As ransomware makes headlines, crypto analytics firms are making bank

War can be good for business. The rise of digital war is proving especially good for some digital-native businesses — particularly those that sell tools for tracing illicit cryptocurrency funds. 

Recent high-profile ransomware attacks have commandeered public attention, shining a spotlight on cybersecurity that the computer-bound experts in the field rarely experience. Massive lines of cars outside of gas stations and desolate shelves in the meat and poultry sections at grocery stores — those are scenes that can get an average person’s attention in the way security software cannot. 

“It’s really this sort of post-9/11 moment,” said Ari Redbord of TRM Labs, an analytics firm that helps government clients sort out crypto transactions.

The moment is also turning out to be particularly lucrative for crypto-analytics firms.

Public recognition

If a comparison to the terrorist attacks of September 11 sounds like hyperbole, consider that Redbord himself joined TRM as its head of legal after leaving the U.S. Treasury’s Office of Terrorism and Financial Intelligence. Also consider that after high-profile ransomware attacks shut down the Colonial Pipeline and meat processing firm JBS, the Department of Justice elevated ransomware to the same priority as terrorism. That will trigger new levels of cooperation between not just U.S. departments and agencies, but also nation-states. 

Ransomware has quickly become a hot-button geopolitical issue as well as a domestic one. Given that the perpetrators behind those recent attacks are believed to be Russian, they have inflamed already-tense relations between the U.S. and Russia. 

The U.S. accuses Russia of tacitly supporting its home-grown hacker industry and ransomware gangs as long as they leave Russian computers alone.  President Biden went so far as to threaten serious — but non-military — response to continued attacks in statements following his recent summit with President Putin.

The fight against ransomware and cyberattacks is also at the heart of a new joint EU and U.S. initiative. The White House has also enlisted the Group of Seven (G7) nations.  

In fact, the U.S. defense industry has been retooling for the digital age for a long time, and that effort has included a focus on ransomware. Security experts at the Department of Defense have been sounding the alarm for years, but that gets easier with the help of public pressure. 

This may help explain the recent flood of money, both government and private, into firms developing tools to trace the crypto ransoms involved.

Private sector profits 

In short, the businesses selling the tools to track and recover cryptocurrency at stake in ransomware attacks are going gangbusters.

On June 24, Chainalysis, the largest government contractor in the field, announced the closure of a new $100 million funding round that saw the firm valued at $4.2 billion — which is especially impressive as it doubled the valuation the firm saw in a round that ended in March. 

Within the same week, competitors CipherTrace and TRM Labs announced their own new funding rounds, of $27 million and $14 million, respectively. Blocktrace, a firm that has long kept a low profile with its government contracts, finally emerged on the public stage with new commercial tools. 

It is a gold rush, but it’s a gold rush that predates these huge ransomware attacks. The attacks just drew attention to it. 

Dave Jevans, CEO of CipherTrace, told The Block that interest in the firm “has been growing enormously over the past year, with a particular spike in activity around ransomware payment tracing in the wake of the attacks on JBS and Colonial Pipeline.” 

These funding rounds, for example. Representatives for Chainalysis, CipherTrace and TRM all downplayed links between the funding rounds — which are usually closed well before their announcements — and the recent ransomware hacks in conversation with The Block. Still, their announcements have come at a time of visibility that any public relations team would sense as an opportunity. 

“We do appreciate the significance of all this media attention on ransomware,” Chainalysis’s head of research Kim Grauer told The Block.“I do think those ransomware attacks have forced the issue on the national stage, but this is what we do,” said Grauer. 

Chainalysis noted in January that ransomware attacks “skyrocketed” in 2020, which the firm called “the year of ransomware.” According to Grauer, ransomware activity “dwarfs” terrorist financing via cryptocurrency, which is another area of focus for Chainalysis that previously commanded more attention. 

In February, Gurvais Grigg joined Chainalysis after concluding his 23-year career at the FBI. His term closed out with three years in the FBI Laboratory, which he called  “the most respected crime lab in the world.” 

Of the move to Chainalysis, Grigg praised “a level of sophistication and depth of experience that is hard to rival.” More generally, he called it an opportunity in “a field that is really ripe for growth.”

A quick scan of the job boards of any of these analytics firms will demonstrate that ripeness. All of the leaders of these analytics firms told The Block that they are currently expanding their teams rapidly and internationally. 

This expansion isn’t just because of ransomware. CipherTrace’s Dave Jevans cited new FATF guidance, while Chainalysis’ Kim Grauer pointed to major terrorist funding traces as important commercial developments during the past year, but all conceded that the ransomware boom had boosted business. 

“Just like everyone else, we’ve been focusing very much on ransomware and cyberattacks these last few months, said TRM’s Redbord.

Federal reconfigurations

An immeasurable proportion of defense and criminal justice capacity is hidden from public view. Seeing more than the tip of the iceberg requires a security clearance. And while these government agencies are eagerly eyeing tailor-made blockchain tracing tools and associated data pools, they are also increasing their own blockchain talent. 

In April, the Department of Justice announced the formation of a new “Ransomware and Digital Extortion Task Force.” More high-level positions are also cropping up for those with particular experience tracking and recovering crypto. 

Interagency and international cooperation seem to be the critical sticking points, however. Senator Rounds, the ranking member of the Senate cyber subcommittee, compared the issue to the Barbary Pirates that provoked the U.S.’s first flexing of military muscle abroad. Following the subcommittee’s hearing on Wednesday, one of Defense Department witnesses alluded to frustration with the Department of Justice not learning from the DoD’s experience with attacks abroad. 

The trans-jurisdictional nature of the “cottage industry” that has cropped up around ransomware’s supply chain is “why national leaders have compared it to the threat of terrorism,” Chainalysis’ Grigg noted.

The role of partnerships

Industry players who spoke with The Block were of course confident in the continued need for their products and services —  but they also said they have been impressed with the development among governments.

Grigg cautioned against underestimating the capacity within the U.S. government for combating ransomware. “Make no mistake, they’re quite sophisticated and the government is growing in its crypto literacy and capabilities.” 

Combining those capabilities with private sector contractors will make governments even more effective at fighting ransomware, he said.“There’s a need for greater public-private partnerships, where industry brings forth new tools.” 

“What you’re seeing out there is a real interest in these capabilities, but it’s also making sure that these great [government] investigators have the tools necessary to investigate these cases,” said Redbord. “You don’t seize bitcoin with analytics tools. You can use analytics tools to follow these funds, but at the end of the day it’s great police work that seizes the funds.”