According to a new report, cryptocurrency-related scams weighed in at $7.7 billion in 2022. This might have been the year cryptocurrency officially went mainstream: Coinbase was listed on the Nasdaq stock exchange, non-fungible tokens (NFTs) became nigh-ubiquitous, and Bitcoin was made legal tender in El Salvador. But a Chainalysis report showed that Wall Street, crypto enthusiasts, and El Salvador's government weren't the only groups to benefit in 2021. So did cryptocurrency scammers.
The company published a preview of its 2022 Crypto Crime Report on Thursday focused specifically on cryptocurrency-related scams throughout 2021. Chainalysis said in the preview report that scammers made off with a record $7.7 billion worth of cryptocurrency this year—which means that "scams were once again the largest form of cryptocurrency-based crime by transaction volume" in 2021.
"As the largest form of cryptocurrency-based crime and one uniquely targeted toward new users," Chainalysis said, "scamming poses one of the biggest threats to cryptocurrency's continued adoption."
The company said the $7.7 billion worth of cryptocurrency stolen by scammers in 2021 was an 81 percent increase over the amount stolen in 2020. That's because in 2020, "scamming activity dropped significantly compared to 2019, in large part due to the absence of any large-scale Ponzi schemes," Chainalysis said. (Although some have argued that cryptocurrency is by its very nature a Ponzi scheme unto itself.)
That's where Finiko came in.
"Finiko was a Russia-based Ponzi scheme that operated from December 2019 until July 2021," Chainalysis said, "at which point it collapsed after users found they could no longer withdraw funds from their accounts with the company. Finiko invited users to invest with either Bitcoin or Tether, promising monthly returns of up to 30%, and eventually launched its own coin that traded on several exchanges."
The scheme was successful: Chainalysis said that Finiko "received over $1.5 billion worth of Bitcoin in over 800,000 separate deposits" from December 2019 to July 2021. It also noted that at least some of that $1.5 billion was paid out to keep the scheme running, of course, but said that Finiko "represents a massive fraud perpetrated against Eastern European cryptocurrency users" nonetheless.
Despite its scale, Finiko seemed like a fairly typical cryptocurrency scam, especially regarding how it moved the grifted funds. Chainalysis said the vast majority of scammers cashed out using mainstream cryptocurrency exchanges; a very small amount of the ill-gotten gains tracked by the company were used to make illicit purchases, sent to decentralized finance (DeFi) platforms, or managed in other ways.
But even the Finiko scheme didn't account for the enormous increase in cryptocurrency stolen by scammers in 2021. Chainalysis said that increase actually resulted from "rug pulls," which the company said, "emerged as the go-to scam of the DeFi ecosystem, accounting for 37% of all cryptocurrency scam revenue in 2021, versus just 1% in 2020." Without that bump, the amount stolen would've stayed flat.
And what exactly is a rug pull? "The definition of 'rug pull' isn't set in stone," Chainalysis said, "but we generally use it to refer to cases in which developers build out what appear to be legitimate cryptocurrency projects — meaning they do more than simply set up wallets to receive cryptocurrency for, say, fraudulent investing opportunities — before taking investors' money and disappearing."
The company said, "rug pulls are prevalent in DeFi because, with the right technical know-how, it’s cheap and easy to create new tokens on the Ethereum blockchain or others and get them listed on decentralized exchanges (DEXes) without a code audit." Those audits would typically detect the ability to indiscriminately drain funds from the liquidity pool, which is exactly what the scammers eventually do.
Rug pulls aren't exclusive to DeFi platforms. Chainalysis said the founder of Thodex, a Turkish cryptocurrency exchange, making off with $2 billion worth of crypto stolen from more than 300,000 users represented 90 percent of the amount stolen by this kind of scam. "However, all the other rug pulls in 2021 began as DeFi projects," it said. So it seems DeFi scams are far more prevalent but also much less profitable.
All of this means that the $600 million (briefly) stolen from Poly Network, the $150 million stolen from BitMart, and the $100 million stolen from VulcanForged pales in comparison to the amount of cryptocurrency lost to scammers in 2021. Crypto heists make for good stories, but when it comes to cryptocurrency-related crimes, the Chainalysis report showed traditional scams and rug pulls are where the money is.
