How do law enforcement agencies ‘seize’ crypto?

After news of a major £180 million crypto seizure by the United Kingdom’s Metropolitan Police broke this week, just weeks after a similar £114 million coup, now is an apt time to inspect exactly how Britain’s bobbies are getting it done.

Crypto advocates often speak about their token treasuries as if they are an impregnable store of value existing off the grid. Ryan Radloff, CEO of crypto investment firm Choice by Kingdom Trust, encapsulated this mindset in a recent interview.

“Personally, I have my libertarian bitcoin stack,” said Radloff. “I’ve got my multisig bitcoin. Come and get it, there’s no way that you can pry this out of my hands. It doesn’t matter if the whole system collapses or not, I have my bitcoin and there’s nothing that you can do about it.”

It is eye-catching, then, to see such vast sums reclaimed from criminals by the police. While British coppers have scored the year’s biggest hauls, such confiscations are occurring all over the world. Authorities in South Korea seized $47 million in bitcoin in late June. Earlier the same month, the U.S. Federal Bureau of Investigation was able to recapture $2.3 million in bitcoin that had been paid to the Colonial Pipeline hackers. 

The reality for criminals dealing in crypto is that once they are cornered by law enforcement, their funds are often just as vulnerable as any hidden trove of cash or jewelry.

But that is not to say that agencies don’t face unique challenges when it comes to recovering crypto.

Types of seizure

The idea of “seizing” crypto is, for some, a misnomer.

Aidan Larkin is the founder and CEO of asset recovery firm Asset Reality and a former criminal investigator with a specialty in crypto. He explained that what is in fact being seized in these cases is not crypto but the means to control it.

“You’re not actually seizing the bitcoin – bitcoin’s in blockchain, it’s the software, it’s the code. What you’re seizing is the private key or the access or control of that asset,” he said. “Some people liken it to when a government seizes land and property. You’re not actually taking the building, but you’re changing the locks on the door, or you’re updating land registry to put a freezing order on the asset so someone can’t trade or deal in it.”

Zihao Xu, a principal at the venture capital firm Octopus Ventures, which is an investor in blockchain analysis firm Elliptic, tried to explain the difference between crypto and cash recovery by evoking a scene from the film The Pursuit of Happyness. Will Smith’s character Chris Gardner at one point sees the Internal Revenue Service claim $600 in unpaid taxes from his bank account.

“That’s the big difference, that can’t happen with crypto,” said Xu. “The money won’t just disappear from your account and be transferred away from your address. But what they can do is trace everything. So they know it’s you, do an asset forfeiture to get your laptop, and then subpoena the private key off you.”

Police work with blockchain analysis companies like Elliptic and Chainalysis to track the movement of crypto.

In its statement announcing the seizure, which was part of an ongoing investigation into international money laundering, deputy assistant commissioner Graham McNulty said that “highly trained officers and specialist units” had traced the funds despite substantial efforts to hide it. 

Getting hold of the private keys – which are used to control crypto funds – is “absolutely the hardest bit” of the confiscation process, said Xu. 

In many ways, it is also the least technical.

Key takeover

Larkin outlined two scenarios police typically face when attempting to seize crypto. The simpler of the two is when police have gathered evidence of illicit crypto activity and the criminals in question have an account with a well-known exchange.

“No different than finding an invoice for a safety deposit box in Hatton Garden, we will contact the third-party custodian that’s holding the asset, get some sort of court order, and put a freezing order or a restraint order on the third-party custodian, usually then with follow up instructions to transfer ownership of the digital assets or access to the digital assets to an account that’s in the control of law enforcement,” said Larkin.

The second, more complex scenario is when a criminal has crypto stored on a private, hardware wallet — meaning access is controlled entirely by recovery seeds, a list of words in a specific order which stores all the information needed to recover a wallet.

The Metropolitan Police did not reveal its methods in a statement about the £180 million seizure issued July 13, but a person close to the situation confirmed for The Block that it involved obtaining private keys — suggesting a private wallet may have been accessed.

The same person added that seized assets will be moved to a wallet controlled by law enforcement. In January, British police formed a partnership with Nomura-backed crypto custodian Komainu to safeguard confiscated crypto.

Amanda Wick, chief of legal affairs at Chainalysis and former senior policy advisor at the Financial Crimes Enforcement Network (FinCEN), said methods for gaining access to hardware wallets include “someone cooperating and providing the information” and legal processes that permit police to search a phone or laptop with private keys stored on them.

“The same techniques that criminals use to hide traditional fiat, they also use to try to hide crypto. When I was in law enforcement, we found recovery seeds hidden in all kinds of places in people’s homes,” she added.

The pressure to access private wallets quickly is high.

“We’ve seen lots of cases around the world where [police have] seized the piece of plastic, but by the time they got to the custody suite someone working with the defendant also had a copy of the seed word or the recovery phrase and has gone in and generated a new key and transferred the assets,” said Larkin. “So the key thing we’re working with government agencies on now is having the capability when they’re on the scene to actually there and then transfer the assets.”

If police are unlucky and unable to locate the means to access hardware wallets swiftly, the chance to retrieve the illicit crypto may go begging.

A recent example comes in the form of Clifton Collins, an Irish drug dealer who claims to have lost access to £46 million (roughly $64 million) in bitcoin after printing access codes on an A4 sheet of paper and stashing it in the aluminum cap of his fishing rod case. He was arrested in early 2017 and sentenced to five years in jail, but his landlord cleared out his house and the case containing the keys to a fortune were taken to a dump and lost.

“Law enforcement has to understand the technology, and that’s why training in this area is so important,” said Wick. “Because you do hear horror stories about agents walking past QR codes that could have millions of dollars on them and not realising that could be crypto.”

Unfortunately for criminals, such blunders are becoming less common as enforcement agencies around the world ramp up their crypto capabilities.

“We work really closely with a number of law enforcement agencies throughout the U.K. They’re incredibly well trained, and it’s not surprising that they’re getting good results,” Wick added.