Tracing Monero Transactions in Vastaamo Hack: Finnish Authorities

Finland’s National Bureau of Investigation has reportedly been tracking Monero transactions as part of an investigation into the criminal trial of Julius Aleksanteri Kivimäki. Kivimäki is accused of hacking into a private mental health firm’s database and demanding ransom payments in cryptocurrencies. New evidence has recently emerged, showing a crypto trail leading to Kivimäki’s bank account. The hacker allegedly demanded 40 Bitcoin as ransom and when it was not paid, proceeded to target individual patients.

According to Finnish police, Kivimäki received payments in Bitcoin, sent the funds to a non-compliant exchange, and exchanged them for Monero before transferring the funds to a dedicated Monero wallet. The funds were later sent to Binance, exchanged for Bitcoin again, and moved to different wallets. The local authorities have not released further details about their on-chain analysis, keeping the investigation confidential.

Monero is known for its strong privacy features, claiming to be “untraceable.” It utilizes technologies such as Ring Confidential Transactions (RingCT), ring signatures, and stealth addresses to enhance privacy. RingCT mixes users’ transactions, concealing the source of funds, while ring signatures conceal the sender’s identity by presenting them as part of a group of possible senders. Stealth addresses generate a unique address for each transaction, making it difficult to link multiple transactions to the same recipient.

In 2019, the head of France’s National Assembly’s Finance Committee proposed banning anonymous cryptocurrencies like Monero due to their ability to completely anonymize users and bypass identification procedures. The United States authorities have also shown interest in Monero, with the Internal Revenue Service offering a bounty for anyone who can track privacy coins. Previous research suggests that blockchain analysis can trace back transactions with privacy coins, including those prior to 2017.