A Law Enforcement Approach to Digital Assets - Michael Halepas | BlockAML

Good morning everyone. Thank you for joining us this morning. Uh thank you for the introduction. Uh my name is Michael Halipass. I I'm a barristister from the UK.

I specialize in in criminal law and uh yes, I was I was previously the lead digital assets lawyer uh in an offshore jurisdiction. Um I'm I'm here today to to provide an update, a law enforcement update or approach to to digital assets. Um I launched my own uh consultancy block uh at the crossroads of uh financial crime uh anti-moneyaundering digital assets uh to advise to provide advocacy to keynote speak and and so on. I'm also um uh my day job I'm a barristister in court. Uh unfortunately I won't be here for very long.

I have to be back in court in London tomorrow morning. Um but I seized the opportunity to come here because um it's an excellent conference and uh I really wanted to speak to you about some of the work that I've done uh and to reach out with you with with you guys. So, as well as being a barristister, I'm also an international consultant and I've done uh worked on a few projects this last year with the Council of Europe um advising different jurisdictions on um digital assets, crypto companies um and um crime risks and and so on. Uh and one of the projects in the last year actually um was in this jurisdiction. So um you may or may not know that the the the role of financial forensic expert in this jurisdiction um is is fairly recent um put into statute and uh it's my great privilege to um work on this project to uh conduct a needs assessment last year to interview uh select members of the judiciary u prosecutors uh financial forensics experts in this jurisdiction and to produce a a working paper um advising on uh next steps how we can uh strengthen the role of financial forensic experts in your jurisdiction.

Uh understandably I can't tell you what's in here um but uh I can give you an idea um for um some of the crime risks we face and I can tell you that well perhaps unsurprisingly I'm a crypto native. Uh I want this technology to go mainstream. I understand that uh this room staring at me is not full of criminals. Um I've been struck within this crypto industry by the the dedication and the passion of the uh the developers and so on to try and strive to bring this technology mainstream. My request my my what I urge you to do and this is not from the Council of Europe.

This is from me personally is this. I was I was really impressed by the um professionals that I met during this process in your jurisdiction. Um the you have you're fortunate to have if I may say experienced um talented um devoted financial forensic experts and they are keen to learn. Obviously globally law enforcement public agencies they tend to be a bit behind with the learning and as we know as you know very well u there's such a rapid rate of change in this in this industry. So my my plea to you guys please is please have a think about reaching out to the public prosecutor's office uh to the um um faculty of economics uh University of Belgrade um to speak to them to offer your services uh in education because the financial forensic experts in this jurisdiction and the prosecutors I know because I've heard it firsthand they are keen to learn about this industry about this technology and the crime risks and I know that you guys are um ahead of the game.

So I I promote and welcome public and private collaboration to to help in this effort. We know there's a lot of corruption and bribery uh in this jurisdiction as with many other jurisdictions, but we are making efforts to to combat that. Right. Uh so in terms of an update, this uh up here on the on the left is Europole's latest document from this year. And it's quite clear that um globally law enforcement agencies are wising up.

they're becoming aware that this technology is not going anywhere. Um it is a bonafide a asset class but there are crime risks and more and more the publications that you see are drawing attention to this crime risk. I mean of course we know that bad actors have been in this realm for quite a while but we law enforcement agencies are uh are aware of the possibilities uh and and the crime risks. Uh and I should say if you want any copies of any of these documents please approach me later. Just to update you on um uh the current landscape.

So um we can see that um the bottom bottom half of the screen it's said that um a minuscule amount of the activity in blockchain is illicit which is really positive but obviously we work together. We strive to minimize the number of illicit transactions in this industry. uh at the the top of the screen um you can see the what is believed to be uh the the volume of uh illicit activity in this industry. As time goes on, more illicit uh wallets are identified and and the numbers move. But what we can see uh in in in the top one is um in 2022 there there was an explosion of um illicit activity with sanctioned uh actors unsurprisingly perhaps.

And we can see that that activity plays a plays a part in in the illicit activity. Um we can also see that that scamming has not gone gone anywhere. It's is quite a constant in this industry. So please uh developers crypto businesses if you're here um just be alert be alive to the kind of type crime risks uh in this industry. Some more charts for you here.

Um you can see that at the top I've included uh the number of crypto hacks. Um we can see that um uh we're beyond the peak of the amount of um uh crypto uh stolen through hacks, but we can see that the number of the number of hacks globally annually is is is growing, I'd say, pretty steadily. Interestingly, I think at the bottom half of the screen, you can see um the preferred asset classes um for uh illicit actors. And perhaps surprisingly, certainly interestingly, whereas Bitcoin used to be used to form the bulk of the illicit activity, the preference for bad actors, we've moved into stable coins. Stable coins are are the preferred option for um bad actors in this in well bad actors globally.

Uh one reason might be the fact that stable coin usage has increased phenomenally and for money launderers for criminals it's preferable to move in a highly liquid uh market. So please be please be alert to that. Um here top slide um I I included this one because I think it's quite interesting. You see that um for in terms of funds stolen by by type of uh compromise in blockchain private key compromise um is is the largest chunk. uh the bottom half um you can see that um I mean this is quite positive I suppose if you're if law enforcement are dealing with um uh centralized exchanges who are up to speed with their with their their KYC uh and anti-moneyaundering is that um most of the scammed funds in blockchain they actually end up in centralized exchanges that I mean positive negative I'll come on to that a little bit later um and we can see that defi DeFi still is a destination for um a fair amount of um scammed funds um because it helps with offiscation once you can get the criminals can get the funds to defy swap offiscate uh chain hop and so on.

Uh I included this um this is um TRM's from two TRM's 2025 crypto uh crime report and um you can see that um traditionally mixers mixer services were popular with bad actors to help to um offiscate uh the the funds stolen but we've seeing that crosschain bridges are becoming more popular um and whereas specific well particularly for um ransomware payments they tend to be requested in Bitcoin But further downstream they change, they hop, they change, convert into different uh cryptos. Uh moving on, I included this because this is ETH Belgrade. Um so apparently uh the largest percentage of illicit crypto activity uh in in last year occurred uh on the Trumon blockchain followed by Ethereum. And it's it's supposed that bad actors have a preference for um blockchains that have low transaction fees uh smart contracts and again we come back to stable coins popular stable coins. Please be mindful of that.

This paper I thought really interesting. If you'd like a copy please let me know. I I I included it because it it's research into um patterns um in in scamming and uh with Ethereum and there's a clear trend for scammers moving funds from uh let's let's say western exchanges where KYC uh AML checks are perceived to be stronger uh more robust and moving them into jurisdictions where they're not. Please be mindful of that. Also um this research paper um studied the the um the data the and we know that the median uh address uh in scamming is active for about 68 days.

So when it comes to law enforcement we need to move quickly. It's quite difficult as as you know the the funds in this in blockchain move immutably. they move really quickly and it's one of the challenges for us in law enforcement um when it comes to tracking uh freezing seizing u suspected illicit uh illicit crypto. Um okay so international standards you might have heard of the financial action task force let's say that the uh fataf for short is the international watchdog um uh setting standards for jurisdictions globally to try to meet to help tackle money laundering proliferation financing terrorist financing now that's great it's great to have uh uniformity globally but we're not quite there now fataf has uh faulty recommendations for jurisdions on lots of different things. Um, but I've included u something on recommendation 15 because recommendation 15 uh introduced uh or extended anti-moneyaundering um competitive financing of terrorism requirements to digital assets and to crypto businesses.

So uh specifically crypto businesses are expected or mandated to be regulated, licensed, registered uh and subject to effective monitoring uh systems which is great. Right? Moving forward, we accept that although there's although privacy is one of the main draws to blockchain technology, we accept I hope that for this technology to go mainstream, transparency will have to increase. So that's that's that's wonderful. What's the downside?

Well, the downside is that uh the FAT conducted a review uh last year and they might well conduct a review in the coming months. Um but but uh the problem with recommendation 15 is that globally only three quarters well threequarters of jurisdictions are either only partially compliant with recommendation 15 or not compliant. So we've got the recommendations, we've got the standards set, but most jurisdictions are not meeting those standards. That's a downside. Uh you might well have heard of the travel rule um especially if you're dealing with with ma uh with European regulation but this is u an obligation for crypto companies to uh collect transfer uh information identifying information about the uh originator uh and the the beneficiary.

So we can try to identify who who's behind different wallets. So again that's that's really useful and that's the direction that the world is moving in. The downside is that again last year uh the financial action task force surveyed jurisdictions uh and found that globally implementation of the travel rule remains really low. So we have the regulations, we have the standards. Unfortunately uh the FATA continues to remind us that most jurisdictions are not meeting these standards.

Okay. So in terms of uh compliance and um monitoring of suspicious activity in this industry, red flags uh are identified and reviewed and that's how uh compliance uh units compliant functions identify potentially suspicious activity. I've included only a few red flags uh on the screen. There are lots as I'm I'm sure you can imagine um just to give you an idea of the types of activity that crypto businesses um should be alert to and if red flags arise um heightened scrutiny of of customer activity um should be uh performed. So for instance are are multiple unrelated wallets controlled by the same IP address that would be suspicious in my view.

Um, again, does the customer insist on transacting with um crypto businesses in jurisdictions with with weak due diligence or sorry, with with crypto businesses or or with weak KYC processes. These these would be typical red flags that we would expect uh businesses to look out for. Right. Just just just a few uh case studies to give you an idea of what's going on. Uh I'm sure you've heard of the Lazarus Group.

The Lazarus group are notorious um for hacking and um harming uh the health of our uh blockchain uh industry. Um last year, sorry, this year in February, we saw the largest crypto uh hack theft of all time. Um we're happy to discuss that later. You can see uh on screen um this is a Lazarus group's uh identified wallet here. You can see in February 2025 there's a huge spike there uh with the bybit hack and what's been identified unfortunately if you can see bottom right of the screen is that the number of days between successful uh uh Lazarus group North Korea affiliated group uh hacks has reduced.

So what does that suggest to me? That suggests that they're more confident um and in their abilities and um they move they move quick. So um for platforms heightened security has got to be has got to be the priority but it's difficult. I appreciate that it's difficult because we're dealing with state sponsored hackers and they will continue to be a thorn in our side unfortunately. Um there's another issue.

So sticking with hacks is this. Not all jurisdictions are the same. Um and what's been identified is that um North Koreans, not wishing to pick on them, but North Koreans, they might hack funds uh from from an exchange. And what's been observed is not only are the funds uh split up to go into different many different wallets in the hope that they might some of them might get get through to their ultimate goal, but unfortunately funds have been identified moving to um exchanges in jurisdictions uh that perhaps don't have KYC requirements or jurisdictions where uh if if a if a law enforcement agency wanted to send a a letter of request to ask for assistance or to ask for information, that jurisiction might not be so cooperative. So, we've observed that um North Korean stolen funds um sometimes end up in in in Russian exchanges.

And I don't know if anyone here has tried to make any requests internationally for mutual legal assistance, but as I said, some jurisdictions are more cooperative than others. What do we see here? You see here I've included this because there is an identified steady uh gradual increase in the number of active Russian language no KYC exchanges servicing uh sanctioned Russian banks. Um which is which is disappointing but it's one of the challenges that we face. Why do I include that?

I include it because realistically moving forward, we can't just throw caution to the wind and say, "Well, look, privacy is inherent in blockchain and we don't know who's who's dealing with us. We don't know who's transacting." I'd suggest that the people in this room are um u aware that there are there are checks that can be done. Um AI can be implemented uh on on on checks. uh the blockchain open source can be scanned to identify suspected um illicit wallet addresses and we should be I know it's easier said than done but I would urge the industry to um think about how how we can identify suspected illicit activity better stop it and cooperate with with public agencies in this country and other jurisdictions to help to identify suspicious activity.

Okay. Uh this one I can tell you about this um this is operation destabilize. This was um a law enforcement effort um run with multiple jurisdictions but led by the national crime agency in the UK. Uh this um I identified u money laundering on on a huge scale in lots of different jurisdictions and it's a sign that um countries need to cooperate with each other. Um you can't do it on your own.

Obviously, this this technology is borderless and we're seeing that criminals, money launderers, they're moving the funds across border, whether it's switching from crypto to cash, cash to crypto. Um, but I include this because bottom of that screen, um, that's a moneyaundering case from the offshore jurisdiction that I was the lead digital assets prosecutor in. I couldn't tell you about that last year on stage because it wasn't all public information, but this is one of the case studies uh, from Operation Destabilize. This was a case where um cash careers, money launderers entered uh the jurisdiction, the offshore jurisdiction to launder£60,000 of cash. Now, that that on the face of it doesn't seem like a lot of money perhaps.

And the easy option, the really easy option for me as a reviewing lawyer was to say, "Fine, we've got the cash, we've got the highly suspicious um handling uh of of this cash uh on our Ireland, on our offshore jurisdiction. let's take the cash, let's prove using circumstantial evidence that this was money laundering and let's leave it there. That that falls short of the international standards and the expectations um for for addressing this problem globally. So what did we do? We investigated their uh bank accounts.

We investigated their activity uh in the UK. We liazed with UK authorities and we began to unravel what was a huge moneyaundering oper operation. huge. Even these uh three money launderers, they were linked to human trafficking, uh illegal subleting of properties, millions of pounds. It was highly suspicious.

Uh I found evidence of uh crypto ownership by these criminals. uh and we shared that information with the National Crime Agency. Uh lo and behold, further downstream, it was found that these criminals on our small island who were initially suspected of dealing with only £60,000 were linked with uh Russian ransomware gangs, global um money laundering from crypto to cash, cash to crypto. So the lesson for us is don't take the easy lowhanging fruit. highly recommend uh essential uh international uh multi-jurisdictional cooperation to tackle this crime type because look if we seize digital assets that have been stolen that are intended for use in criminality my hope is that that will help to deter other people from doing the same and we've got to we can't we can't let these criminals continue their activity in this space because it will harm the wider uh ecosystem.

So that was operation destabilize, right? Another one. So sticking with moneyaundering, you might have heard of this one. This is Jean Wen. U Chinese lady uh operating the UK.

She was a Chinese takeaway worker and she lived above a Chinese restaurant. Um she uh I think her declared income for 2016 was £6,000 and in 2017 I believe she started renting a house for £17,000 a month. Now um she uh she was convicted of money laundering. Uh she said that she had been duped and she she obtained the funds uh innocently. Um but the court disbelieved her.

So we are seeing more prosecutions gradually of criminals who are uh involving themselves in in laundering uh digital assets uh which is really positive and in common law jurisdictions we have a concept called irresistible inference. So although we might not necessarily have the I should say this is not one of my cases but although we might not necessarily have uh evidence of where the funds have come from if we can evidence with circumstantial evidence the handling of those funds. So for instance this lady here uh she was working as a Chinese takeaway worker uh she had uh handling uh 61,000 bitcoin and it's highly suspicious isn't it? But anyway, she was prosecuted. Uh, and that leads me nicely onto future directions because what we are observing is uh law enforcement agencies gradually are increasing their appetite for um freezing, seizing, uh, confiscating um, illotten uh, digital assets.

So that happened in this case. So she was ordered this year that she will pay back3.1 million pound sterling after her moneyaundering conviction. and if she does not, she will face uh additional time in prison. Bottom half of the screen, you can see countries holding Bitcoin.

I've included that because there are serious conversations that need to happen uh within jurisdictions about the handling of digital assets. So 61,000 Bitcoin was seized from that lady. That takes the UK into the third uh largest holder territory of Bitcoin. Now the UK will have to think about what they do with those funds. Um because uh Germany is also on that list and as some of you may know Germany took the decision last year.

I I did not advise the German authorities but they took the decision to sell their digital assets their bitcoin and that has cost the German uh public. So that's where we are. So we're going to see expect to see more uh more um asset confiscation from bad actors handling digital assets um and more uh more uh legislation to uh help um um realize that digital assets are are property are capable of constituting property and we need laws to help us to uh address the crime risks with this with this industry. So this is this is um legislation from the UK um and interestingly uh it enables um pre-arrest seizure of digital assets. it it introduces the concept of uh crypto asset related items.

So so think of a crypto asset related item as a seed phrase uh or a hardware wallet uh are examples of those happy to discuss this later. um also introduces uh crypto wallet freezing orders uh mean lots right schedules eight nine and 10 of this document happy to discuss it later with you but uh I think as a crypto native interestingly is the concept of destruction of uh forfeited crypto assets in certain circumstances so for instance if it's decided that it's not in the public interest to release digital assets uh that have been taken from criminals back into the market in theory well in practice they can be destroyed think maybe Monero might be an argument for for not releasing that into back into the system. Okay. Uh right. In terms of asset recovery, crypto asset recovery, there are four stages.

Um asset tracing, asset freezing and seizing, asset confiscation, and asset realization. So this is how it's meant to work using this structure. Um the the difficulty unfortunately is that um if there are uh if there's an investigation in Serbia and there are crypto assets believed to be in a jurisdiction uh that is not known for being so cooperative with law enforcement, you might have difficulty uh obtaining cooperation from them. The other issue is that mutual legal assistance requests, so letters of request to other jurisdictions, they're measured in months rather than days. So they take time and as you know this asset class moves really really quickly.

So that's one of the issues that that we face uh internationally. Um but there are structures in place and in theory if we have increased cooperation uh globally if we have heightened intelligence sharing between public and private between different jurisdictions we can help to hope to uh increase our abilities to tackle to tackle um uh criminality uh involving digital assets. Um so yes I'll leave that on on on the screen for a little bit longer. Happy to discuss this with anyone uh afterwards. Um but I have I have some final thoughts to share.

Um and I've been flying through these slides because I'm against the clock. But um in my view um globally we need to increase uh strengthen our um AML and CFT strategies. Um we need to law enforcement need to have a a pre-arrest pre-seizure strategy for digital assets. is no good uh executing a search warrant say and finding evidence of digital assets and then we don't have a wallet that we can transfer the funds to. We don't have a strategy.

Um but it's just no good. So this will have to be improved globally. Unfortunately, lots of jurisdictions are not quite there, but we're working we're working to get there. I've advised, as I said, some jurisdictions on some of some of the pitfalls, some of the risks, uh suggested ways of helping to tackle this uh crypto crime, if I can call it that. But I really do believe that um because of the um nature of this asset class, there's no avoiding the need for public and private uh collaboration.

Um and again, not just with financial forensic experts in Serbia, with uh all public agencies, all law enforcement agencies. you must continue or have continuous training and education. Um, CASPs, VASPs, please don't turn a blind eye. Please, please harness the technology. I know that people in this industry are extremely intelligent uh and uh want this technology to continue to go mainstream.

Please think about the efforts that you can take to help to identify potential illicit activity and to uh lies with uh uh law enforcement um and your financial intelligence units. Um one thing I'll highlight is this um one of the difficulties is that in in private companies uh it's been identified that there is an interoperability of compliance tools. So that's that's something that really can be addressed. Um again crypto companies all companies financial trades to one side but crypto companies in regulated jurisdictions they they have an obligation to uh improve the quality of their uh their customer on boarding. We need to know uh so far as possible who is dealing in crypto assets.

Um uh again I've included on there a bullet for um increased awareness and liaison. I really do believe that crypto natives, crypto businesses uh can do more uh to increase communication and liaison with your law enforcement agencies, with your regulators. Um remember, gradually people are realizing that this is a bonafide asset class. Uh this is not just for criminals, but the more cooperation we have between public and private, I'm confident is my belief uh that we can help to tackle uh bad actors misusing this uh this asset class. And again um intelligence sharing.

So that's something happy to talk to you about after this. Uh I've had discussions with public authorities in in Europe about steps that we can take to um streamline the intelligence sharing uh between different bodies because we know that the the uh the assets can move extremely quickly. We need to have a think about how we can share intelligence quicker, more effectively uh to to uh to help to tackle this crime type. That's it. I flew through those slides.

If you have any questions, feel please feel free to ask. Um I I won't be here for the whole day. So if you do want to have a conversation, please please do approach me today. Um and I'll I'll keep doing my thing. I'll keep working with uh the Council of Europe and and other agencies.

And um again, thank you for having me. It's my real real pleasure to be here in Bulgrade. Thank you.

Thank you, Michael. Thank you actually for for actually fighting uh money laundering but still supporting crypto and especially directly here in Serbia doing that. Thank you so much for that. Uh we have five minutes for questions now. So if anyone has a question uh please raise your hand and uh volunteer is going to pass you the microphone.

You have a question there.

Hi Hi.

Okay. Uh first of all, thank you for your presentation. Um is there any way that we can get those slides and uh use some of the of the data and

Yeah, of course.

Attribution. Yeah,

of course. Um I'm happy to um share them with you after any of those documents and obviously you'll appreciate that there are lots of research papers that I haven't included in my slides, but yeah, happy happy to to share those afterwards. Lots of there's lots of open- source material uh on this subject. Certainly. Yeah.

Yeah. Okay. Thank you.

Is that it?

Okay. I guess that's all.

Great.

Let's give Michael a big applause.

Thank you. Thank you.