May 25, 2013

The founder of Liberty Reserve, a digital currency that has evolved as perhaps the most popular form of payment in the cybercrime underground, was reportedly arrested in Spain this week on suspicion of money laundering. News of the law enforcement action may help explain an ongoing three-day outage at libertyreserve.com: On Friday, the domain registration records for that site and for several other digital currency exchanges began pointing to Shadowserver.org, a volunteer organization dedicated to combating global computer crime.

lriconAccording to separate reports in The Tico Times and La Nacion, two Costa Rican daily newspapers, police in Spain arrested Arthur Budovsky Belanchuk, 39, as part of a money laundering investigation jointly run by authorities in New York and Costa Rica.

Update, May 28, 9:11 a.m. ET: Libertyreserve.com is now resolving again, but its homepage has been replaced by a notice saying “THIS DOMAIN NAME HAS BEEN SEIZED,” and features badges from the U.S. Treasury Dept., U.S. Secret Service, and the DHS.

Original story:

The papers cited Costa Rican prosecutor José Pablo González saying that Budovsky, a Costa Rican citizen of Ukrainian origin, has been under investigation since 2011 for money laundering using Liberty Reserve, a company he created in Costa Rica. “Local investigations began after a request from a prosecutor’s office in New York,” Tico Times reporter L. Arias wrote. “On Friday, San José prosecutors conducted raids in Budovsky’s house and offices in Escazá, Santa Ana, southwest of San José, and in the province of Heredia, north of the capital. Budovsky’s businesses in Costa Rica apparently were financed by using money from child pornography websites and drug trafficking.”

For those Spanish-speaking readers out there, Gonzalez can be seen announcing the raids in a news conference documented in this youtube.com video (the subtitles option for English do a decent job of translation as well).

Liberty Reserve is a largely unregulated money transfer business that allows customers to open accounts using little more than a valid email address, and this relative anonymity has attracted a huge number of customers from underground economies, particularly cybercrime.

In a now 10-page thread on this crime forum, many members are facing steep losses.

In a now 10-page thread on this crime forum, many members are facing steep losses.

The trouble started on Thursday, when libertyreserve.com inexplicably went offline. The outage set off increasingly anxious discussions on several major cybercrime forums online, as many that work and ply their trade in malicious software and banking fraud found themselves unable to access their funds. For example, a bulletproof hosting provider on Darkode.com known as “off-sho.re” (a hacker profiled in this blog last week) said he stood to lose $25,000, and that the Liberty Reserve shutdown “could be the most massive ownage in the history of e-currency.”

That concern turned to dread for some after it became apparent that this was no ordinary outage. On Friday, the domain name servers for Libertyreserve.com were changed and pointed to ns1.sinkhole.shadowserver.org and ns2.sinkhole.shadowserver.org. Shadowserver is an all-volunteer nonprofit organization that works to help Internet service providers and hosting firms eradicate malware infections and botnets located on their servers.

In computer security lexicon, a sinkhole is basically a way of redirecting malicious Internet traffic so that it can be captured and analyzed by experts and/or law enforcement officials. In its 2011 takedown of the Coreflood botnet, for example, the U.S. Justice Department relied on sinkholes maintained by the nonprofit Internet Systems Consortium (ISC). Sinkholes are most often used to seize control of botnets, by interrupting the DNS names the botnet is programmed to use. Ironically, as of this writing Shadowserver.org is not resolving, possibly because the Web site is under a botnet attack (hackers from at least one forum threatened to attack Shadowserver.org in retaliation for losing access to their funds).

Reached via Twitter, a representative from Shadowserver declined to comment on the outage or about Liberty Reserve, saying “We are not able to provide public comment at this time.” I could find no official statement from the U.S. Justice Department on this matter either.

Libertyreserve.com is not the only virtual currency exchange that has been redirected to Shadowserver’s DNS servers. According to passive DNS data collected by the ISC, at least five digital currency exchanges —milenia-finance.comasianagold.comexchangezone.commoneycentralmarket.com and swiftexchanger.com — also went offline this week, their DNS records changed to the same sinkhole entries at shadowserver.org.

Assuming the reports at The Tico Times and El Nacion are accurate, this would not be the first time Mr. Budovsky has attracted attention from authorities for money laundering. According to the Justice Department, on July 27, 2006, Arthur Budovsky and a man named Vladimir Kats were indicted by the state of New York on charges of operating an illegal money transmittal business, GoldAge Inc., from their Brooklyn apartments. From a Justice Department account of that case:

“The defendants had transmitted at least $30 million to digital currency accounts worldwide since beginning operations in 2002. The digital currency exchanger, GoldAge, received and transmitted $4 million between January 1, 2006, and June 30, 2006, as part of the money laundering scheme. Customers opened online GoldAge accounts with limited documentation of identity, then GoldAge purchased digital gold currency through those accounts; the defendants’ fees sometimes exceeded $100,000. Customers could choose their method of payment to GoldAge: wire remittances, cash deposits, postal money orders, or checks. Finally, the customers could withdraw the money by requesting wire transfers to accounts anywhere in the world or by having checks sent to any identified individual.”

From the U.S. government’s description, Liberty Reserve sounds virtually indistinguishable from GoldAge, except for having been based in Costa Rica. If Liberty Reseve stays offline, this could cause a major upheaval in the cybercrime economy. I will be following this case closely, and would expect to hear more about this apparently coordinated takedown following the Memorial Day holiday in the U.S. on Monday.

For now, however, many in the underground would rather believe almost any other explanation than a law enforcement takedown. The administrator of cybercrime forum Carder.pro, for example, has been telling forum members that the entire incident is the work of professional hackers working for Liberty Reserve’s competitors.

Carder.pro administrator "Ninja" isn't buying the news being reported by Costa Rican media.

Carder.pro administrator “Ninja” isn’t buying the news being reported by Costa Rican media.

Update, May 26, 10:45 p.m. ET: A competitor to Liberty Reserve, a virtual currency called Perfect Money, on Saturday posted a note to its site saying it would no longer accept new registrations from individuals or companies based in the United States. “We bring to your attention that due to changes in our policy we forbid new registrations from individuals or companies based in the United States of America. This includes US citizens residing overseas,” the company wrote. “If you fall under the above mentioned category or a US resident, please do not register an account with us. We apologize for any inconvenience caused.”

Update, May 28, 1:26 p.m., ET: I just filed a follow-up story which confirms that libertyreseve.com and other exchangers were seized by the U.S. government. The story also examines the impact of this law enforcement action on other digital currencies, including Bitcoin.


416 thoughts on “Reports: Liberty Reserve Founder Arrested, Site Shuttered

  1. Translator

    If interested, here is the Google translation for the Korean comment posted May 28, 2013 at 8:01 am:

    1) Liberty Reserve web site of the world’s sudden closure has baffled many people.

    2) Press the number of illegal activities, such as iteotdamyeon several years ago through the passage should have been aware of the world they will each user.

    3) a significant cyber electronic financial transactions during the period have been used as a model site, as shown in the press that it was a hotbed of financial crime is absurd according to.

    4) the closure of a site other than the site of the legitimate institutional fit of electronic banking through the good of the world to protect the user’s point of view first, and leave the investigation is to be carried out.

    5) The closure of the site terminated a criminal offense is a means of building another crime. Role in helping the authorities and the offender does not matter will be considered from a different angle is World of global economic activity, such as the protection of international investment protection measures are required.

  2. Gone4GooD

    LR won’t be coming back you retards. Go check the LR site now, it’s officially SEIZED by the US fucking government.

    Oh well, time to move on, people.

    Nothing is going to bring it back.

  3. Lemans

    And what about innocent member balance in all over the world ???

  4. Tiger

    Good news really. I hope … Payza and Moneybookers … would be the following …. in nearest time …i hope. I ask all governments and states all over the world to have more hard control and inquisition over ” Swindel Money Institutions” .

  5. Nice1

    wankers, it all worked out as u want now we all can use their perfectmoney. not allowing their citizen to participate in anything to do with it that is why boys always snick, same perfect money will serve same purpose.

  6. Doug

    Hey man, what about my money??? Are we getting it back???

    1. Offshore

      Of course not. Cops don´t give money or drugs back when they seize a stash house

  7. Nice1

    maybe not WIN did you really think people are dumb, you can put whatever u want through the media and so on bullshit works. now my only source of living is through survey programs offered through lr and so on and i funded it with 200 last week to upgrade my account status. by this time next month i would of have something in my pocket enough to live peacefully.

    1. Harry Johnston

      I’m afraid you wouldn’t have gotten your money back even if LR had stayed open, because the “survey programs” you’re talking about were probably scams anyway.

  8. Nick P

    It probably will cause upheaval. I think the impact on the underground is overstated, though, based on previous articles from this site. The main payment methods in underground have long been Western Union and Liberty Reserve. Western Union will still be around to move the cash by the thousands. There will still be crooked operators and patsies to receive the cash on behalf of crooks. Life will go on for the crooks.

    Of course, much like in stock market, those who diversified their income sources and methods will be least effected by these events.

  9. jah

    oh my god….I just deposit $1000 into LR on friday afternoon and then it vanished at evening ….ohhh poor me…god…

  10. poor

    the whole world are your slaves and your are the master.

  11. chris affandi

    I don’t need to write a big story about all this but one question that i think nobody ask themselves…

    why the goverment needs to know our business and why cant we know his…???

    as I can see we are always victim of the system no matter what if someone could answer I will kill myself

  12. chris affandi

    we must trust their words and we as citizens need to show facts…

    remember one thing…thieves removed a screw from jesus to reduce his pain…while everyone was cryin and doin nothin…

  13. Vadim Takser

    Accessory to a crime. An accessory is distinguished from an accomplice, who normally is present at the crime and participates in some way. An accessory must generally have knowledge that a crime is being, or will be committed. A person with such knowledge may become an accessory by helping or encouraging the criminal in some way, or simply by failing to report the crime to proper authority. The assistance to the criminal may be of any type, including emotional or financial assistance as well as physical assistance or concealment.

  14. Jeffrey Lyon

    Agreed, crime is bad but the government must be careful not to overreach. The entire basis for U.S. jurisdiction in this case is that 200,000 users out of 1mm+ were located in the U.S. The suspects were not citizens and were not in the U.S.

    Accordingly, this case should belong to the Costa Rican authorities and we should not be seeing seizure warrants for assets all over the world, not for domains (read: not property), and certainly not for ccTLD domains.

    Above all else, this case should have been handled in a manner that would protect those not directly indicted. In similar cases, the accused are indicted and the company is placed into receivership.

    Overall I am quite disappointed at the government’s handling of this case.

  15. Dr.Egg

    How should they have handled it? By the time the case falls apart like the megadownload case, its too late. A new bunch of electronic-currency companies will have popped up and the whole game continues. The Ukrainians will leave jail and learn their lesson: pay lobbyists, donate to parties and all will be good. If you dont, we close you down!

    1. gbenga

      Dr Egg,
      The question you should ask yourself is “who is handling what” A criminal is given the chance to handle crime case…..how will a criminal reflect justice in a crime case?

      US Govt is not in any way better than LR when it comes crime related issues.
      If they think they have power, let them stand on their own for one year and see where their power can take them. God will punish every money launders and evil perpetrators that has stolen from innocent US citizen.
      Let it be known to everybody today that as powerful as our US Govt think they are, they still cannot stop any natural disaster befalling human….hurricane …….cyclone…….Earthquake………volcanic eruption and volcanic ash……tornado…..e.t.c Are natural way God shows his power over us.

  16. gbenga

    Why should they feel they are the best in handling every situation every time?

    Laundering should be blamed on govt and stupid individuals who never have the second thought before excising their selfish interest.

    This is not about LR at all because they are not the cause of civil unrest going on around the world. This is all about display of power. LR is not the reason for court case bwt APPLE and SAMSUNG KOREA

    Just weeks after the launch of Samsung’s latest Galaxy S4 flagship smartphone, FOSS Patents reports that Apple is seeking to add the device to a patent lawsuit already underway against Samsung in the United States.
    US has been trained never to allow others to flourish even on their own land.
    They always make people look stupid. Especially those that cannot reason and see beyond general sense.

  17. gbenga

    For those of you that still thinks US Govt has done right, it is a sorry case for you. What befell LR today might happen to anybody or any country tomorrow.
    Tuesday, May 28, 2013 was the day US Govt suddenly discovered that LibertyReserve.com was not Licensed to transmit money electronically worldwide.
    This same LR money transfer was used in donating money to sponsor US Presidential Election.
    Suddenly LR became illegal because someone used it to transmit money illegally.
    There is going to be more arrest and more closure if this case is to be handled by Non criminals but is there any way criminal will handle a lawsuit without hypnotizing the entire public?
    We should ask the arrest major that what have they done on their part to caution LR prior to this time.
    We should ask them when exactly did they first discover that LR was Illegal “US Govt_Brian”
    We need to ask them welther they produce adequate security to US banking system.
    We need to ask a lot of questions because if your child is doing something wrong you must caution him and provide an alternative before you start a fight and impose sanctions on your child.
    This is all about US selfish interest.

  18. md esha baqer

    Liberty Reserve a ‘black-market bank’ – US Attorney

    The Liberty Reserve digital money service that was shut down laundered more than $6bn (£4bn) in criminal cash, US authorities have said.
    Police raids at the weekend in 17 countries saw Liberty Reserve’s owners and operators detained and its computer hardware seized.
    US Attorney Preet Bharara said it was the “largest international money-laundering prosecution in history”.
    US prosecutes ‘$6bn money-laundering hub’
    The Liberty Reserve digital money service that was shut down laundered more than $6bn (£4bn) in criminal cash, US authorities have said.
    Weekend police raids in 17 countries scooped up Liberty Reserve’s owners, operators and its computer hardware.
    The Department of Justice said it was the “largest international money-laundering prosecution in history”.
    Liberty had about a million users and processed more than 55 million illegal transactions, said DoJ court papers.
    Cash transfer
    The documents allege that seven people involved in running Liberty Reserve set up the digital cash service as a “criminal business venture” designed specifically to “help criminals conduct illegal transactions and launder the proceeds of their crimes”.
    The raids in the US, Spain, Costa Rica and other countries led to the arrests of five of Liberty Reserve’s principals, including its founder Arthur Budovsky.
    The service’s operators will face charges of money laundering and operation of an unlicensed money transmission system. Also arrested were many of the principal operators of exchanges that fed cash to Liberty for distribution to members of criminal gangs or as the start of the laundering process.
    The raids also garnered servers supporting the service and allowed the DoJ to seize the web domains through which the service was run.
    Behind the scenes, data traffic for the sites from regular customers was directed to a series of virtual traps, known as sinkholes, that log information about who is trying to use the service.
    In addition, it said, 45 bank accounts used by the service have been seized and action has been taken to take over the assets of 35 other sites that fed funds to Liberty Reserve for laundering.
    Some details about the scale of the Liberty Reserve operation came to light in court documents unsealed by the New York office of the DoJ, which is leading the action against the service.
    The digital money scheme run through the service was one of the world’s largest, the DoJ said, and handled $6bn over the seven years it was in operation.
    Liberty Reserve was so successful that it became a “financial hub of the cyber crime world”, whose users were involved in credit card theft, investment fraud, hacking, child pornography and drug trafficking.
    The shutdown has caused problems for legitimate users of Liberty Reserve, said Mitchell Rossetti, head of the EPay Tarjeta service that piggy-backed on LR.
    “Thousands upon thousands of LR users are not nor have been involved in illegal activities,” he said, “but now have become victims through the closure and seizure of LR.”
    “We seem to be acceptable collateral damage,” he said. “We have committed no crime and want our funds returned to us.”

  19. zgr

    fašisti zasraný, díky za reklamu pro bitcoin 😀

  20. PARTHASARATHI

    Unless other wise there came any alert regarding the site{LR}which the govt suspect to get involved in illegal activities as indicted now , its legitimate users won’t think they transfer fund through criminal site and getback.Because there is nothing suspicious about the way the accused site and other site functions.May be registration was simple as regards LR.If LR victims should bear moral responsibility for using the site which govt describes illegal,the govt also should bear the same for not issuing any kind of notification that the govt is in suspicion over the activities of the site prior to closure.Even though criminals also be alerted but can’t escape long.This would have avoided individual losses and enabled pointed accusition over cybercrime.

  21. romale

    If you are one of the people who are hoping to get access to your money because you did nothing wrong, your shit out of luck. Its like oh, I’m going to invest my money in a drug dealer who is going to give me 15% APR. What you are doing is legal, but what they are doing is not. If it was a registered financial institution you would get your money back. As is, they just freed the fuck out of your money because you were to stupid to use a real money transfer system for your legitimate business.

  22. Mukai

    i am happy US GOV have their money back unless this gov are thieves as well because since you could recover all the fund stolen through lr, why not deduct your fund from lr and return mine and so is the rest balance can be accessed by individuals because this is another theft and why must you people seize another man hard earned money, this those not make you look good because my hard earned money is in your hand i am nothing like you so my money is earned by hard working legal and i deserve access to my money.

  23. Mukai

    US Gov is this some kind of fraud programs you perform to rip off the entire world off? E-gold was were also charged with similar and Libertyreserve now, in 2025 perfectmoney will be ripe enough for them to reap.

  24. Mukai

    rather there should be donatetounitedstates.com, i will cheerfully donate monthly or weekly, why because i know it will be used wisely, there should be a decision after this we can know how Many want their money back or not. if this thread can not be manipulated.Please if you are lr user and have fund in your lr and FEEL RIPED OFF and want your money back please Reply with. Yes i want my money back. otherwise say just, NO.
    STARTING WITH ME.
    Yes i want my money back.

    1. DESMAN

      Yes, i want 100dollarptc paid my money, what can i do…after Libertyreserve closing.

Comments are closed.