Not A Bug But A Feature

Source

Datafinnovation are out with more impressive research described in a blog post entitled Losing The Blacklisting Race and a paper entitled Enforcement Speeds In DeFi: Limits to a Race Against Time by Ben Charoenwong et al.

The blog post is more accessible, so that's what I will quote from. But for the details you need to read the paper. The blog post's TL;DR is:

First, we explore the empirical reality of OFAC’s blacklisting efforts. The results there are stark: nearly all addresses are completely empty by the time OFAC manages to blacklist them. This result is robust across time, attacker and type of attack. Second, we construct a simple model to explain why this outcome is inevitable with competent attackers. Evasion strategies which work in our model match those we find employed in the wild.

Below the fold, I start from Datafinnovation's work and explore its context.

Their analysis rests on two properties of permissionless blockchains; creating new wallets is free and fast, and transferring coins to and from them is cheap and quick. Thus attempts to enforce compliance by identifying "bad actors" wallets and persuading cryptocurrency institutions to blacklist them are in a race that both in practice and in theory the enforcers are doomed to lose. There are two reasons for this. First, because the actions the enforcers need to take are slower than those of the "bad actors". And second:

The key observation remains that attackers know when they attack. So this naturally sets up a race where the attacker has a head start.

They summarize their exploration of the empirical reality thus:

The paper works through all addresses designated by OFAC over several years and groups them by entity. We are then able to compute the “depletion rate” for each entity: what fraction of the funds that entered the entity’s eventually-blocked addresses managed to escape. For almost all entities this rate is ~100%. As we identify over two dozen entities, we conclude near-total escape is not limited to a certain type of entity or incident or anything else.

We can rule out explanations like “only hackers escape” or “only state-sponsored entities escape” because we see almost everyone escape. Ineffectiveness is, empirically, the reality of current compliance efforts. This is an observation not an opinion. Our claim is not that these compliance efforts are completely useless — it is only that they are sufficiently useless as to be ineffective in practice. For example, a marginal chance of having some stolen funds frozen is not going to disincentivise professional hacking groups.

Figure 3

The paper's Figure 3 shows the depletion rate for their data set of incidents. This is defined as "fraction of total USD-converted token value that exited sanctioned addresses before OFAC’s blacklisting announcement". In most cases sanctioning the wallet was futile because essentially all the value was gone. How much slower is enforcement?

The key measure — what will become a critical determinant of success in our later model — is the time gap between an incident occurring (i.e. an exploit or theft) and enforcement (i.e. funds being frozen). We find this gap is generally on the order of 10–20 days. Again this is pretty robust across incidents and entities.

The 13.8% outlier in Figure 3, caused by unusually quick blacklisting, is the Lazarus Group:

The paper works through the details of the Lazarus Group escaping with Ronin Network hack proceeds in 2022. We can easily see the hackers running ahead of waves of OFAC enforcement in exactly the way our model predicts rational hackers that understand enforcement will behave.

Figure 1

Despite multiple enforcement actions, Lazarus was able to keep ahead of the authorities, as shown in the paper's Figure 1. The authors define the escape rate as "the fraction of remaining balances that were subsequently transferred out despite official designation", and the freeze rate as the remainder that the enforcers captured. Across their whole data set the freeze rate was pathetic:

Of the approximately $944 million in total balance at blacklisting, $930 million ... was subsequently transferred out. Only $14 million ... remains frozen in the sanctioned wallets. The Lazarus Group, with the largest nominal exposure and lowest entity-level depletion, contributes much of this balance; its successor wallets T2–T8 drained near-completely after designation.

That is a 1.5% tax on criminal's loot..

Datafinnovation's Tradeoffs in automated financial regulation of decentralized finance due to limits on mutable turing machines showed that:

a decentralized and permissionless Turing-complete system cannot provably comply with regulations concerning anti-money laundering, know-your-client obligations, some securities restrictions and forms of exchange control.

Thus they argue that an automated system will necessarily leak, and that it is necessary to force a prudent, risk management approach on licensed providers by making them liable for transactions to and from sanctioned wallets, with penalties sufficient to deter. But:

To the extent the tools are known to generally lose the funds-escape race none of this is helpful. The amount of loss is still growing quickly. These are perhaps better understood as cynical attempts to sell tools by presenting failure as a narrow success to justify spending on those tools. Misguided resource allocation in this area, in our view, has been an essential component in the explosive growth of scams and hacks. There is no reason for a sane person to believe using the same broken tools will magically produce better outcomes in the future.

Why is the US administration committed to enforcing the laws against financial crimes and the associated money laundering using tools that cannot possibly work, rather than imposing actual consequences upon institutions that facilitate the crimes? For an answer we need look no further than a press release dated 11^th August 2026 from the US Treasury entitled FinCEN Permanently Ends Beneficial Ownership Reporting Requirements for Millions of Small Business Owners. This triggered former Republican speech-writer David Frum's Trump’s Last Loyal Constituency:

“Many secrets; no mysteries.” That’s the master code of the Trump administration. When it does something strange, there’s never any mystery as to why: Somebody close to the president, or possibly the president and his family themselves, intends to score a dishonest dollar. Exactly who and how may be secret. Exactly why is no mystery.

So it is with the news that the Department of the Treasury has ended ownership-reporting requirements for U.S. businesses and purged the existing database of ownership information. This seemingly technical-sounding change is a huge gift to financial crooks, who can now store and launder dark money in U.S. financial institutions with less risk of detection. But the gift comes at the direct expense of banks, mutual funds, insurance companies, and other financial institutions, which now have to shoulder the burden of verifying customer data themselves.

How big a problem were these reporting requirements for "millions of small business owners"?:

The information required was pretty basic: name, address, birth date, and a government ID—a Social Security card, say, or a passport. For the great majority of U.S. enterprises, these rules were easy to comply with. Almost 80 percent of American businesses have no employees other than the owner. You have probably divulged the requested information dozens of times without inconvenience.

The problem the Corporate Transparency Act was intended to solve wasn't about small business:

For the institutions receiving the information, however, its collection was very burdensome. Most clients told the truth. Some did not. How to tell which was which—and how to authenticate the information provided by untruthful clients? The consequences of a mistake could be catastrophic for the financial institution. In 2024, TD Bank paid $3 billion in fines—and accepted limits on the future growth of its business—to settle U.S. claims that it had not properly monitored accounts opened by fentanyl traffickers.

To protect themselves, financial institutions pay third-party agencies to check information about their customers, especially those algorithmically identified as high-risk. One study puts the cost of financial-crimes compliance in the United States and Canada at $61 billion.

How did the CTA try to reduce these costs? It:

imposed an obligation on most businesses operating inside the United States to report their ownership directly to the government. The Corporate Transparency Act authorized the Treasury to establish a database of this information. ... If a financial institution sensed something amiss, the federal database would assist its investigation. The goal was less to exclude criminals from the banking system than to use “the banks to track the money and find the criminals,

By destroying the database, the Trump administration has removed that help from financial institutions and foreclosed an essential avenue for tracking crooks.

How much difference did terminating the reporting requirement make to honest businesses?

Despite the Treasury’s claims that this purported deregulation of financial information “is a victory for common sense and American small businesses,” in the words of Treasury Secretary Scott Bessent, the change provides scarcely any benefit at all to honest businesses. They still have to report the relevant names, addresses, dates of birth, and government-ID numbers every time they transact with a financial institution. That burden remains the law.

And how much difference did it make to dishonest businesses?

The purported “deregulation” is, however, a great benefit to tax evaders, drug traffickers, money launderers, and other criminals hoping to elude scrutiny of their finances. If they can locate a weak or careless or greedy financial institution, they can open accounts with imperfect information—and they now stand a much higher chance of getting away with their deception.

Though it is important to note that one reason the US has a large share of the money laundering market is that, whatever the Federal government wants, corporations are a matter of state law not federal. Some US states, such as Montana and Wyoming, are happy to facilitate money laundering by registering corporations without knowing their beneficial ownership.

The "deregulation" is part of a broader picture of administration policies:

Across the federal government, enforcement against rich-people crimes has been crippled or abandoned. Inside the Department of Justice, resources have been redistributed away from white-collar-crime enforcement, and Trump has stopped enforcing laws against bribing foreign officials altogether. Pre-Trump, some three dozen lawyers worked on domestic public integrity at DOJ. That figure has been cut to two. The team that policed lawbreaking in the crypto industry has been disbanded.

Why is the administration so intent on making money laundering and financial crime great again? Here are just a few of many similar clues:

• On March 6^th 2015 the Financial Crimes Enforcement Network announced that FinCEN Fines Trump Taj Mahal Casino Resort $10 Million for Significant and Long Standing Anti-Money Laundering Violations:
  

  The Financial Crimes Enforcement Network (FinCEN) today imposed a $10 million civil money penalty against Trump Taj Mahal Casino Resort (Trump Taj Mahal), for willful and repeated violations of the Bank Secrecy Act (BSA). In addition to the civil money penalty, the casino is required to conduct periodic external audits to examine its anti-money laundering (AML) BSA compliance program and provide those audit reports to FinCEN and the casino’s Board of Directors.
  
  Trump Taj Mahal, a casino in Atlantic City, New Jersey, admitted to several willful BSA violations, including violations of AML program requirements, reporting obligations, and recordkeeping requirements. Trump Taj Mahal has a long history of prior, repeated BSA violations cited by examiners dating back to 2003. Additionally, in 1998, FinCEN assessed a $477,700 civil money penalty against Trump Taj Mahal for currency transaction reporting violations.

• On 15^th June 2015 David Sirota and Lydia O'Neal reported that Trump’s Businesses Have A History Of Money Laundering Charges:
  

  Special prosecutor Robert Mueller, appointed to lead the probe of alleged Russian meddling in the 2016 presidential election, is reportedly examining whether or not President Donald Trump’s associates violated money laundering laws. That scrutiny is hardly unfamiliar to Trump, as his business empire has been repeatedly sanctioned for violating those statutes. He even at one point pressed regulators to weaken the rules.
  
  In 1993, the Associated Press reported that two of Trump’s Atlantic City casinos were fined by Treasury Department regulators for “willfully failing to report” transactions involving more than $10,000 — a violation of the Bank Secrecy Act (BSA). Five years later, the department fined Trump Taj Mahal Associates, the company managing the eponymous Atlantic City casino, for violating the same law, which was created in 1970 to help combat money laundering.
  
  More recently, in March 2015, three months before Trump announced his bid for the presidency, regulators fined the same casino $10 million. Trump had severed his relationship with the now-defunct Taj Mahal when he sold it to billionaire investor Carl Icahn in 2016, a move to try and save the casino following a series of bankruptcies. According to a Treasury Department press release announcing the March 2015 charges, the regulator had imposed the penalty “for willful and repeated violations of the Bank Secrecy Act… dating back to 2003” — during the time Trump was running the company.
  ...
  In 2006, the George W. Bush administration proposed updates to the BSA that would impose stricter reporting requirements for casino transactions. The new amendments to the BSA, as proposed in March of that year, would broaden financial reporting by the casinos to include “bills inserted into electronic gaming devices” and update the law’s wording “with terminology that is more current and commonly used” in the casino industry.
  
  In response, a top Trump official pressed regulators to drop both of those changes. In a letter to regulators, Trump Entertainment Resorts Vice President of Legal Affairs Pat Agnellini argued that the reporting “process would be so cumbersome.” The executive also asserted that electronic gaming “would not be a conduit for money laundering and therefore, any minimal benefit would be dramatically outweighed by the cost of any potential programming fix.”

• On November 17^th 2017 Cristina Maza reported that Trump Made Millions of Dollars From Drug Money Laundering in Panama: Report:
  

  President Donald Trump made tens of millions of dollars in profits by allowing Colombian drug cartels and other groups to launder money through a Trump-affiliated hotel in Panama, according to a new investigation by the organization Global Witness.
  
  In the early 2000s, Trump was having financial difficulties and began selling his high-profile name to real estate developers around the world, the report said. One of these developed Panama's Trump Ocean Club International Hotel and Tower.
  
  The report said the drug cartels purchased hotel units to hide the origins of money earned through drug trafficking and other criminal activity, and Trump is estimated to have earned tens of millions of dollars from the deals.

• On March 29^th 2019 Craig Unger reported that Trump’s businesses are full of dirty Russian money. The scandal is that it’s legal:
  

  What I mean is that for more than three decades, at least 13 people with known or alleged links to the Russian Mafia held the deeds to, lived in or ran criminal operations out of Trump Tower in New York or other Trump properties. I mean that many of them used Trump-branded real estate to launder vast amounts of money by buying multimillion-dollar condos through anonymous shell companies. I mean that the Bayrock Group, a real estate development company that was based in Trump Tower and had ties to the Kremlin, came up with a new business model to franchise Trump condos after he lost billions of dollars in his Atlantic City casino developments, and helped make him rich again.

• On 2^nd August 2026 Reuters reported that Capital One says it closed Trump Organization’s accounts after anti-money-laundering review:
  

  Capital One Financial hit back on Friday against a lawsuit over its decision to close the Trump Organization’s bank accounts years ago, stating that it did so after a review by anti-money-laundering experts.
  ...
  Capital One has never accused the Trump Organization of money laundering. But Friday’s filing argues that “documents and Plaintiffs’ own allegations make clear that Capital One closed Plaintiffs’ accounts for anti-money laundering (‘AML’) reasons.

Now can you see why this post's title is "Not A Bug But A Feature"? Everybody who matters is happy with this Potemkin enforcement:

• The cryptocurrency industry is happy, since effective enforcement would collapse trading volumes and thus their earnings.
• The "bad actors" are happy, because they are paying a percent or two for immunity from the law.
• The tracing companies are happy, because they have a guaranteed market for their services and vast amounts of data to work with.
• The government is happy, because they can tout the yield of their tax on crime as evidence that they are "cracking down on crime", but without significantly impeding the earnings of senior officials and their donors..

The only people who are unhappy are the victims of the crimes that flourish behind the Potemkin facade.