27,000 requests last year: Collaboration key for Binance’s Investigations team

Binance’s Investigations and Intelligence team plays a role in helping global law enforcement agencies identify and combat crypto-related crime.

Historical crime has left a proverbial black mark on the cryptocurrency ecosystem with multi-million dollar hacks, scams and fraud cases grabbing headlines around the world.

Various research reports have highlighted the use of cryptocurrencies for illicit means, with varying degrees of severity since Bitcoin’s inception in 2009. This has ebbed and flowed but crypto is still perceived by some as a means to launder money, finance terrorism and facilitate other serious crimes.

The prevalence of cryptocurrency-related crime inevitably led to the development of better tools and services to track and trace funds on different blockchains and cryptocurrency exchanges. Firms like CipherTrace, Chainalysis and Elliptic offer surveillance and analysis tools to businesses, while some of the biggest players have gone as far as establishing their own investigation and surveillance departments to identify illicit transfers on their platforms.

Binance is among them, with its exchange operating in several jurisdictions across the world. Its global footprint has demanded greater oversight of its operations which is carried out by Binance’s Investigations and Intelligence department.

Cointelegraph sat down for an interview with department head Nils Andersen-Röed and senior manager Jennifer Hicks during Web Summit in Lisbon to unpack the role their team plays within the organization and the greater cryptocurrency and crime enforcement space.

Industry experts

Both individuals have a wealth of experience in the sector. Andersen-Röed rose through the ranks of the Netherlands Politie and led its Dark Web Unit from 2016 to 2018. He then worked for Europol’s Specialist Dark Web Team for three years before joining Binance.

Hicks’ military background saw her serve as a cryptologic linguist for the United States Navy from 2010 to 2016. She later moved into specialized investigative work as a senior cybercrime investigator for Chainalysis from 2020 to 2021 as a precursor to her current role at Binance.

Andersen-Röed oversees the European, Middle East and Africa region, with a mandate to handle a broad scope incorporating compliance processes. This includes transaction monitoring and storyboarding, as well as escalations on more serious issues:

“In my team, I’ve got former law enforcement agents, so we all used to work on crime cases ranging from ransomware to traditional cases with cryptocurrency elements in there.”

Hicks has a more specific directive across the global team, heading up the special investigations unit. Her team focuses on multinational and extremist-related crimes, tapping into her terrorist financing expertise:

“We’ll get requests from all over the world. It could be Europe, United States, anything that has extreme events that could be crypto related and not just Islamic terrorism.”

Hicks’ department has also addressed cases related to child abuse materials, violent crimes and incidents involving sanctions.

Busy workload

Binance, like many other exchanges, has a dedicated team that deals with general oversight requests and private information inquiries. More complex or urgent queries are allocated to specific departments.

The exchange’s global reach means that Andersen-Röed’s department is busy, usually processing requests in a few hours to three working days on average. It’s no mean feat, given the sheer amount of requests handled in 2021:

“The generic caseload is quite big. I think for the case team, for example, last year had like 27,000 requests which were handled in a very short time.”

This does not include what he describes as “proactive work.” This could include an instance of a hack, for example, where the team looks for exposure to Binance and investigates and takes action at an exchange level:

“If we see or if we notice certain law enforcement agencies in certain countries are interested in it, then we also reach out to them to see if we can work with them.”

Collaborative efforts

Binance’s Investigations team has also been involved in larger projects relating to fraud cases, terrorism financing and ransomware attacks, which Andersen-Röed described as top priorities for law enforcement agencies.

The transparent nature of blockchain networks also means that there is no shortage of work for Binance’s investigative team. This calls for a predefined scope in order to manage workloads and investigative efforts, given that some illicit movement of funds could eventually end up on Binance’s platform:

“If you see a hack, even if it doesn’t go to our platform, we can still trace it through blockchain. So, we quite often have to define up to what point we will investigate. It could be that a hack at some point will reach our platform or users will try to launder money, and then we can quickly take action.”

Binance’s Investigations team also has outside agencies approaching it for assistance. Hicks joked that the department receives requests “hourly” but the reality is that their expertise is sought after and influential.

Working through hundreds of law enforcement requests is a sizable task, but Hicks highlighted her team’s efforts to help guide and support investigations that might be outside of the exchange’s sphere of influence. This includes offering more than just information that has been requested, by collaborating on thought processes and analytical approaches:

“If we think that there’s a better avenue for them to get the answers that they need in their investigation, we’ll walk them through that. It’s really like a holistic process. It’s not really just standard field tracing and all that.”

Investigations are a two-way street as well. Binance relies on commercial tools and threat intelligence platforms to keep an eye out for crypto-related crimes and illicit movement of funds, as Hicks explained:

“The threat intelligence industry is chock full of great counterterrorism analysts that I used to work with in the past. So there is a network there that we rely on in order to gain a complete picture of whatever that investigation may be.”

A guiding hand

While the top global law enforcement agencies are well-versed in tackling cryptocurrency-related crime, Binance’s Investigations team also supports those that are still learning to deal with these types of crimes.

Andersen-Röed admitted that some countries and agencies are great at what they do, while others are still learning about the sector and lack the tools and expertise to tackle more complex tracing and crypto-related incidents:

“We also try to we do a lot of active outreach for law enforcement to basically explain what we’re doing but also how they can investigate. And it helps us because the quality of professional will improve.”

The pair’s Investigations team forms an important but smaller part of Binance’s compliance and security infrastructure. Some 500 people make up the department of the exchange that ensures its stability and security.

Nevertheless, the impact of the Investigations team can end up helping secure the wider cryptocurrency ecosystem by going one step further than just identifying and deactivating Binance accounts being used to move illicit funds.

Andersen-Röed stressed the importance of the reactive and proactive work in tracing cryptocurrency and flagging potential criminal elements:

“We try to take action against the accounts and reach out to law enforcement so they can investigate and hopefully arrest criminals. We try to keep our platform safe, but we also try to keep the industry safe.”

The cat-and-mouse nature of these efforts will likely continue, but Andersen-Röed believes his team’s efforts to make the industry safer will prevail in the long run. Collaboration and outreach remain an integral part of the exchange’s efforts to weed out nefarious players.