Zhuang's Diary

Learn about money laundering in one movie

一口气了解洗钱 它能玩得有多花 — 小Lin说
https://www.youtube.com/watch?v=s3iM7VslPsQ

Behavior 行为模式

peeling chain 剥皮链
A peeling chain is a behavioral pattern where multiple repeated deposits are made at an exchange or service. A peeling chain pattern may suggest an attempt to stay below a certain KYC threshold to avoid detection.
剥皮链是指在交易所或服务平台上反复进行多次存款操作。剥皮链模式可能意味着试图保持在某个KYC阈值以下，以避免被检测到。

举例 - 在2022年初，一些犯罪分子利用剥皮链技术在多家加密货币交易所进行小额频繁的存款操作，以保持在KYC合规的最低要求之下，从而避免被交易所标记为高风险账户。这些小额存款随后被转移到多个中间账户，最终汇集到一个主要的钱包地址，用于购买非法商品或进行洗钱活动。
reference link ==> https://www.fraudinvestigation.net/cryptocurrency/tracing/peel-chain

automated layering 自动分层
Automated layering, also called artificial hops, is a behavioral pattern that involves routing funds through multiple intermediate hops without any dilution of funds. An automated layering pattern may suggest an attempt to obfuscate the true source of funds by exploiting the fact that some screening programs will stop tracing at a certain number of hops.
自动分层，也称为人工跳跃，通过多次中间跳跃路由资金，而不稀释资金总额。自动分层模式可能表明企图利用某些筛查程序在一定跳跃次数后停止追踪的特点，来掩盖资金的真实来源。


实例 - 2023年，某犯罪团伙利用自动分层技术，将通过诈骗和勒索所得的加密货币资金，在短时间内通过多个区块链地址进行中转，每次转移均未稀释资金总量。整个操作过程中，资金经过超过20次跳跃，旨在逃避追踪和监管机构的监控。这种行为利用了部分筛查程序的限制（即超过一定次数的跳跃后停止追踪）。
reference link ==> https://www.fraudinvestigation.net/cryptocurrency/tracing/layering

mixer first funding 首次混币资助
Mixer first funding is a tactic used during high-profile exploits. Bad actors fund their attack addresses using a Mixer or Coin Swap Service to hide the original source of funds. While these services aren’t illegal in themselves, they allow users to obscure fund origins, which can facilitate illicit activities. This behaviour flags when addresses receive their first transaction from a mixer or low-KYC exchange.like Tornado Cash.
首次混币资助是在高调攻击事件中使用的策略。恶意行为者通过混币器或币交换服务为其攻击地址提供资金，以隐藏资金的原始来源。尽管这些服务本身不违法，但它们允许用户掩盖资金来源，可能助长非法活动。当地址接收到来自混币器或低KYC交易所的首次交易时，这种行为会被标记。例如，Tornado Cash。
在韩国，一起针对某知名区块链项目的攻击中，黑客利用混币器为攻击钱包地址提供初始资金。黑客通过混币服务掩盖了资金来源，然后对该区块链项目的智能合约漏洞进行了攻击，盗取了价值数千万美元的加密货币。

address poisoner 地址投毒者
Address Poisoner identifies addresses that conducted an address poisoning attack. Address poisoning, also known as address spoofing, is a scam where fraudsters create a fake wallet address resembling the user’s or one frequently used by them. Using this fake address, they send small amounts of cryptocurrency or NFTs to the user’s wallet, which ‘poisons’ the transaction history with deceitful transactions. They anticipate that the user, failing to notice the difference due to the address similarity, will unwittingly use the scam address for transactions - resulting in the loss of funds.
地址投毒者识别那些进行了地址投毒攻击的地址。地址投毒（也称地址欺骗）是一种骗局，骗子创建一个伪造的、与用户常用地址相似的钱包地址，并向用户的钱包发送少量加密货币或NFT，从而“污染”交易历史，使其充满欺骗性的交易记录。他们预期用户因地址相似而未能发现差异，从而在进行交易时不经意地使用了骗局地址，导致资金损失。
2022年底，美国一名诈骗者在某用户频繁使用的加密货币地址基础上，创建了一个仅在最后几位字符上不同的假冒地址。诈骗者利用这一相似地址，向受害者的钱包发送少量加密货币，希望受害者在未来的交易中误用该假冒地址，导致资金转入诈骗者控制的钱包。受害者没有仔细核对地址，误将价值数千美元的加密货币转入诈骗者的钱包。尽管事后发现了问题，但资金已无法追回。
1）诈骗者可以通过编写脚本，自动生成大量的地址，然后筛选出与目标地址相似的地址。由于每次生成的地址都是不同的，只要生成足够多的地址，总能找到一个与目标地址在某些位置上相似的地址。这个方法类似于“暴力破解”，需要大量的计算资源，但可以通过批量生成和筛选来实现。2）有些加密货币钱包允许用户使用一些工具（如Vanitygen）来生成“个性化”的地址，即地址的部分字符是可以指定的。这些工具允许用户设定地址的前缀或后缀，然后通过不断尝试生成满足条件的地址。例如，可以通过不断生成和筛选找到一个以特定字符或数字结尾的地址，从而与目标地址形成相似性。

exploiter 攻击者
Leverage this rule to mitigate interaction with addresses that have participated in a hack or exploit.
通过此规则，可以减少与曾参与黑客攻击或漏洞利用的地址之间的互动。

Ice phishing 冰钓式网络钓鱼
Ice phishing occurs when a user unknowingly allows a scammer to control their wallet. The scammer tricks the user into approving a transaction that looks safe, but in reality, the approval is granted to the scammer’s address hidden in transaction data. Once the approval is given, the attacker can take control over their digital assets. Leverage this rule to prevent interactions with addresses that have performed ice phishing attacks.
冰钓式网络钓鱼发生在用户在不知情的情况下允许诈骗者控制他们的钱包时。诈骗者诱骗用户批准一项看似安全的交易，但实际上，交易数据中隐藏的批准地址是诈骗者的。一旦批准，攻击者就可以控制用户的数字资产。通过此规则可以防止与执行冰钓式网络钓鱼攻击的地址进行交互。
2023年3月，英国某用户在一次空投活动中，批准了一项授权交易，实际上授权的是一个隐藏在交易数据中的恶意地址。该恶意地址由诈骗者控制，一旦获得授权，诈骗者迅速将用户的钱包中的代币转移至自己的钱包。受害者损失了价值超过50万美元的加密货币，而诈骗者利用多个分层账户迅速洗白这笔资金，避免了被追踪。

原理说明

1. 诱饵设定：诈骗者通常会通过某种诱饵，比如伪造的空投、假冒的DApp（去中心化应用）或钓鱼网站，诱导用户进行某项操作。
2. 授权请求：当用户点击“领取空投”或进行其他操作时，网站或应用会弹出一个交易请求，让用户授权某个智能合约或地址管理其代币。用户通常会认为这是一个安全的操作，实际上授权的地址是攻击者的恶意地址。
3. 恶意授权：用户一旦确认交易，攻击者就获得了代币的控制权限，可以任意转移受害者的资产。

代码实例
以下是一个示例，以ERC20代币为例，展示如何构造一个授权交易，并潜在地进行恶意操作：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

// 使用以太坊Web3库构造授权交易
const Web3 = require('web3');
const web3 = new Web3('https://mainnet.infura.io/v3/YOURINFURAAPIKEY');
// ERC20代币合约地址（示例）
const tokenContractAddress = '0xYourTokenContractAddress';
// 恶意地址（诈骗者控制的地址）
const maliciousAddress = '0xAttackerAddress';
// 受害者钱包地址
const victimAddress = '0xVictimAddress';
// ERC20合约ABI（接口定义，用于与合约进行交互）
const erc20Abi = [
    // 省略部分ABI，只保留approve方法
    {
        "constant": false,
        "inputs": [
            {
                "name": "spender",
                "type": "address"
            },
            {
                "name": "value",
                "type": "uint256"
            }
        ],
        "name": "approve",
        "outputs": [
            {
                "name": "",
                "type": "bool"
            }
        ],
        "type": "function"
    }
];

// 创建ERC20代币合约实例
const tokenContract = new web3.eth.Contract(erc20Abi, tokenContractAddress);
// 授权操作，实际上授权给了恶意地址
async function approveMaliciousAddress() {
    try {
        const amount = web3.utils.toWei('1000', 'ether'); // 授权数量，比如1000个代币
        // 构造授权交易数据
        const approveData = tokenContract.methods.approve(maliciousAddress, amount).encodeABI();
        // 构造交易对象
        const transactionObject = {
            from: victimAddress,
            to: tokenContractAddress,
            data: approveData,
            gas: 200000
        };
        // 在此处，用户会看到一个请求他们批准授权的弹窗，若用户批准，授权将被执行
        console.log('请在钱包中确认授权交易');
    } catch (error) {
        console.error('授权交易失败:', error);
    }
}
approveMaliciousAddress();

攻击过程
一旦授权完成，恶意地址将获得代币转移的权限。诈骗者可以使用transferFrom方法，将受害者的代币转移到自己控制的钱包。

1
2
3
4
5
6
7
8
9
10
11

// 转移代币的代码示例（攻击者执行）
async function transferTokensFromVictim() {
    try {
        const amount = web3.utils.toWei('1000', 'ether'); // 转移数量
        // 调用transferFrom将代币从受害者地址转移到攻击者地址
        await tokenContract.methods.transferFrom(victimAddress, maliciousAddress, amount).send({ from: maliciousAddress });
        console.log('代币已成功转移到攻击者钱包');
    } catch (error) {
        console.error('代币转移失败:', error);
    }
}

防范措施
• 仔细检查授权地址：用户在确认授权交易时，应该仔细检查授权的地址，确保不是恶意地址。

associated scammer address 关联诈骗者地址
Leverage this rule to mitigate interaction with addresses that have received funds from a known scammer.
通过此规则，可以减少与曾接收过已知诈骗者资金的地址之间的互动。

scammer deployed contract 诈骗者部署的合约
Leverage this rule to mitigate interaction with smart contracts deployed by known scammers. These contracts often promise high returns or false investments but are designed to siphon funds once the victim interacts with them. You can expand this section by discussing how smart contracts are audited (or not) and why code auditing practices could help detect scammer-deployed contracts early.
通过此规则，可以减少与已知诈骗者部署的智能合约之间的互动。这些合约通常承诺高回报或虚假投资，但其目的是在受害者与其互动后吸走资金。讨论如何审计智能合约（或不审计）以及为什么代码审计实践可以帮助及早发现诈骗者部署的合约来扩展此部分。

pig butchering 杀猪盘
Pig Butchering is a scam that utilizes deceptive communications to manipulate individuals into making fraudulent investments. This behavior identifies addresses that have received transactions suspected to be from Pig Butchering victims. This is accomplished by analyzing historical transactions made by victims of Pig Butchering.
杀猪盘是一种利用欺骗性沟通来操控个人进行虚假投资的骗局。该行为识别接收到疑似来自杀猪盘受害者交易的地址。这是通过分析杀猪盘受害者的历史交易实现的。
2023年7月，东南亚一个国际诈骗团伙通过社交平台接触受害者，利用情感交流和投资诱惑逐渐获取受害者的信任，随后引导受害者向所谓的“高收益投资项目”转账，实际上这些资金都进入了诈骗者控制的钱包。多个受害者损失金额高达数百万美元。受害者在察觉被骗后报案，但由于资金早已被分散转移至多个国家的加密货币账户，追查和追回难度极大。

Exposure

Detect exposure to labeled entities using various risk triggers 意思是识别与某些特定类别的实体（如企业、个人或组织）之间的潜在风险关联。
系统通过多种风险触发器来检测用户或地址与这些标记的实体之间的交互情况。这些实体通常被标记为与特定的高风险活动相关：

1. Activist Fundraising (政治/社会运动筹款)
与政治或社会运动相关的筹款活动，可能涉及高风险或敏感的资金来源，存在被利用进行非法活动的风险。
Associated with political or social movement fundraising, potentially involving high-risk or sensitive fund sources, and could be used for illegal activities.

2. ATM (加密货币自动取款机)
加密货币ATM允许用户将加密货币兑换成现金或反向操作，因其匿名性和现金交易特性，可能被用于洗钱活动。
Cryptocurrency ATMs allow users to convert crypto into cash or vice versa. Due to their anonymity and cash-based transactions, they can be used for money laundering.

3. Authentication (身份认证服务)
涉及身份认证服务，可能存在身份欺诈和非法账户访问的风险。
Involves identity authentication services, which could carry risks related to identity fraud and unauthorized account access.

4. Bitcoin Faucet (比特币水龙头)
提供少量免费比特币的网站，可能被用于隐匿资金来源或洗钱。
Websites that distribute small amounts of free Bitcoin, potentially used to obscure the source of funds or launder money.

5. Bridge (跨链桥服务)
跨链桥服务用于在不同区块链之间转移资产，可能增加资金追踪的难度。
Cross-chain bridges allow asset transfers between different blockchains, which can complicate fund tracing.

6. Broker (经纪商/中介服务)
未经许可的金融中介服务，可能涉及非法金融活动或欺诈。
Unlicensed financial intermediaries, potentially involved in illegal financial operations or fraud.

7. Charity (慈善机构)
某些慈善机构可能被用于洗钱或掩盖非法资金流动。
Some charity organizations may be used for money laundering or concealing illegal fund flows.

8. Child Sexual Abuse Material Vendor (儿童性虐待材料供应商)
涉及儿童性虐待材料的交易，是严重的非法活动风险指示。
Involves the trade of child sexual abuse material (CSAM), a severe indicator of illegal activity.

9. Coin Swap Service (币种兑换服务)
币种兑换服务用于将一种加密货币兑换为另一种，可能被用于洗钱或隐藏资金来源。
Coin swap services exchange one cryptocurrency for another and may be used for money laundering or hiding the source of funds.

10. Credit Card Data Vendor (信用卡数据供应商)
非法出售信用卡数据的服务，常用于网络犯罪和欺诈。
Services that illegally sell credit card data, often used in cybercrime and fraud.

11. Criminal Organization (犯罪组织)
与已知犯罪组织相关的实体，这些组织涉及洗钱、勒索等非法活动。
Entities associated with known criminal organizations involved in activities such as money laundering, extortion, etc.

12. Dark Forum (暗网论坛)
暗网上的非法讨论平台，常用于信息交易和非法商品交易。
Illicit discussion platforms on the darknet, often used for information exchange and the trade of illegal goods.

13. Dark Market – Centralized (中心化暗网市场)
提供非法商品和服务的中心化暗网市场。
Centralized darknet markets offering illegal goods and services.

14. Dark Market – Decentralized (去中心化暗网市场)
去中心化的非法商品和服务交易市场，难以追踪和关闭。
Decentralized marketplaces for trading illegal goods and services, harder to trace and shut down.

15. Dark Service (暗网服务)
提供匿名代理、伪造文档等非法服务的平台。
Platforms providing illegal services such as anonymous proxy, forged documents, etc.

16. Dark Vendor Shop (暗网供应商店)
在暗网市场上设立的供应商店，提供非法商品或服务。
Vendor shops on darknet markets providing illegal goods or services.

17. Extortion (勒索)
通过威胁或强制手段获取资金，常见于勒索软件攻击中。
Obtaining funds through threats or coercion, commonly seen in ransomware attacks.

18. FinCEN Primary Money Laundering Concern (FinCEN主要洗钱关注对象)
被美国金融犯罪执法网络（FinCEN）认定为主要洗钱对象。
Entities identified by the U.S. FinCEN as primary money laundering concerns.

19. Gambling (赌博)
在线赌博服务，可能与资金洗白、欺诈有关。
Online gambling services, potentially associated with money laundering or fraud.

20. Known Criminal (已知犯罪分子)
已被确认与犯罪行为有关联的实体，涉及欺诈、盗窃等活动。
Entities known to be involved in criminal activities such as fraud, theft, etc.

21. Malware (恶意软件)
涉及恶意软件的交易，这些软件用于窃取资金或敏感信息。
Transactions involving malware used to steal funds or sensitive information.

22. Marijuana Vendor Shop (大麻销售店铺)
销售大麻的商店，在一些地区可能非法。
Shops selling marijuana, which may be illegal in certain jurisdictions.

23. Mixer (混币服务)
混币服务用于混淆加密货币的资金来源，常用于洗钱。
Mixing services used to obscure the source of cryptocurrency, often for money laundering.

What Kind of Service is CoinJoin?
CoinJoin is a privacy-enhancing Bitcoin transaction which combines inputs from numerous users and returns multiple outputs of identical values. Unlike other mixing services, users maintain custody of their funds throughout this process.
The uniformity of outputs is intended to obscure ownership of each UTXO and defeat the heuristic-based clustering algorithms used by law enforcement and blockchain investigators.
For example, if four users input 2, 4, 6 and 8 BTC for a total of 20 BTC, the CoinJoin transaction would create 20 separate outputs each worth 1 BTC. The outputs would be apportioned to each user in the same amounts they originally contributed. Since every output has the same value, it should be impossible (in theory) to immediately discern which of the new bitcoin addresses are now controlled by each of the original four users.

24. OFAC Sanctioned Entity (OFAC制裁实体)
受到美国外国资产控制办公室（OFAC）制裁的实体。
Entities sanctioned by the U.S. Office of Foreign Assets Control (OFAC).

25. Phishing (网络钓鱼)
通过欺诈手段获取用户敏感信息（如私钥或登录凭证），常见于网络钓鱼攻击。
Fraudulently obtaining sensitive user information (e.g., private keys or login credentials), common in phishing attacks.

26. Ponzi Scheme (庞氏骗局)
一种非法的投资骗局，承诺高额回报，但实际上利用新投资者的资金支付旧投资者的收益。
An illegal investment scam promising high returns, but actually uses new investors’ funds to pay previous investors.

27. Privacy Wallet (隐私钱包)
注重隐私保护的钱包，可能被用于隐藏交易历史或资金流动。e.g., Wasabi Wallet。
Privacy-focused wallets designed to conceal transaction histories or fund flows. e.g., Wasabi Wallet.

28. Ransomware (勒索软件)
勒索软件攻击中使用的地址，受害者需支付赎金解锁被恶意加密的数据。
Addresses involved in ransomware attacks, where victims pay ransoms to unlock maliciously encrypted data.

29. Scam (诈骗)
涉及诈骗活动的实体或地址，这些地址可能用于网络钓鱼或其他形式的欺诈。
Entities or addresses involved in fraudulent activities, often used in phishing or other types of fraud.

30. Shielded (隐私交易)
通过隐私保护技术（如零知识证明）隐藏交易信息的工具。
Tools that use privacy-enhancing techniques (like zero-knowledge proofs) to hide transaction details.

31. Thief (盗窃)
涉及盗窃加密货币的地址，通常通过未经授权的访问或攻击行为。
Addresses involved in cryptocurrency theft, typically via unauthorized access or hacking.

32. Terrorist Organization (恐怖组织)
涉及恐怖组织的资金流动。
Transactions associated with terrorist organizations.

33. Human Trafficking (人口贩运)
与人口贩运相关的资金流动。
Transactions related to human trafficking activities.

34. Weapon Sales (武器销售)
非法武器销售相关的资金流动。
Transactions involving the illegal sale of weapons.

35. Drug Trafficking (毒品贩运)
与非法毒品交易相关的资金流动。
Transactions related to the illegal drug trade.

36. Sanctioned Countries (受制裁国家)
与受国际制裁国家的交易，可能违反国际法。
Transactions with entities from sanctioned countries, potentially violating international law.

37. Shell Companies (空壳公司)
被用于洗钱或隐藏非法资金来源的空壳公司。
Shell companies used for money laundering or hiding illegal fund sources.

38. High-Risk Jurisdictions (高风险司法管辖区)
与高腐败或监管薄弱的国家或地区的交易，可能增加洗钱风险。
Transactions with countries or regions known for weak regulations or high corruption, increasing money laundering risks.

39. Fraudulent ICO (欺诈性ICO)
假冒的初始代币发行，承诺高额回报但无实际项目支持。
Fake Initial Coin Offerings (ICOs) that promise high returns but have no real project backing.

40. Illegal Content (非法内容)
传播或交易非法内容（如盗版、暴力、仇恨言论），这些行为通常违反法律。
The distribution or trade of illegal content (e.g., pirated material, violence, hate speech), which typically violates the law.

41. Illicit Marketplace (非法市场)
从事非法商品或服务交易的市场，这些市场往往涉及洗钱、毒品或武器交易。
Marketplaces that deal in illegal goods or services, often involving money laundering, drug trade, or weapons transactions.

42. Money Mule (资金骡子)
通过第三方账户转移非法资金的活动，这些账户通常不知情或自愿参与。
Involves the transfer of illicit funds through third-party accounts, where the account holders may be unaware or willingly participate.

43. Ponzi-like Scheme (类庞氏骗局)
与庞氏骗局类似的投资骗局，承诺高额回报但实际上以新的投资者资金支付旧投资者的收益。
A fraudulent investment operation similar to a Ponzi scheme, promising high returns while using new investors’ money to pay earlier investors.

44. Privacy Coin (隐私币)
设计用于隐藏交易细节的加密货币，虽然保护用户隐私，但也可能被用于非法活动。
Cryptocurrencies designed to conceal transaction details, while enhancing user privacy, may also be used for illicit activities.

45. Ransomware Payment (勒索软件支付)
向勒索软件攻击者支付赎金的交易，用以解锁被恶意加密的数据。
Transactions made to ransomware attackers to unlock maliciously encrypted data.

46. Sanctioned Individual (受制裁个人)
与受国际或政府制裁的个人进行交易，可能违反制裁法律。
Transactions with individuals under international or government sanctions, potentially violating sanction laws.

47. Suspicious Transaction (可疑交易)
异常或可疑的交易行为，可能与洗钱、欺诈或其他非法活动相关。
Transactions that appear abnormal or suspicious, potentially linked to money laundering, fraud, or other illicit activities.

48. Terrorist Financing (恐怖主义融资)
为恐怖组织提供资金的行为，通常通过加密货币隐秘进行。
The act of providing financial support to terrorist organizations, often facilitated covertly through cryptocurrency.

49. Unlicensed Money Service Business (无牌照货币服务业务)
未经许可的货币兑换或转账服务，可能涉及洗钱或非法金融活动。
Unlicensed currency exchange or transfer services, potentially involved in money laundering or illegal financial activities.

50. Whale Transaction (巨鲸交易)
涉及大量加密货币交易，可能引起市场波动或被用于非法资金转移。
Transactions involving large amounts of cryptocurrency, potentially affecting market stability or used for illicit fund transfers.

51. Front-Running (抢跑交易)
涉及利用未公开的市场信息，在合法交易被确认之前抢先执行交易，导致市场操纵或不公平的交易环境。
Front-running involves using non-public market information to execute trades before legitimate trades are confirmed, leading to market manipulation or unfair practices.

52. Pump-and-Dump (拉高出货)
一种市场操纵手段，操纵者人为抬高加密货币的价格，吸引散户投资者购买，随后抛售手中的大量持仓。
A form of market manipulation where perpetrators artificially inflate the price of a cryptocurrency to attract retail investors, then sell off their large holdings.

53. Wash Trading (刷单交易)
交易者通过自己在不同账户间反复买卖相同资产，制造虚假交易量，操纵市场价格。
Traders repeatedly buy and sell the same asset between their own accounts, creating fake trading volume to manipulate market prices.

54. Regulatory Arbitrage (监管套利)
利用不同司法管辖区的监管差异，通过选择监管较宽松的地区进行交易，规避合规要求。
Taking advantage of regulatory differences across jurisdictions by trading in regions with looser regulations to avoid compliance requirements.

=============== the risks below are not in the list of Elliptic and TRMLAB ===============
================= 以下风险没有包含在 Elliptic and TRMLAB 的范围内 =================

55. Fake News Manipulation (假新闻操纵)
散布虚假消息，影响市场情绪和资产价格，从中获利或导致市场动荡。
Spreading false information to manipulate market sentiment and asset prices, either for profit or to destabilize the market.

56. Tax Evasion (逃税)
使用加密资产来隐瞒收入，逃避税收，特别是在多个国家拥有资产的情况下。
Using cryptocurrencies to hide income and evade taxes, especially when assets are held across multiple countries.

57. Insider Trading (内幕交易)
未公开的内部信息被用于个人利益相关的交易，可能违反证券法。
Using non-public insider information for personal gain in trading, potentially violating securities laws.

58. Peer-to-Peer (P2P) Market Risks (点对点市场风险)
在P2P交易市场上，用户可以绕过银行或正规金融机构进行交易，增加欺诈或非法交易的风险。
On peer-to-peer markets, users can bypass banks or formal financial institutions, increasing the risk of fraud or illicit transactions.

59. Layer 2 Protocol Risks (Layer 2协议风险)
涉及Layer 2扩展方案的风险，这些方案用于提高区块链交易的可扩展性，但可能缺乏充分的安全性或合规措施。
Risks related to Layer 2 scaling solutions, which aim to improve blockchain transaction scalability but may lack robust security or compliance measures.

60. Flash Loan Exploits (闪电贷攻击)
使用无抵押的闪电贷款，在单个交易中操纵市场或智能合约，进行非法获利。
Using uncollateralized flash loans to manipulate the market or smart contracts within a single transaction for illicit profit.

61. Smart Contract Exploits (智能合约漏洞利用)
利用智能合约中的漏洞或缺陷，执行未授权的资金转移或操纵合约行为。
Exploiting vulnerabilities or flaws in smart contracts to carry out unauthorized fund transfers or manipulate contract behavior.

62. NFT Fraud (NFT欺诈)
与非同质化代币(NFT)相关的欺诈行为，包括伪造稀有资产、洗钱或欺骗性交易。
Fraud involving Non-Fungible Tokens (NFTs), including forgery of rare assets, money laundering, or deceptive transactions.

63. Liquidity Pool Exploitation (流动性池利用)
通过操纵流动性池的算法或规则非法获利，导致投资者或交易者损失。
Illegally profiting by manipulating the algorithms or rules governing liquidity pools, causing losses to investors or traders.

64. DeFi Protocol Risks (去中心化金融协议风险)
去中心化金融(DeFi)平台的风险，包括智能合约漏洞、治理攻击、流动性枯竭等。
Risks associated with decentralized finance (DeFi) platforms, including smart contract vulnerabilities, governance attacks, and liquidity exhaustion.

65. Unregulated Stablecoins (无监管稳定币)
某些稳定币未受监管，可能在破产、赎回失败或资产透明性不足的情况下带来系统性风险。
Some stablecoins are unregulated, potentially posing systemic risks in the event of insolvency, redemption failures, or lack of transparency.

What Kind of Information Can be Traced?

The twin goals of cryptocurrency forensics and asset tracing — identify the perpetrator, and find their funds — are pursued through several areas of analysis and fact-finding:

1. Attribution Data: Blockchain intelligence tools collect and analyze ownership attribution information for thousands of entities, which can be used to de-anonymize blockchain addresses for identification of criminals and investigative subjects. These systems rarely provide personally identifying information (PII) for individual owners of specific cryptocurrency assets, but may identify known associations with criminal groups or fraud schemes, as well as transactions with other relevant entities, such as exchanges and fiat off-ramps where criminal proceeds are converted to cash.

2. Transaction Mapping: Transactional data is converted into visual maps and flowcharts, showing interactions by the subject with known exchanges and other entities, tracing financial transfers to their ultimate endpoints. Visual mapping makes it much easier to recognize patterns, such as layering and peel chains, commonly used for money laundering. Expert investigators use powerful tools that automate mapping and evidence collection. This approach is more efficient and more effective than blockchain search engines or open-source explorers that require manual review of ledger entries.

3. Cluster Analysis: A cluster is a group of cryptocurrency addresses that are controlled by the same person or entity. Expanding the focus of an investigation from one address to a larger cluster can dramatically increase the amount of available evidence for de-anonymization and asset tracing. Cluster analysis can also be used to determine if any linked addresses have a substantial current value or UTXO.

4. Subpoena Targets: Commercial cryptocurrency exchanges, decentralized finance (DeFi) firms, and virtual asset service providers that comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations typically require verification of customer identity for new accounts. This makes them a highly valuable resource for de-anonymizing subjects who have used their services to buy, trade, hold, or cash-out cryptocurrency. Personally identifying information for registered owners of addresses and wallets – as well as their banking details – may be obtainable through civil subpoenas or criminal warrants.

5. Current/Historical Value: Cryptocurrency addresses with significant value are critical indicators for financial recovery. They may be appropriate targets for seizure warrants by criminal prosecutors, or garnishment during civil judgment enforcement.

6. Total Transactions: Volume of cryptocurrency transactions can signify the potential size of a fraud scheme and number of victims. Complaints to law enforcement typically receive more attention when a crime syndicate has harmed numerous people. Larger schemes may also be appropriate for class action suits in civil court.

7. Risk Profiling: Automated risk-scoring is conducted through advanced algorithms that trace activity of target address(es) and identify associations with known entities such as exchanges, mixers, peer-to-peer exchanges, sanctioned parties, ransomware rings, and darknet markets.

8. IP Address: Privacy-piercing metadata is collected through blockchain surveillance systems, which run networks of nodes that “listen” and “sniff” for Internet Protocol (IP) addresses associated with certain transactions. IP addresses, when available, may provide information regarding the geographical location of the subject at the time of the transaction.

How to create a Finance business Risk Rule?

Combination of the risk rules as a business rules as below:

Rules as best example (Elliptic)

Entity Naming Conventions as best example

通用架构

员工 —>
Downstream(DRN) — HTTPS—> Int. Firewall —HTTPS —> Upstream (DMZ) —> Ext. Firewall —> Internet

聊天软件

员工 —>
GRE Router(HK, UK, China等国家) —> GRE Tunnel Encapsulation —> Zscaler (Cloud) —> MS Cloud (Teams)

网盘

员工 —>
网络策略Policy —> SAML —> Azure IDP

上网浏览

员工 —>
网络策略Policy —> Internet

VPN

远程员工 —>
网络策略Policy —> 拆分通道 —> ZOOM

Zscaler的能力

• 1）为用户建立profile，2）制定policy，3）执行policy - 控制用户的网络浏览。
• 可以和企业内部的 AD 整合。
• 用户端无法logout，无法退出，无法修改policy，确保用户执行policy。
• 管理员端可以方便地监控全体用户端流量情况，如，哪些 App 流量最高，用户端device类型/型号。
• 支持多云环境，自动更新，低延时，全球部署。

Broadcom

• 服务端网络安全管理

Trellix Endpoint Security

• 确保所有安全组件无缝运行，为所有载体提供强大的保护。
• 可以在用户工作电脑端，云端部署。
• 中心化管理。

以下是 Nightfall_3、Zeto 、 Zether 和 ZAMA 的详细比较，从隐私算法到交易花费、时长、限制等多个维度进行分析：

1. https://www.jpmorgan.com/kinexys/documents/JPMC-Kinexys-Project-Epic-Whitepaper-2024.pdf
2. https://github.com/Inco-fhevm/confidential-erc20-framework/blob/main/whitepaper.pdf
3. https://github.com/Inco-fhevm/confidential-erc20-framework/

根据BIS的文章：https://www.bis.org/bcbs/publ/wp44.pdf

直接说结论：公有链会产生现有风险分类中的风险，主要是运营风险，其次是流动性风险和市场风险。银行有管理此类风险的经验，但公有链带来了一些新挑战，可能需要新的或额外的方法来管理风险。减轻这些风险的做法处于不同的发展阶段，一般没有经过压力测试。虽然针对这些风险的技术解决方案尚未成熟，但快速发展可能会产生新的解决方案（和风险），这些解决方案（和风险）可能值得进一步研究。

Discussion of potential mitigants

• A. Business Continuity Planning Governance risk; technology/attack risk; political, policy, and legal uncertainty
• B. Technology-based control over parties and transactions Legal/compliance risk (money laundering/financing of terrorism)
• C. Permissioning a subset of node infrastructure Legal/compliance risk (money laundering/financing of terrorism); technology/attack risks, consumer protections risk
• D. Technology to address privacy/confidentiality/consumer protection risks Privacy/confidentiality/consumer protection risks
• E. Technology to address liquidity risk Liquidity risk

Business continuity planning

BCP could involve a registry that can be used to recover ownership after disruption, such as an off-chain database. For example, in the event of a hard fork or an attack on the blockchain that creates uncertainty as to the distributed ledger’s accuracy, the off-chain records could be used to identify the rightful owner of the assets or the branch of the fork that should be followed. BCP could also set out all relevant internal processes, including those to ensure that all transactions and participants are traceable, potential lost data can be recovered, and the records on the ownership of the assets can be retrieved within a reasonable timeframe. In addition, BCP could define an alternative blockchain where assets would be created or ported in case of disruption of the primary blockchain (“designation of a contingency chain”).

Technology-based control over parties and transactions

On certain permissionless blockchains, tokens that parties transact in are created or subject to constraints programmed by smart contracts. Those smart contracts determine the tokens’ operational attributes and limitations. Among other things, smart contracts can be used to control and limit access to and ownership of a token and even to reverse transactions that have already been processed. These features, in turn, could be used to mitigate some of the AML/CFT risk associated with permissionless blockchains. Implementation of permissions can take a number of forms:

1. Denylisting: when a crypto-asset has deny-listing functionality, the issuer can use the smart contract to bar specified addresses on the blockchain from holding or accessing the asset. A banking organisation might use this functionality to prevent transactions to or from wallets associated with known terrorists, criminals, or states subject to Office of Foreign Assets Control (OFAC) sanctions. The ability to infinitely create new wallets may limit the effectiveness of this mitigant.
2. Allowlisting: the inverse of denylisting. The token in question is programmed to be accessed only by approved addresses on the blockchain. Addresses that are not on the allowlist will not be able to receive or send the asset. The issuer can add or remove participants to the allowlist via the smart contract.
3. Privacy-preserving identity verification: technologies such as zero-knowledge proofs may allow identity verification while preserving privacy at the transaction level. Such technologies are nascent in both development and application.
4. A controller: smart contracts can also be used to empower a designated entity (the controller) to control and limit access to the cryptoasset; block and reverse transactions that are fraudulent; and amend the code that implements the cryptoasset functions to address any deficiencies that may emerge. The controller could be the entity that develops and maintains the business continuity plan (discussed above). The controller would not exercise control over the permissionless network itself, but over the specific tokens of a specific issuance. The controller could use its authority to help mitigate legal/compliance risks, in particular money laundering / financing of terrorism and OFAC sanctions risks, through the use of off-chain due diligence and blockchain-related permissioning technology.

   Permissioning node infrastructure

   Permissioning a subset of nodes might create known validators that are deemed safe for particular users such as banks to interact with. This may help address risks such as legal and compliance risks (including gas fee risks or ML/FT risks), technology/attack risks (including MEV risks), and consumer protection. This would likely come at the cost of slowing down transactions for the parties attempting to avoid paying gas fees to nodes operated by criminals or other sanctioned parties.

   Technology to address privacy, confidentiality and consumer protection risks

   Technology to address privacy, confidentiality, and consumer protection risks is being developed. Some potential solutions, such as zero-knowledge proofs, may take the form of permissioned chains “one level up” from the primary blockchain. In such a configuration, the primary chain is referred to as a layer 1 chain, while the chain one level up is referred to as a layer 2 chain. Alternatively, a separate blockchain that communicates with the permissionless primary blockchain, called a sidechain, may be employed. In addition to zero knowledge proofs, other methods such as fully homomorphic encryption might be used to protect consumer information.

   Technology to address liquidity risk

   Low transaction throughput of popular permissionless blockchains can be exacerbated in times of system stress, imposing liquidity risk on tokenised assets. Several variations on layer 1 consensus mechanisms are intended to speed up the clearance of transactions. In addition, many blockchain projects aim to speed up transaction processing on layer 2 chains and sidechains. However, while these solutions aim to off-load transaction volume from layer 1s, they still depend on the base permissionless blockchain for final settlement and therefore only partly compensate for the layer 1’s transaction processing speed. These technologies are all developing rapidly.

1. 摩根大通（JPMorgan Chase）
• 项目名称: Liink by J.P. Morgan (原名为Interbank Information Network, IIN)
• 业务金额: 摩根大通通过Liink的Confirm应用来改进全球资金转账，并降低交易被退回的概率。通过Liink进行的全球支付涉及超过9500000笔交易。此平台目前有90多家金融机构参与，覆盖20多个国家。
• 启动时间: 2019年以后，Liink在继续扩展和优化功能。
• 技术实现: Liink是由摩根大通的Onyx部门开发的一个分布式账本平台，最初称为Interbank Information Network (IIN)。该平台利用区块链技术来提高全球银行间支付的透明度和效率。Liink的技术架构基于Quorum，这是一种许可链，旨在确保高效、安全的交易处理。
• 相关资料: J.P. Morgan Liink

2. 汇丰银行（HSBC）
• 项目名称: Contour (原名为Voltron)
• 业务金额: Contour是一个基于区块链的贸易融资平台，旨在简化和加速全球贸易流程。目前，该平台处理的业务金额已超过1亿美元，主要涉及信用证（Letter of Credit）的数字化交易。超过20家银行，包括恒生，中国银行（香港），花旗银行，工商银行，ING，渣打银行，DBS，等等。
• 启动时间: 2019年正式推出，并且仍在全球范围内扩展。汇丰银行是 Contour 平台的创始成员之一，并且在推动平台的设计、开发和推广方面发挥了重要作用。
• 技术实现: Contour（前称为Voltron）使用R3的Corda区块链平台来实现贸易融资数字化。Corda是一个专为金融服务设计的分布式账本技术，允许企业通过智能合约来自动化贸易融资流程，并确保交易的安全性和透明性。
• 相关资料: Contour partners

3. 瑞银集团（UBS）
• 项目名称: Utility Settlement Coin (USC)
• 业务金额: USC项目涉及数亿美元的结算交易，由瑞银牵头，参与银行包括巴克莱、德意志银行、汇丰银行等。该项目致力于利用区块链技术进行金融市场的数字化结算。但没有具体的金额披露。
• 启动时间: 2019年继续扩展并成立了Fnality International公司来推动项目的商业化。
• 技术实现: USC项目由多家全球银行联合开发，使用了基于区块链的分布式账本技术，旨在创建一种数字货币用于金融市场的结算。该项目后来成立了Fnality International公司，进一步推动了该技术的实际应用。USC具体基于哪一种区块链技术，目前没有公开，但是可以看到Ethereum Enterprise Alliance (EEA) 是Utility Settlement Coin (USC)的活跃成员之一。
• 相关资料: Fnality International

4. 花旗集团（Citigroup）
• 项目名称: SETL
• 业务金额: Citigroup通过投资SETL平台，支持数亿美元的现金和其他资产的区块链结算。SETL旨在现代化资本市场基础设施，确保高效、安全的资产转移。但没有具体的金额披露。
• 启动时间: 2019年起，Citigroup持续支持SETL的发展。
• 技术实现: SETL平台旨在通过区块链技术来现代化资本市场基础设施。它允许资产（如现金、证券等）的安全、高效转移。SETL具体基于哪一种区块链技术，目前没有公开。
• 相关资料: SETL

5. ING银行（ING）
• 项目名称: HQLAx
• 业务金额: HQLAx平台旨在优化证券借贷市场，参与的市场规模达到数十亿美元，主要涉及银行间的高质量流动性资产（HQLA）借贷交易。
• 启动时间: 2018年
• 技术实现: HQLAx基于R3的Corda平台开发，该平台虽然是许可链，但项目与公有链有紧密关联。HQLAx通过区块链技术改善了市场的流动性和透明度。
• 相关资料: HQLAx Overview ， https://corda.net/modal/hqlax/

6. 渣打银行（Standard Chartered）
• 项目名称: Zodia Custody
• 业务金额: Zodia Custody服务于大型金融机构，如渣打银行和Northern Trust，提供安全的加密资产托管。
• 启动时间: 2020年
• 技术实现: 采用多重签名和冷存储技术，确保符合主要金融监管要求，保障数字资产的安全存储。
• 相关资料: Zodia Custody Overview

• 项目名称: Partior
• 业务金额: Partior为渣打银行、新加坡银行等金融机构提供跨境支付结算服务。
• 启动时间: 2021年
• 技术实现: 基于区块链技术，支持实时跨境支付结算，降低交易对手风险，并减少结算时间。
• 相关资料: Partior Overview

• 项目名称: Olea
• 业务金额: Olea为渣打银行和汇丰银行等大客户提供供应链金融服务，帮助企业管理和融资供应链。
• 启动时间: 2021年
• 技术实现: 利用区块链技术创建透明且可追踪的供应链融资流程，减少企业融资的时间和成本。
• 相关资料: Olea Overview

7. 西班牙对外银行（BBVA）
• 项目名称: BBVA Corporate Loans on Blockchain
• 业务金额: 西班牙对外银行利用区块链平台进行了数十亿美元的企业贷款结算。
• 启动时间: 2018年
• 技术实现: 该项目使用了基于以太坊（Ethereum）的公有链技术来记录和结算企业贷款，使交易透明化并降低操作风险。
• 相关资料: BBVA Blockchain Projects

8. 法国农业信贷银行（Crédit Agricole）
• 项目名称: Tokenization of Bonds on Blockchain
• 业务金额: 法国农业信贷银行的意大利分行与金融科技初创公司BlockInvest合作，正在推动债券代币化项目。该项目特别关注中小企业（SMEs）的债券发行，这也是意大利央行探索分布式账本技术（DLT）的一部分。
• 启动时间: 自2021年以来，该项目一直在发展，最近在2023年进行了扩展，重点是平台的扩展和新监管要求的整合，包括未来可能引入的加密欧元。
• 技术实现: 该项目使用了以太坊（Ethereum）和Polygon公有区块链平台，以提供一个安全透明的环境来进行债券发行。项目旨在提高债券交易的效率，增加市场的流动性和可访问性。未来，项目计划集成自动交割对付（DvP）和链上身份解决方案，以确保合规性和提高运营效率。
• 相关资料: SEB and Crédit Agricole CIB launch digital bond platform built on blockchain technology，https://www.ledgerinsights.com/credit-agricole-italy-bond-tokenization/

9. 富达投资（Fidelity Investments）
• 项目名称: Fidelity Digital Assets
• 业务金额: 未披露具体金额，但富达投资的数字资产业务管理着大量的加密货币，包括比特币和以太坊，服务于全球的机构投资者。
• 启动时间: 2018年启动，是传统金融机构中较早涉足数字资产托管领域的公司之一。
• 技术实现: 富达的数字资产平台通过定制化的冷存储和热存储解决方案，提供高度安全的数字资产托管服务。平台采用了多重签名技术和先进的安全协议，确保资产的安全性和符合监管要求。此外，富达还提供交易执行、市场接入和其他增值服务，以帮助客户在数字资产市场中进行投资。
• 相关资料: Fidelity Digital Assets Fidelity-backed crypto security startup Fireblocks launches ‘Secure Asset Transfer Network’

10. 德意志银行（Deutsche Bank）
• 项目名称: Digital Asset Custody Platform
• 业务金额: 具体金额未披露，但该平台旨在为机构客户提供广泛的数字资产托管服务，包括比特币和以太坊等主要加密货币。德意志银行已经为此申请了监管许可，显示其在这一领域的重大投入  。
• 启动时间: 项目于2021年启动，并在2023年加速推进。
• 技术实现: 平台结合了传统银行系统和数字资产生态系统，提供机构级别的冷存储和热存储解决方案，确保资产的安全性和合规性。
• 相关资料: CoinDesk, Daily Hodl

11. 法国巴黎银行（BNP Paribas）
• 项目名称: BNP Paribas Securities Services’ Digital Asset Custody
• 业务金额: 未披露具体金额，但该平台旨在为机构客户提供安全且合规的数字资产托管服务。
• 启动时间: 2022年启动，目前正在积极扩展服务以满足市场需求。
• 技术实现: 法国巴黎银行与两大金融科技公司Fireblocks和METACO合作，开发了这一数字资产托管平台。Fireblocks提供热钱包、代币化和连接基础设施层，METACO则提供银行级别的数字资产托管和编排平台。平台集成了区块链技术，旨在为客户提供安全且高效的数字资产发行、转移和托管服务。
• 相关资料: BNP Paribas Securities Services to develop digital assets custody capabilities through partnerships with METACO and Fireblocks

12. 瑞银集团（UBS）
• 项目名称: UBS Digital Asset Custody
• 业务金额: 未披露具体金额，但主要为高净值客户和机构投资者提供服务。
• 启动时间: 2021年启动，逐步扩展数字资产管理服务。
• 技术实现: 该平台采用区块链技术，提供全面的数字资产管理和托管服务，确保高效且安全的资产交易。
• 相关资料: UBS Tokenize

13. 高盛（Goldman Sachs）
• 项目名称: Goldman Sachs Digital Asset Custody
• 业务金额: 未披露具体金额，但高盛的数字资产托管服务预计涉及数十亿美元的资产管理。
• 启动时间: 2021年启动，并逐步扩展以涵盖更多类型的数字资产。
• 技术实现: 平台整合了冷存储和热存储解决方案，确保符合机构投资者的安全性和合规性要求。
• 相关资料: Goldman Sachs/discover/gs-dap