Tracing for a suspicious activity report

Graduate · enrolled learners

This lesson opens with The Upbit hot-wallet theft, November 2019.

What happened

In November 2019 about 342,000 ether, worth roughly 50 million dollars at the time, was taken from the hot wallet of Upbit, a South Korean cryptocurrency exchange. Because the theft moved on a public ledger, the stolen ether did not vanish; it was traceable, and investigators followed it as the thieves sold 57 percent of it for bitcoin, at 2.5 percent below market price, on three exchange sites police believe North Korea set up, and distributed the rest to 51 overseas exchanges to launder it. In November 2024 South Korea's police attributed the theft to North Korea's Lazarus and Andariel groups, by tracking IP addresses and the flow of the funds with material obtained with the FBI's help. Some of the stolen funds had turned up on a Swiss exchange in 2020, and after four years spent proving their source to Swiss prosecutors, police had 4.8 bitcoin, worth about 600 million won, returned to Upbit in October 2024. The lesson for a compliance desk is on the receiving side: when some of those funds arrived at another exchange, that exchange could in principle trace an inbound deposit backward through the transfer graph and discover it led to the Upbit theft, which is exactly the situation that obliges a suspicious activity report rather than a quiet decision to keep or refuse the funds.

The decision point

Screening asks whether a counterparty looks risky before you deal with it; tracing goes further, following funds backward through the transfer graph to establish where a specific deposit actually came from, hop by hop, even after thieves have split and mixed it to obscure the path. The Upbit theft is the demonstration that stolen funds moving on a public ledger stay traceable through those obfuscation steps, which is why a receiving institution can discover that an inbound deposit leads back to a known theft. That discovery is not merely information to act on privately: when tracing reveals that funds are connected to crime, the regulated institution is generally obliged to file a suspicious activity report, a formal report to the authorities, rather than simply keeping or returning the funds on its own judgment. Under US rules for money services businesses, the duty covers a transaction of at least 2,000 dollars that the business knows, suspects or has reason to suspect involves funds derived from illegal activity, and the report is due within 30 calendar days of initial detection. So the decision an institution makes is that tracing has a required output when it surfaces criminal proceeds: the trace informs the report, and the report is filed, because a desk that traces a deposit to a theft and then handles it quietly has done the analysis and skipped the obligation the analysis triggered.

Recorded loss

$50,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.