Threat of real violence for virtual currencies

The currency they were after was virtual, but the guns they carried were anything but. In the beach resort of Phuket, Thailand, last month, the assailants pushed their victim, a young Russian man, into his apartment and kept him there, blindfolded, until he logged onto his computer and transferred about $100,000 worth of bitcoin to an online wallet they controlled.

A few weeks before that, the head of a bitcoin exchange in Ukraine was taken hostage and only released after the company paid a ransom of $1 million in bitcoin. In New York City, a man was held captive by a friend until he transferred over $1.8 million worth of Ether, a virtual currency second in value only to bitcoin.

The rich have always feared robbery and extortion. Now, big holders of bitcoin and its brethren have become alluring marks for criminals, especially since the prices of virtual currencies entered the stratosphere last year.

Virtual currencies can be easily transferred to an anonymous address set up by a criminal. While banks can stop or reverse large electronic transactions made under duress, there is no bitcoin bank to halt or take back a transfer, making the chances of a successful armed holdup frighteningly enticing.

Thieves have taken advantage of this system in a startling number of recent cases, from Russia, Ukraine and Turkey to Canada, the United States and Britain. "This is now becoming more pervasive and touching more law enforcement divisions that deal with organised crime and violent crime on a local level," said Jonathan Levin, founder of Chainalysis, which has worked with several law enforcement agencies on virtual currency crimes.

Levin's company specialises in tracking criminal transactions on the blockchain, the computerised ledger where every bitcoin transaction is publicly recorded. Chainalysis has helped police attempt to track down criminals in several recent cases, including some that have not been made public, according to Levin.

But even when a transaction can be tracked, the design of bitcoin means that criminals do not have to associate their identity with their bitcoin address - as is necessary with most traditional bank accounts. That has stymied police in several cases.

"For this, the advantage of bitcoin is that it's hard to verify," said Chanut Hongsitthichaikul, an investigator with the Chalong Police Station, which investigated the case in Phuket. "We asked the victim how to track it since they know bitcoin better than us. We asked them how to check the receiver. They said there is no way. It is hard to do." Thai police tracked the victim's laptop, which was also stolen, to Kuala Lumpur. That's where the trail went cold.

While the recent crime wave has brought a new level of violence, virtual currency holders have been targets for several years. Criminals have been staging a long-running campaign to remotely hijack the cellphone numbers of prominent virtual currency holders in order to gain control of their digital wallets.

A few years ago, some of bitcoin's earliest proponents had SWAT teams called to their homes by people who demanded big bitcoin payments to stop the harassment - a tactic called "SWATing" in some online communities.

There have also been many documented holdups around the world at in-person meetings where people were looking to convert cash into virtual currency, including one last year in Palm Beach, Florida, where the thief made off with $28,000 before being arrested.

But criminals have grown much more brazen as the price of bitcoin has spiked.

The most audacious attack hit Exmo, the virtual currency exchange in Ukraine. The chief executive of the exchange, Pavel Lerner, was abducted the day after Christmas and freed a few days later after the company made a ransom payment of bitcoin worth around $1 million. A spokeswoman for Exmo said the money came from Lerner's personal funds. Lerner was on leave from the company but would return.

A month earlier, a Turkish businessman was forced to hand over the passwords to his virtual currency wallets - containing nearly $3 million worth of bitcoin - after having his car stopped by an armed gang in Istanbul that appeared to know about his bitcoin holdings, according to local news reports.

Many big virtual currency holders privately say they will no longer travel to Russia, Turkey or other countries where they assume that attacks may be easier to pull off because of organised crime.

But armed attackers have also hit a Canadian bitcoin exchange in Ottawa, the Ether investor in New York City and a prominent virtual currency trader living near Oxford, England.

In a number of cases, the assailants have been caught - and been forced to return the money - because of video footage. But in other cases, the criminals are still at large. The unsolved crimes have sown fear among the ranks of the so-called crypto rich, which have grown considerably over the past year.

Proactive confrontation

Most of the crypto rich are loath to speak publicly about the risk of physical attacks, for fear of making themselves targets.

But Jameson Lopp, a longtime bitcoin engineer and virtual currency holder, said the community should be proactive in confronting the threat, to let criminals know that people are taking steps to protect themselves.

Last summer, someone called a SWAT team to Lopp's house to harass him. Since then, Lopp has installed closed-circuit cameras around his property and posted photos on Twitter of the automatic weapon he has at home.

In a more technical defensive measure, Lopp has long kept his virtual currency holdings in so-called multisignature wallets created by the company he works for, BitGo. These wallets require multiple people to sign off on a transaction before the money can move.

Lopp will go even further later this year when he, his girlfriend and his dog move to a new home. He plans to "go dark" - not providing the address to anyone and using a post office box for deliveries. But he said even that will not fully banish his concerns.

"If you are rich and you own real estate, or stocks or a sports team, somebody can't mug you and take your sports team away," he said. "Having liquid crypto assets makes you much more attractive for that type of criminal attack."

Levin said programmers are working to develop methods of signing virtual currency transactions that can quietly alert authorities that a transaction is being made under duress - something like the hidden button under the bank teller's desk.

But he said the most obvious way to thwart attackers is with wallets that require multiple signatures, and with less public discussion about owning virtual currencies.

Lopp said it is important to publicise the many ways in which virtual currency holders can fend off assailants so that criminals reconsider the likelihood of a successful attack. "We're in the very early days of this becoming a problem," Lopp said. "The attackers are still trying to figure out what the risk-reward really is."