Screening an address before you touch it

Graduate · enrolled learners

This lesson opens with Suex, September 2021.

What happened

Suex was a cryptocurrency exchange that in September 2021 became the first such exchange ever sanctioned by the US Treasury's Office of Foreign Assets Control. Treasury's case rested on analysis of Suex's known transactions, which found that over 40 percent of its known transaction history was associated with illicit actors, including the proceeds of at least eight ransomware variants. A published blockchain analysis of the same exchange found that, in bitcoin alone, Suex's deposit addresses at large exchanges had received over 160 million dollars from ransomware actors, scammers and darknet market operators since it opened in 2018. Suex operated as a cash-out point, a place where proceeds from crime were converted, and on this lesson's reading the reason its role could be measured at all is that its flows were written into the public ledger: they were visible on-chain the whole time, and the sanction acted on a record that a compliance desk could have read by screening an address before dealing with it.

The decision point

A public ledger is a two-edged fact: it records every transfer permanently for the world to trace, which means that before an institution transacts with an address it can look at what that address has done and what it is connected to. Screening an address before you touch it is using that record as a compliance control, asking whether the counterparty's on-chain history ties it to sanctioned entities, stolen funds, ransomware, darknet markets or other illicit sources, and doing so before value moves rather than discovering it afterward. Suex is the demonstration that this information is really there: an entire exchange was named as a cash-out point because its illicit role was legible on-chain to anyone who screened it. The critical discipline is that the check is preventive, made before the transaction, because once you have received or sent funds to a tainted counterparty the exposure already exists, and it is also probabilistic, because an address's history is a set of connections to weigh, not a certified identity. So the decision an institution makes is to screen the counterparty against the public record first and let the result inform whether it transacts at all, because the ledger already holds what Suex's counterparties should have seen.

Recorded loss

$160,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.