Follow the money: The relationship between currency exchange and illicit behaviour in an underground forum

Gilberto Atondo Siu*, Ben Collier, Alice Hutchings

*Corresponding author for this work

Research output: Contribution to conferencePaperpeer-review

Abstract / Description of output

Underground forums are used to discuss and organise cybercrime (as well as more conventional social activities). These forums are also commonly used for exchanging various digital currencies, either gained through the profits of crime or through less controversial means. Understanding the link between discussions of illicit behaviour and currency exchange can provide insights to identify money laundering and other parts of the cybercrime supply chain. In this paper we use natural language processing to classify posts from HackForums by crime type over a period of more than 10 years. To the best of our knowledge, this is the first time that this type of classification has been used for this large forum dataset. Although the majority of conversations in the forum were identified as relating to non-criminal discussions, we concentrate on the types of crimes being discussed by those exchanging currencies. We find the most popular topics are related to trading credentials and bots and malware. PayPal was one of the most widely advertised digital currencies and we observe significant displacement from Liberty Reserve to Bitcoin after the former was taken down in 2013. Rather than an explicit ‘cashing out’ mechanism, in which cryptocurrencies gained through crime flow into state-backed fiat currencies, we instead see a circulation of capital between different forms, as cash is held and then cashed back and forward according to movements in the wider currency market. We continue our examination of discussions of cryptocurrencies and explore how the underground market has reacted to new opportunities, with a qualitative case study about Facebook’s putative ‘Diem’ coin. We find that while most discussions are related to the technical details and potential investment opportunities, some potential cybercrime use-cases are raised.
Original languageEnglish
Number of pages11
Publication statusAccepted/In press - 2 Jul 2021
EventWorkshop on Actors and Cyber-Crime Operations (IEEE European Symposium on Security and Privacy 2021) -
Duration: 7 Sept 20217 Sept 2021
https://wacco-workshop.org

Conference

ConferenceWorkshop on Actors and Cyber-Crime Operations (IEEE European Symposium on Security and Privacy 2021)
Abbreviated titleWACCO
Period7/09/217/09/21
Internet address

Fingerprint

Dive into the research topics of 'Follow the money: The relationship between currency exchange and illicit behaviour in an underground forum'. Together they form a unique fingerprint.

Cite this