The sale of cryptocurrency exchange accounts that have passed Know Your Customer (KYC) verification happens across a multitude of platforms, including Telegram and Discord. While one might expect a similar volume of sales to occur on dark web markets, our examination of KYC'd account sales shows this is likely not the case. Our analysis of fraudulent sales of KYC'd accounts across 300 dark web markets shows that just 4% of markets host ads for crypto related KYC services.

Background

Know Your Customer rules are one of the legal requirements that financial services providers must adhere to when selling financial services products to new customers. These regulations require customers to prove their identities – using identification documents and other personal records – so that financial institutions can better assess risk and monitor for all types of financial crimes, including fraud, money laundering, terrorism financing, and identity theft. Depending on the nature of the financial services provided, these rules can require institutions in the US and their international affiliates to:

• Collect the identities of their customers;

• Monitor their customers through periodic identity documentation updates;

• Screen customer transactions;

• Closely monitor Politically Exposed Persons (PEPs); and

• Screen their customers against sanctioned entities lists

Those who have used centralized exchanges are most likely familiar with some of these practices. However, the semi-anonymous nature and relative newness of the Web3 ecosystem have made the industry a particularly difficult one for traditional financial regulators to enforce KYC rules on. There are multiple reasons for this, including the fact that many major exchanges operate in jurisdictions with looser financial regulations than the US and the lack of international coordination around regulating these platforms.

The current regulatory environment creates opportunities for bad actors to take advantage of centralized exchanges (CEX) to launder and move funds. One method used to launder funds involves obtaining a fraudulently KYC'd account. You can read more about CertiK’s investigation into over-the-counter KYC sales here. This particular investigation focuses on the sale of fraudulent KYC sales primarily on Telegram, Discord, and other social media sites. However, we also wanted to take a deeper dive into how much of this activity takes place dark web markets.

Dark web markets are often associated with criminal services, including the sale of stolen data, credit card information, malware, hackers-for-hire, drugs, and weapons.

Analyzing KYC Sales on Dark Web Markets

It is important to note here the difficult nature of conducting research on the dark web. Research must be conducted using a special browser known as the Tor browser, or by configuring another web browser like Firefox to access the Tor network. The browser allows one to access website URLs ending with the extension .onion. These URLs change frequently and often are often left inactive when domain owners move a market’s online location for security purposes. This makes finding and maintaining access to dark web markets much complex than on the surface web. A market URL can be working today, and replaced with a scam or non-functional URL tomorrow.

We started with a database of over 300 links to dark web markets and assessed them for sales of KYC’ed accounts. Of the original 300 URLs only 182 were transcribed correctly, meaning they contained the correct number of characters in a .onion address. Of the 182 full addresses, 102 were dead links and 80 were working. Of the remaining working links, only 12 markets had advertisements related to KYC account sales or fraudulent KYC services for other money transfer platforms, such as PayPal.

Graph: Shows the number of links from our dark web market database both live and inactive.

Only 27% percent of the links in this database were live. The number of links that worked for markets where KYC’d accounts or KYC services were being sold were only 4% percent of the total.

Not only were the number of markets hosting KYC'd CEX account advertisements quite small, but the total number of ads on each platform were also minimal. The chart below shows the distribution across all markets where we found vendors selling KYC services.

Graph: The total number of KYC service ads on each market examined in this sample

A Closer Look at KYC Ads

We looked at the ads and vendors on the three most active markets by total number of ads currently listed. This includes Nemesis Market, MGM Grand Market, and the Ares Market, each of which had 10 ads or more. It should be noted that even though these markets had the highest number ads around half of the ads had broken links and appeared to be reposts from the same vendors.

Markets that contained KYC ads vary in their structure but all provide the following basic pieces of information about the vendors providing these services:

• Vendor Usernames

• Total Vendor Sales

• Total Vendor Reviews

• Vendor Ratings

• Product Price

• Product Descriptions

Image: Example advertisement for a Paxful.com KYC’ed account. Source: Ares Market

What also becomes clear when examining these ads is that the vast majority are cross-posts from the same vendors. In our examination of the big three markets mentioned above we identified six vendors with unique usernames, however, the content of these ads suggests there are only four unique actors, two of which use different usernames on different markets. We based this conclusion on the content of these ads being word-for-word exactly the same. Below is is list of these actors and their associated vendor stats for the Nemesis, MGM, and Ares markets.

Image: Actors across dark web markets with live KYC ads do not have many metrics by which to judge their activity

The vendor data we have on these actors does not provide much information for identifying or assessing the efficacy of these vendors' sales. While most vendor scores are ranked quite high out of five, there are not enough sales or reviews to truly assess the impact or overall activity of the vendors. The one exception is vendor mikedoesittoo who has over 100 sales and 37 reviews on Nemesis market. Multiple of these reviews include positive five star ratings specifically for his KYC'ed account sales, making them the most active and effective actor selling KYC’ed accounts.

Conclusion

Overall, the KYC'd CEX account market on the dark web appears to be small and likely statistically irrelevant in terms of its overall contribution to fraud in the cryptocurrency industry.

It it likely that we continue to see this activity predominate on Telegram and Discord, as these channels are already used heavily by individuals and projects in the crypto space. These social platforms are not only more readily accessible than dark web markets, but cryptocurrency enthusiasts as a whole are almost certainly more familiar with navigating these platforms from doing research on projects or connecting with project communities. While this is not to say that finding these types of markets on social media platforms is simple, their ease of use without a doubt creates greater accessibility to both fraud peddlers and enablers in these circumstances.