.
It may be more accurate to say that the $75B is the criminal income of PBS syndicates, who do many other cybercriminal activities - online shopping scams, job scams, fake kidnapping, telecom fraud, sextortion, human trafficking ransoms, online gambling, money laundering, etc. Before I get accused of moving goal posts, I will point out that the authors never said inside the paper that $75 billion is all from PBS. Other figures given in the paper — $15B, $27B, $40B — were more identifiable as PBS. Rather, they said $75B or higher is what the criminal entities linked to PBS have taken in via crypto in total.
Conversations with the authors confirmed that this is what they meant. Unfortunately the distinctions can be easily glossed over, which got reflected in the headlines of TIME and Bloomberg. I think the authors could be more explicit on the distinctions, but that’s their editorial choice. (To disclose, I and Raymond Hantho of Chainbrium, were the source of most of those addresses, as acknowledged at various places in the Griffin & Mei paper. We collected those addresses for our own parallel research into PBS that is still embargoed.)
Do the distinctions matter though? Arguably, no. It is tricky to define what PBS includes, beyond the commonly known formula. Chinese scam companies doing PBS commonly also do many other online rackets simultaneously. The ‘dog pushers’ (low level scammer) can be assigned to do romance scams in one day, shopping scams the next day, group investment scams the same day, and online gambling the next month, all in the same floor (yes, using crypto). Ultimately, from a scam companies’ point of view, those are all income.
Nevertheless, based on some people’s a priori belief about crypto, irrelevant parts of the Griffin & Mei paper were taken as supposed flaws in its methodology and used to discredit the whole paper, never mind the dataset was interrogated from many angles for consistency and robustness. Admittedly, academic papers can be quite dense.
Forget the methods. Is $75B plausible?
Consider that:
The Griffin & Mei dataset covers a period of about 4 years.
The US Internet Crime Complaint Center (IC3) reports $429M in cryptocurrency losses to PBS in 2021, $2.7B in 2022, and $4.3B in 2023.
PBS is severely underreported (by 3X or more) due to stigma and ignorance, especially early on in 2021, and especially among Chinese immigrant victims. PBS is also often miscategorized and unrecognized until recently.
Reports of PBS is rampant also in other developed countries –Japan, Korea, Australia, Canada, European countries, etc.
PBS is also not only a rich-country disease; Southeast Asian countries have long been heavily targeted.
In China, police reports of PBS in one year for 2020 amounted to $5.7B USD – not yet including illegal online gambling.
The UN estimated that Southeast Asian fraud factories earn $7.5B to $12.5B annually1.
In all, global losses to PBS syndicates can easily reach $20B a year in crypto and fiat.
Now consider the scam-adjacent industries in Southeast Asia:
Smuggling money out of capital-controlled China is big business — at $500B at a peak year. Crypto is still included.
Scholars have put the size of the Chinese gambling industry in Southeast Asia to be $100B to $500B a year (personal communication), and it has been estimated that $143B leave China per year through gambling.
The human trade for scam compounds in Southeast Asia involve hundreds of thousands of people. The UN found that, conservatively, 100,000 and 120,000 are trapped in scam compounds in Cambodia and Myanmar, respectively; Chinese reports at least 300,000 of its nationals are working/slaving as scammers; there are up to 500,000 mostly Chinese workers in the Philippine online gambling sector. One also can easily find the many recent reports of hundreds or thousands of individuals freed from scam compounds per police raid.
The billions of dollars mentioned here is not to conflate, but for context. How are these relevant? One, PBS syndicates are likely using the same money networks that evolved from cross-border underground exchanges of the Chinese diaspora. Supposedly because of the big liquidity demands, this money network will tend to concentrate and be highly connected. Two, many notorious scam compounds in SEA are outgrowths of the gaming and casino industries in the region. Indeed, many of the top Chinese fugitives for cyber-scams have backgrounds in running casinos. Asian governments and scam companies often consider online gambling and cyber scams together.
If one finds these numbers to be unbelievable, one should visit the fraud factories in Cambodia, the glittering Chinese casino cities in Manila, and the mafia ministates in Laos and Myanmar to get a feel. Or read Zeke Faux’ book Number Go Up, on the two chapters on Pig Butchering Scams.
The Appeal to Chainalysis Fallacy
The Griffin & Mei paper is contrasted by its critics to Chainalysis’ own estimate of PBS that the study critics treat as the gold standard. According to Chainalysis’ previous Crypto Crime Report, only $5.8B has been lost to all crypto scams in 2022, including PBS, and even less in 2021.
Chainalysis’ statistic is often misused in debates around cryptocurrency regulations. The fact that Chainalysis’ numbers on scams are merely the floor minimum is often undersold, even by Chainalysis itself historically. Chainalysis count only cases that they positively recognize. And aside from massive underreporting and mis-categorization of PBS, crypto scam reports also have to reach their database. Anyway, I already wrote extensively about the many technical and epistemological ways Chainalysis’ estimate is inadequate and wildly misleading, so I will just have a few more things to add here.
Chainalysis’ approach is understandable given that its tracing is used for criminal convictions, but applying the same approach in counting cases is simply inappropriate for public policy. Expecting complete evidentiary standards to every scam address and inflow before counting them as criminal is not realistic. As a contrast to Chainalysis’ approach of needing proof beyond reasonable doubt, in the public health sector, many actions are based on the preponderance of evidence. For instance, smoking has not been proven to cause lung cancer, but statistically speaking, you wouldn’t want to bet your life on it.
Complaints about the proprietary aspects of the tracing done in the Griffin & Mei paper while extolling Chainalysis’ estimate is ironic, given that Chainalysis itself is accused of peddling proprietary black box tracing. Also, one can easily argue the opposite of saying that Chainalysis “face stiff competition from other chain analysis providers and hence have an economic reason to get these things right” (from the same complainer). One can equally say that Chainalysis has an economic incentive to promote crypto use by underestimating crypto crime, while in academia where reputation is the only currency, researchers have to be careful of being ravaged by peer reviewers. Finally, it does not matter that Chainalysis is a multi-billion dollar company.
Relying on minimum values is useless if the actual value is many multiples of the minimum. One does not decide to wade across a stream just by knowing its minimum / shallowest depth. Chainalysis’ published number for PBS is too conservative to the point of being pointless; just compare it to FBI statistics. We might as well say, “at least $10 million has been lost to PBS globally”. To say that only a couple billion dollars in crypto has been lost to PBS is the real “fully fucking absurd”.
The Long Short of $75B
The more technical attacks on the paper centered on two flaws supposedly in Griffin & Mei’s methods: 1) the double-counting of flows and 2) tracing through service provider addresses (related to: one cannot know that all cryptos sent to a tainted address are criminal). The rest of the paper actually addresses those concerns in some ways.
In the tweeted screenshots, Tay (Taylor Monahan, crypto forensics expert and MetaMask product lead) finds a couple of “gotchas” of alleged double-counting, to paint the rest of the paper as untrustworthy. But the sentences picked out as double-counting were not used to derive the $75 billion. They are just descriptions of the recirculation that was observed, shown inside Figure 4A of the paper (I point out with a dashed circle, below). Instead, as detailed further in the paper, it is at the exit points, the exchange deposit addresses that the $75 billion was calculated from (shown by my arrow and solid circle).
Is the exit point the correct place to count? Exits to exchanges are one-way, and we can make other reasonable assumptions. With the sheer sizes of PBS cases and the pervasiveness of the scam cottage industry in the region, it is hard to believe that controllers of recipient accounts in Asian exchanges are unaware of the origin of funds or are not part of the scam industrial complex. They may even specialize in servicing Chinese scam companies.
When summing the total inflows to the exit addresses, the authors get:
$26B if they count the inflows to only the exit addresses revealed from the starting 4,000 reported PBS addresses.
$75B if they apply a logical heuristic to include other exit addresses controlled by the same owners of the initially identified exit addresses
Up to $238B if they relax the heuristic to include more exit addresses
How much of the exiting funds are likely from PBS?
The authors find that many of the largest exit (deposit) addresses are, individually, endpoints of up to 400 known reported PBS addresses; see Fig 13 in the paper. There are certainly thousands more unknown PBS intake addresses than the 4,000 we have gathered.
Tracing backwards revealed that $40B of the $75B come from exchanges within 5 hops; $15B of that came from US-facing crypto exchanges used by Western victims (Coinbase, Kraken, Crypto.com, Gemini)
The authors only counted transactions leaving exchanges that are below $500k, because victims are unlikely to send above that amount all in one go. The authors also do this to minimize double-counting of cashed-out funds reentering and going through the exit addresses again, which the authors surmise to be the scammers shifting internal money.
So which of these numbers is PBS?
My take is that $15B is the absolute minimum of PBS crypto from “Western” victims. I think the short, exchange-to-exchange transfers of $40B suggest that the global crypto defrauded by PBS could be as high as $40B. Those $40B in exchange-to-exchange crypto transfers below $500k certainly don’t look like retail trading. In our experience (Chainbrium) tracing by LIFO (Last-In-First-Out), stolen cryptos from PBS are quickly cashed out to exchanges, i. e. not circulating on-chain indefinitely as one would expect if they were traded away to unconnected crypto users.
**********
Aside from estimating the total size of PBS, there were interesting things the study authors found to support their claims. Alternative explanations will have to fit all the observed data as nicely as PBS money laundering.
Almost all addresses in the trace were connected as a large but bounded network
The network was distinct from a “placebo” group of non-PBS scam addresses
Looking at subsets of addresses show the same characteristics (see sensitivity and robustness sections).
Inducement payments2 to (Western) scam victims (a common trick in PBS) are identifiable as round-number payments below $10k from the network to Western exchanges (Benford’s Law?)
Curiously high usage of decentralized exchange Tokenlon, long known to be a signature of PBS, to swap cryptos for USDT, almost exclusively
The inflow into the PBS network and shift to victims outside China seem to be affected by events relating to crypto and scam crackdowns:
Note that the shape of (b) may just be artifacts of the time period the PBS addresses were reported and collected, but the authors note that inflows were persisting despite the crackdowns.
********************
This piece is not about putting down the crypto movement, but if people think that these Asian syndicates are getting only ~$2B worth of criminal funds in crypto, they are kidding themselves.
UP NEXT: Laundering money through TRON (maybe)
dk.fj sav;dwocgliawo meimklebhfjkshfke;uh
From hearsay, if true, the UN derived their estimate by extrapolating from the conservative estimate of people trapped in scam compounds and the daily quotas each scam worker is forced to meet
The fake investment websites often allow victims to make small withdrawals in the beginning to gain their trust.