Now Defunct LocalBitcoins Used in Murder-for-Hire Scheme

In July, Kristy Lynn Felkins was sentenced to five years in prison for attempting to have her ex-husband killed via the dark web “hitman” website, Besa Mafia. In 2016, Felkins sent 12 bitcoins (valued at approximately $5,000 at the time) to the site’s Bitcoin deposit address. Felkins obtained the bitcoin that she would subsequently send to Besa Mafia through the Finland-based peer-to-peer marketplace, LocalBitcoins.com (“LBC”). LBC, which officially shuttered its doors earlier this year, used to be the destination for bitcoin buyers and sellers hoping to remain anonymous. For U.S. law enforcement agencies, it was a mixed bag working with LBC; some records produced by LBC resulted in disruptions, but obtaining those records was often difficult. 

In building the case, Homeland Security Investigations (HSI) investigators identified a darkweb request for a hitman, and were able to quickly trace the transaction back to LBC.  “Like a lot of our early Bitcoin cases, we had to work internationally to get the records from LocalBitcoins,” said Special Agent Aron Mann of HSI’s Cyber Crimes Unit. 

In the Felkins case, the LBC records showed that bitcoins went from LBC to the Besa Mafia address. The account that sent the bitcoins was registered to “Kristy L Felkins” using Felkins’ actual email and phone number. The LBC records, combined with evidence from other investigative techniques, helped lead to Felkins arrest and eventual guilty plea.

The age of LocalBitcoins

LocalBitcoins started operations in 2012. It became the go-to peer-to-peer marketplace where buyers and sellers could find each other based on region, price, and reviews, often using pseudonyms to remain anonymous. In the beginning, the site operated like a Craigslist-style platform, where buyers would physically meet sellers in their geographic area and exchange fiat currency for bitcoin. After LBC set up an escrow system in 2014, and allowed buyers/sellers to use electronic forms of payment such as wire transfers, business really took off as sellers and buyers could be anywhere in the world engaged in large, anonymous financial transactions at the click of a button.

Law enforcement would often face hurdles or delays in obtaining records from LBC, however, when investigators did receive information it was often fruitful.

“In one investigation, we were able to obtain LBC records for the operator of a Northern California-based Bitcoin ATM company, Coinucopia, which resulted in a guilty plea,” Mann said. “The records obtained from LBC helped illuminate the volume and counterparties with whom the ATM operator did business.”

The other major issue for law enforcement was LBC’s lack of money laundering controls and light scrutiny on customer accounts. 

“Most of our cases involving LocalBitcoins focused on tax evasion or money laundering charges in violation of the U.S. Bank Secrecy Act” said Jarod Koopman, Executive Director for Cyber and Forensic Services at IRS Criminal investigations. “People used LBC to anonymize their transactions, but when criminals use cryptocurrency for nefarious purposes, they fail to realize that all transactions are detailed on a digital blockchain. There’s always a financial trail. As a result, we can often see that criminal activity occurred before we know who committed the criminal activity.”

From LBC to a multi-chain, multi-asset ecosystem

The LBC era represented a time-period where most illicit activity occurred on Bitcoin and very few investigators had the tools and training to track and trace funds. 

Today – in the age of DeFi, NFT’s, and bridges that connect blockchains –  illicit actors are more sophisticated using money laundering mechanisms like cross-chain swaps, mixers, tumblers, lesser known-currencies and stablecoins. According to TRM’s Illicit Crypto Ecosystem Report, in 2016 97% of illicit activity occurred on the Bitcoin compared to just 19% in 2022 highlighting the move to a mult-asset, cross-chain world. While illicit actors have become more sophisticated, so have the investigators and the tools they use. 

In 2019, in response to the growing number of blockchains and the growing use of different chains by cybercriminals, TRM Labs introduced cross-chain analytics in TRM Forensics, our flagship tracing tool. This enables investigators to trace funds from multiple blockchains and multiple assets in a single visualization.

In 2022, TRM identified the growing use of chain-hopping as an obfuscation technique, and  introduced TRM Phoenix, the industry’s first solution for automatically tracing the flow of funds across blockchains through bridges and other services.