BlockAML | How Crypto‑Related Crime Is Actually Prosecuted - Michael Halepas | Common S3nse - 2026

[music] Right. Thank you everyone for joining us in this last panel uh this last presentation of the first day. My name is Michael Halipass. Feel free to follow me on LinkedIn. I am a barristister uh based in London at present.

I am the founder of Block AML. I was formerly the lead digital assets prosecutor in an offshore jurisdiction. Uh I currently consult including for the Council of Europe on uh crypto law enforcement you could say advising public authorities internationally on strategy and policy. Also a trainer with the City of London Police Economic and Cyber Crime Academy. I am I am a crypto native you could say.

I'm not a developer. Um, I've proven myself to be a terrible NFT speculative investor. Um, but I really I really really do believe in the uh potential of this transformative technology to improve the lives of uh millions of people around the world. So I am on your side but I I understand that um there's a balance that will have to be struck in terms of privacy but but I'll come on to that. What what worries me as a practitioner um is is not just the scale um of the criminality of the illicit activity on the blockchains, but it's the professionalization.

Um we now have Chinese money laundering networks uh that processed well over 16 billion last year alone with nearly 1,800 active wallets. So in my view that is not individual criminality. That is industrial uh infrastructure. And before I move on through the slides, what I'd like to say is that uh I I only have a short time. None of this is financial advice and none of this is legal advice.

Uh I am I'm qualified and trained uh in England and Wales. Uh I do some work internationally, but I'm not I've certainly not been called to the Dutch bar. So it's not legal advice. But I just want to sh some ideas and to help identify some of the types of evidence and legal questions that can arise in crypto related investigations and proceedings. Um this what you will see is a is a comparative caseled discussion.

I'm going to touch on four different cases none of which I had a hand in. So all of the information that you see on screen is not privileged. It's taken from public sources. Just lastly on the on this slide, what I want to have you keep in mind is that um the label of the protocol or the software is not determinative um of what it is. Um the practical one of the practical questions is um whether identifiable people um operate control sufficiently uh influence um relevant activity.

So let's move on. Again I'm not going to tell you I'm not going to go into the most in-depth law enforcement presentation ever just to give some of you an idea assuming that that there aren't many law enforcement officers in the room. Um we agree that digital assets are simply another asset class. Um the key concept when it comes to uh dishonesty offenses, money laundering, fraud, uh scams, hacking is the is the mental element is is of dishonesty. When it comes to uh enforcement officers um law enforcement officers um conducting searches of individuals of vehicles of home addresses there's a non-exhaustive list of the types bless you of the types of items that they they will look for to try and find evidence of wrongdoing, evidence of suspicion or knowledge of dishonesty.

The first item on that list is um a newly new term. It's a new term that was brought in by legislation in in England and Wales. Uh the Economic Crime and Corporate Transparency Act 2023. Crypto asset related item is purposefully given a wide definition. That is, as the statute defines it, an item of property that is or that contains or gives access to information that is likely to assist in the seizure of any crypto asset.

In other words, um, a crypto asset related item could be a piece of paper with a seed phrase on it. Uh, it it doesn't have to be a wallet, per se, but unsurprisingly, investigators, if they can identify that the suspect has used crypto, they will seek to identify the wallet, conduct blockchain tracing. Obviously, obviously a pseudonymous wallet address cannot be a suspect in a criminal case and enforcement law enforcement seek to identify with reasonable certainty who is controlling who is the person or persons controlling uh those funds. They will officers will typically look through electronic devices, communications, uh governance records, marketing. remember that one.

As I said earlier, evidence of dishonesty. Let's move on. Okay. And and I'm I'm absolutely sure that people in this room know very well what blockchain can show and what it can't show. Remember that we are so early in this space that this technology is still like speaking French to some people.

Um when I speak to detectives, other law enforcement officers, one of the key points to get across to them is that Blockchains can tell you what's going on inside the blockchain, but it can't tell you what's going on outside of the blockchain. There is very valuable material that can be garnered from blockchain uh transactions much more than you can with say a hold of cash. So there are benefits to to to law enforcement. At the same time, obviously just because we have the blockchain transaction evidence, just because we have the wallet address identified, that's not where the investigation stops. The job of the prosecutor, if I put the prosecution hat on, is to identify, as I said earlier, with reasonable certainty.

Who is the person controlling uh the wallet? What is the level of their control? What is their mental state? What's their knowledge? What is their purpose of the activity?

These are all ideas that we have to keep in mind when we're investigating, when we're building a case. Now, once you get to court, it's not as straightforward as simply telling the court that somebody is guilty or that funds in a case constitute criminal property. That is tainted property. My defense hat on having defended as well. Um, every piece of evidence can be challenged if there are weaknesses with the attribution for example or the police methods in uh the um the evidence.

Um a a ch analysis chart for example might look authoritative uh but it may involve assumptions about wallet clustering uh transaction patterns exposure tracing. Um When we present a case in court, um the methodology um should be transparent enough to be explained to a courtroom and to be tested by the other side. Um provenence where where did the digital material come from? Uh can its origin be demonstrated? Um completeness, what are we missing in the evidence?

Um um does the material give a balanced and sufficiently complete picture uh including evidence that may weaken or or or qualify the proposed case theory? I think you get the picture here. Um but these are some of the ideas, some of the challenges with presenting evidence uh of fact in court. Take you over to England now. I'm going to move away from the criminal realm going to move to the civil uh civil realm.

I'll give you an examp two cases as examples. So just for those who aren't um English lawyers uh in the criminal court the standard the standard of proof is uh used to be called beyond reasonable doubt. Now we tell juries that they must be sure of the defendant's guilt. That's a really high bar. Sometimes um sometimes we simply don't have the evidence to that level that we could we can pursue a criminal prosecution.

But uh we so again prosecution we might um assert that funds in an account, funds in a wallet, funds in a VASP or CASP um constitute tainted funds. We don't have the evidence that we can prove to a jury so that they are sure of the um illicit nature of the funds. There are means by which um the enforcement um agency can uh use civil recovery powers. So whenever a we go down the civil route in court uh the standard of proof is on the balance of probabilities. In other words, which side is uh more likely than not to be correct?

That changes the game. That lowers the bar, but it means that from a civil enforcement side, uh we can we can still pursue um the funds that we say are tainted, right? Um so again sticking with um the English courts um there is a very useful case um the director of public prosecutions against Okconor and others from 2025. Now why have I included this one? Because this included mixes um this uh I find it as a useful example.

The background uh to the offenses was the hacking of computer systems uh in a Manhattanbased uh exchange. Um at the time of the uh final hearing, you can see the uh the fund the crypto held amounted to 4.14 million pounds worth. Um police traced uh the movement of funds into uh Coinbase and Binance account in one of the defendants names. So they could see the funds moving from mixes into um Binance and Coinbase.

Um but as it won't surprise anyone in this room, they couldn't find the origin of the funds that had moved to the mixer. So um in other words, they were unable to say um well they they were unable to say where where the funds had had come from to the criminal standard. So case would never get off the ground. Again, I'm not involved in this case, but using what's publicly available. Um, as with all cases, and again, I'm reminding you, just because we have a blockchain transaction, that is not indicative of guilt.

Um, the claimant, in this case, the director of public prosecutions had to present to the court uh the evidence, the circumstantial evidence that built a picture for the court um that the funds funds in the Coinbase and the Binance accounts were um unlawful um and that they could be um uh could be, excuse me, could be recovered. Um, circumstantial evidence might include a lack of explanation as to where the funds came from, a lack of evidence of any legitimate income. All of these uh types of evidence go to build a picture. Um, and that was one of the examples. Again, sticking with English civil recovery, um to apply for a a crypto property freezing order requires the claimant to um establish that they have a good arguable case that the asset is recoverable property.

There's a case you can see I referred it to there um brightest I suppose it's pronounced from 2021 and the significance of that case is that um it was established that digital assets crypto are property within the um the definition in the process of crime at England and Wales it's quite important and credit where it's due in my view the English courts over the last five or six have really really led the way in using common law to show that digital assets as intangible as they are can be capable of being held trust can be capable of being stolen. So now we have comfortably when they say moved on from this is magic internet money. If it's intangible it can't be property. We understand now and increasingly jurisdictions around the globe are ticking the box to satisfy that they recognize that digital assets are capable of constituting property. If the asset is capable of constituting property then these statutes bite because if it's not property criminal.

So uh what we found is that the civil recovery powers are often being used where criminal proceedings um are are lacking. um in excuse me uh one of the one of the um comments that was made in in in this particular case was that if digital assets were not treated as property that was capable of being recovered that would create a really serious luna real serious gap in legislation now and I appreciate many of you won't have read the process of crime act um but the introductory text and I'll read an excerpt from that says that [clears throat] the legislation is to allow for the recovery of property which is or represents property obtained through unlawful conduct or which is intended to be used in unlawful conduct. So again an example that net is closing in this asset class that we all want to go mainstream is is gradually going mainstream and it is being treated as just another asset. All right, let's go over to Europe. Now you're familiar with Mika um the um European Banking Authority and the European Securities and Markets Authority published the joint report January of last year following on from MA reviewing um developments in in the cryptosphere if you will and analyzing DeFi, crypto lending, borrowing and staking.

So what am I saying to you? The the eyes of the regulators are very firmly on DeFi. they weren't before this report and if you'd like a copy of it, please let me know afterwards. I'm happy to send it over. Um, fairly interesting publication this one.

Um, I think key points are that DeFi is an industry term. Defi as far as Europe is concerned. Defi has not been defined centralized finance. So be mindful of that please. Um, I think from the conversations I've had and this is not the view of the council.

These are the conversations I have had over the years. NFTs and DeFi are dirty words. If I may say that there's there seems to be a view, a general view that decentralized finance is only for bad actors. I know that's not the case. And when I have law enforcement officers in front of me, I I amplify that message.

I just want to make clear I'm not here to round up all the DeFi developers and arrest them. Um let's go to mika. So ma uh can apply where relevant services are performed, provided or controlled directly or indirectly by identifiable people. Um services provided fully decentralized without an intermediary should not fall within ma. For the developers in the room, please uh be mindful of that.

And again, ma does not define fully decentralized So back to my previous point, it's actually an industry label. It's not a statutory term. Okay. Right. Just lastly on that paper by the EPA and ESMA, they make a number of recommendations in there.

I'm not going to speak to the merits, the advantages or disadvantages, but lifted three of them. So what ESMA is recommending is for developers for D5 platforms um is um introducing what they call disaster recovery in and incident response mechanisms um to provide early responses to disaster events. That's one of their suggestions. Another suggestion is onchain monitoring and identity verification. So placing the emphasis on the D5 protocol to uh explore the use of blockchain analytics software to track and analyze transactions uh to to detect suspicious activity.

I'm sure that's probably not hearing don't shoot the messenger. Um one of the other recommendations is real time supervisory monitoring of D5 protocols based on public data also known as embedded supervision. I think that document's worth a read. velopers. If you'd like a copy, let me know.

Right, let's move over to the states. Excuse me. That question. Hi. Not one of the.

Oh, I see. No. Yes. Yes. So um all all of the major text financial action task force and so on um just because something's called an NFT say doesn't mean that it's an NFT.

So what these uh guides say is what does it actually do? Is it with an NFT? Is it used for payment services that would suggest that it's a cryptocurrency rather than an NFT? But just be mindful that um the label is not the end of it. Okay.

in practice what what is it doing dayto-day not legal advice this is not financial advice thank you all right tornado cash okay so um again I said this is um give you some ideas using some some some cases okay you will know you will know what happened to tornado cash you know that of placed tornado cash on it um specially designated nationals and block persons list um that listing named only a decentralized application and approximately 40 associated addresses. The retrial of Roman Sterlingov has been rescheduled to April 2027. We know that he wrote the code and published information on the internet. Other people are using his code. Now, the criminal case concerned uh his conduct uh control, facilitation, knowledge, and intent not simply the existence of the code.

I'm not here to talk about the criminal case against him. What I'm highlighting is something which I think is quite profound. Uh when tornado cash was um sanctioned um the um invol the protocols invol alleged involvement with Lazarus group was cited. Now um the theory was that the immutable self-executing smart contracts on Ethereum could constitute property subject to blocking and that tornado cash not a person tornado cash or or the contracts um qualified as a person or entity um under that statute. Now [clears throat] quite worrying I would have thought for for for developers there but as you probably know in March 2025 uh following appellet court ruling OFAC removed tornado cash from the sanctions listing the court held that immutable smart contracts comprising tornado cash could not be classified as property because they lack the hallmarks of ownership control and exclusivity.

The um the decision preserves a distinction between offering a service on the one hand and creating a tool on the other. Um that's why I say it's a profound statement. It says that to me it says that the uh the traditional tool of sanctions uh has structural limits when the instrument is decentralized and immutable. So um in my view tornado cashache demonstrates why it's necessary to keep the category separate and uh the legal status of immutable code for sanctions purposes is clearly not the same question as the criminal liability of people alleged to have operated control facilitated a service. So we shall watch how that one develops right over to Samurai Wallet.

Again no doubt you're familiar with this one. This is slightly different. Uh this uh this concerns two defendants who eventually conspiracy to operate a license money transmitting business. Now again publicly available documents uh will will tell you all of this. Um but and in particular the US government sentencing memorandum was a great source of information for this.

Um the the important issue here is not that Samurai offered privacy functionality. The the issue is what the defendants were doing. Um so between 2015 and 2024 the defendants Rodriguez and Hill developed, marketed, controlled, and operated Sam samurai. Um between 2015 and 2021, neither of those defendants filed any US tax returns. uh neither did they declare any of their income from samurai.

So that was that was an issue. Um but here the the uh prosecution looked at online at their tweets at their marketing material. Again, none of this is legal advice, but if I can ask you perhaps to think what you would advise them if you were their defense representatives, that might help because it's not the case that it's simply we set up uh software and we're being pursued for the software. I mean again this is this is not legal advice. This is taken from from open source material but um the legal issues concern what what the purpose knowledge and operation was.

You can see I've put two uh screen grabs here. Um the um where are we? You can see right that's it. So um this would be really worrying if I was representing these gentlemen and that these chaps uh posted promoting their services money that would be a great concern to me. Remember we said earlier about the mental element being key for dishonesty offenses.

Well, with with a fraud case, uh with many types of dishonesty cases, it don't have to be touching crypto. Where there is evidence that we can build a package, an evidential package to present to a court to say, look at these person's communications, their marketing, it is dishonest, prosecution will be expected to do so. And again, I didn't sit in on their trial, but um just it's just a plethora of um marketing material that it was useful to the prosecution here. Uh this one um was this one here is uh a 16th of July 2020 tweet after a third party had encouraged the uh lovely hackers of a social media company to use Samurai Wallet to mix uh once they're done taking profits. Uh one of the defendants responded by personally encouraging the hackers uh to send crime proceeds into their world pool.

Moving on. Again, this is this is more of the Samurai wallet marketing material. So if you developers are putting out any marketing material, please just think about just think about concept of dishonesty and how that will look. So I've got left and right here. So these are separate marketing materials on the left.

You can see I have highlighted one of the one of the offers by the samurai wallet operators that premium service for illicit activity on the on the on the I mean that's clearly did not help their defense did it? on the right hand side um there's a there's an invitation to Russian oligarch samurai wallet uh users to help circumvent sanctions. Again, this is not legal opinion. I'm just presenting to you some of the marketing material these developers had out there in the internet and why perhaps is not a surprise that they were prosecuted for dishonesty offenses. So, please if you're in this room again, this isn't please.

Um let's move. So gentlemen in the room gentlemen um some of the key questions I think for developers uh to ask themselves uh concern um control knowledge of what's going on. Right? So once we get to court um who controlled what what their knowledge was uh and what the evidence is are really really important when we get into court. Now I I understand that developers will continue to push the boundaries.

In fact, the boundaries are still being written. So it's a really exciting time to be alive and I know that you want to build things that add value to this world. I think the industry needs to find solutions that work and I hope that we can do that without arresting the developers. Um I think that a balance needs to be struck which does not stifle innovation. My hope my hope is that um we will see increased collaboration between public and private and my concern my My belief is we can do this without thank you for your time.

Uh I'll be here tomorrow. If anyone would like to discuss if you have any questions, please feel free to fire away. No takers questions? No. Hi It's a really really interesting question, isn't it?

It's uh reminds me the question about some of the centralized stable coin providers with the secondary markets. There's a discussion about to what extent they should be liable for people with an Ethereum. Um but uh yes, look, the point is if it's purely immutable like tornado cash, nobody can stop it. Nobody owns it. It's not like um the uh it's not like the vending machine analogy.

Vending machine has an owner. If it's a mutable contract that just runs, it doesn't have an owner. And that's what they they they specified in tornado cache. So, I mean, much like you wouldn't advise anyone to um market any of their businesses, any of their services as helping Russian oligarchs to avoid sanctions. You would say the same with this.

I I know I know that one of the major benefits of digital assets is uh privacy immutable transfers across the across the globe uh without the requirement for a third party intermediary. The the explosion in the stable coins is no surprise. None of it. But if we want this technology to go mainstream and it probably will become trady eventually transparency of transparency and there will have to be a balance st on a last comment on a Friday evening is don't it's probably best advised not to promote any services to strangers that help them illicit gates probably.

Yeah. Yeah. Of course it can. Of course it can. But then where is the responsibility?

I think what I didn't touch on is with um if you don't mind I'll go back to stablecoin circle tether where they have the blacklisting function or the freeze function right there are legitimate uh privacy concerns there because how do we stop overreach you know today a wallet might be frozen and then tomorrow they've decided that they they're going to unfreeze it. What I'm interested in over the next five years, say, is to see what the market moves to, what the market decides is acceptable in terms of um the freeze functions of the the assets that they use. Really really interested to see that. Um and I I also wonder what pressure there will be on um developers to for example I'm not but for example to limit the uh asset types permissible on their platforms um to to help with the law enforcement effort. It's it's really interesting.

Really interesting. And uh or I think so. Um but you know, watch this space. I don't envy developers. You do great work.

Really do great work. But I don't envy you right now. Good luck with it. Thank you.