Must-Know Crypto Investigations of 2023: Europe

This week, we go across the Atlantic to the UK and Europe, where we have seen some major victories in combating crypto-related crime. Law enforcement disrupted millions of pounds and euros in illicit crypto activities, from crypto-related fraud to drug money laundering, perpetrated by sophisticated cyber criminals on victims across the globe. They also navigated significant practical and legal complexities to return seized cryptocurrency to victims.

Let’s take a look at some of 2023’s key successes across Europe. 

1. UK police return GBP 2 million of Bitcoin stolen in crypto fraud scheme

In 2023, the UK saw a number of outstanding cases involving large sums of cryptocurrency brought to a satisfying conclusion. Criminal sentences were handed out and Various UK law enforcement agencies were able to return large sums of ill-gotten cryptocurrency to victims. 

One notable case which illustrates the complexities of digital asset recovery and restitution in the UK was a crypto fraud scheme perpetrated by former Oxford University PhD candidate Wybo Wiersma in 2018. Wiersma created a fraudulent site luring victims to generate what they believed were random seed phrases, which are used to control the tokens associated with a blockchain address. However, these seed phrases were in fact predetermined by Wiersma, who then made off with the victims’ crypto assets. He then transferred the tokens to numerous cryptocurrency accounts. 

Following Wiersma’s arrest in 2019, the South East Regional Organised Crime Unit (SEROCU) seized GBP 2.37 million (USD 3 million) in cryptocurrency from an exchange under the UK’s Proceeds of Crime Act. This was the first time that the Act had been used to make a crypto seizure from an exchange. In November 2023, the court ordered GBP 2.1 million (USD 2.67 million) to be paid back to the victims.

In order to return the stolen assets to victims, SEROCU had to “overcome significant challenges” in converting the assets back to GBP, working with the Financial Conduct Authority (FCA), the National Police Chief’s Council (NPCC) and FCA-registered exchange Kraken to “ensure this was done lawfully and in line with national policy.” 

“This was a large and challenging case, which meant lengthy investigations, as well as significant complexities in seizing, storing and finally, returning the assets to victims in a lawful manner,” explained Phil Ariss, TRM’s Director of UK Public Sector Relations and former crypto lead for the NPCC Cybercrime Programme. “At the time the investigations began, many of these issues were uncharted territory, and their successful conclusions are testament to the creativity and determination of the team. With the passage of the Economic Crime and Corporate Transparency Act in October 2023, UK law enforcement will have more powers to seize crypto quickly, and return victims’ assets. I am hopeful that we will see the pace of disruption accelerate in coming years.”

‍2. UK police take down counterfeit drug dealers who made millions in Bitcoin

The UK also saw successes against drug-related crypto crime. In March 2023, SEROCU again with the Crown Prosecution Service (CPS) concluded a case against a group of counterfeit drug dealers who had made millions peddling their wares online.

Marc James Ward, Christopher James Kirby, and Thomas Russell Durden were manufacturing a variety of counterfeit controlled drugs, such as Pfizer Xanax, and selling them on both the public internet and darknet markets (DNMs). DNMs are multi-vendor online illicit global commerce platforms located on the “darknet”, an encrypted section of the internet neither accessible from standard internet browsers nor indexed by search engines, and are the epicenter of the online crypto-mediated illicit drugs trade.  

The group collected payment in Bitcoin and used cryptocurrency to launder their proceeds. In addition to arrests, police also seized cryptocurrency worth GBP 1.3 million (USD 1.65 million) from Durden. In January 2023, the trio pleaded guilty to unlawfully supplying drugs, as well as money laundering offenses, and were sentenced to a total of 20 years and 11 months at Portsmouth Crown Court.

The case dates back all the way to 2016, when Pfizer Global Security launched a probe that identified Ward, which they subsequently referred to the police. 

“Having worked on both these cases during my time at SEROCU, it is gratifying to see them come to a successful close,” shared Emma Henshaw, Global Investigator at TRM and former SEROCU cyber intelligence officer. “This counterfeit drug case is a prime example of how public-private collaboration is vital in achieving results. During the five-year long investigation, SEROCU continued to collaborate closely with the Pfizer team, which provided valuable insights into the case. In the Wiersma crypto theft case, SEROCU was supported by Europol and German police from the state of Hesse. In the borderless world of crypto, such partnerships are vital to piece together the complete puzzle and take criminals to task.”‍

3. Europol, Belgian and Spanish authorities disrupt drug-money laundering network

2023 also saw significant crypto-related disruptions in continental Europe. 

In March 2023, the Belgian Federal Judicial Police Leuven and the Spanish Guardia Civil, supported by Europol, disrupted a large scale money laundering and underground banking system that had been funneling profits generated by cocaine trafficking. The case lead originated from the decryption of messages transmitted via the SKY ECC secure messaging application, which was taken down by Belgian authorities in 2021. The investigation found that the network relied on a combination of cryptocurrency investments, distribution of cash via an underground banking system and real estate investments across Europe and Morocco, to launder their illicit profits. 

Aside from two arrests, the operation resulted in a seizure of EUR 1.2 million (USD 1.3 million) in cryptocurrencies, EUR 50,000 (USD 54,000) in cash, three properties and a number of luxury items.

“What is interesting about this case was the sizable cryptocurrency seizure, which far outstripped the cash component. The fact that this illicit network operated across several European countries, South America and Dubai goes a long way to show how coordination is a key component to success,” said Mariano Gemignani, TRM’s Spain-based Global Investigator and former Argentine FIU analyst. “No doubt Europol’s onsite deployment of a cryptocurrency specialist was also critical in achieving this result. When it comes to crypto asset seizures, time is of the essence. Criminals can move crypto assets even when in police custody, so immediate action during the operation itself significantly increases the degree of success.”

4. German law enforcement take down darknet marketplace Kingdom Market

In December 2023, Germany’s federal police agency, the Bundeskriminalamt (BKA), and the Frankfurt Public Prosecutor’s Central Office for Combating Internet Crime (ZIT) announced the takedown of darknet marketplace Kingdom Market, with support from law enforcement partners across the US and Europe. 

Kingdom Market was an English-language DNM that had been operating at least since 2021, primarily used for illicit drug trafficking. The platform played host to 42,000 products across several hundred seller accounts, and accepted payments in Bitcoin and Litecoin, as well as privacy coins Monero and Zcash. German authorities took control of the marketplace by securing its server infrastructure. The next day, Slovakian Alan Bill was also charged in a US district court for helping to set up and run Kingdom Market. FBI was able to identify Bill as Kingdom’s administrator through a number of breadcrumbs, including following the flow of on-chain funds from a group of cryptocurrency addresses used by Kingdom to cryptocurrency wallets belonging to Bill.

5. Irish police make first major crypto seizure from cyber fraud gang

In November 2023, various units of Ireland’s An Garda Síochána, with Europol’s support, made Ireland’s first major cryptocurrency seizure in organized cyber-enabled fraud. The gang, based out of Waterford in Ireland, had targeted Irish and international victims via bogus text messages impersonating legitimate entities including post offices, delivery companies and financial institutions. The messages were designed to lure victims into compromising their personal data, enabling fraudsters to hijack their back accounts and devices, and debit and credit cards.

Irish authorities arrested nine gang members, and seized EUR 1.12 million (USD 1.2 million) in cryptocurrency, EUR 30,000 (USD 32,500) in other monies, and two vehicles. 

“Ireland has played an important role in standard setting for cybercrime investigations in recent years, and this case is a great example of how An Garda Síochána has developed the skills needed to respond to evolving crime trends,” commented Paul Marrinan, Blockchain Intelligence Expert at TRM, and former Irish Garda and INTERPOL detective. “Such a sizable crypto asset seizure requires specialist expertise, which many Irish investigators develop through the Forensic Computing and Cybercrime Investigation course at University College Dublin. The coordination of this case with international partners via Europol was also essential. Finally, the collaboration between the local police office and specialized national units was critical in actioning this intelligence and affecting this disruption, showing how local police can have an international impact.”

As European law enforcement looks to deal further blows to illicit crypto, capability building and partnerships will be critical. In TRM Labs’ recent survey of over 300 law enforcement officers, 87% cited blockchain analytics tools as very important to successful investigative outcomes, and 92% cited public-private partnerships as an important success factor.

All in all, 2023 was certainly a remarkable year for law enforcement across Europe in the fight against crypto-related crime. 2024 is shaping up to be an even more impactful year. In January alone, we saw a EUR 2 billion (USD 2.16 billion) crypto seizure in Germany and a GBP 1.4 billion (USD 1.77 billion) crypto laundering case going to trial in the UK. Watch this space. 

If you are a law enforcement officer wanting to expand your crypto investigative skills through learning and partnership with the global law enforcement community, join our law enforcement-only working group, LEO Labs, here.