Bitcoin ATMs May Be Used to Launder Money
Even as crypto crashes, these machines are spreading—and they can be perfect vehicles for cleaning dirty cash.
In the hours before dawn, a team of former U.S. Army Rangers snakes its way through the streets of Manhattan to Apollo Deli & Fruit, which sits on a corner in Harlem, one block away from its namesake, the Apollo Theater. The store looks like most bodegas in New York City, but beneath an ad for Boar’s Head cold cuts is a sign that reads “Keep Calm and Buy Bitcoins Here.” And then, next to a tower of Lay’s potato chips, sits what looks like an ATM.
Three of the men, looking like plainclothes police officers, head directly to the machine. While two of them keep lookout, one uses a key to pop open the front lid, revealing a small keypad. He punches in some numbers, and the machine opens up, presenting him with a white plastic box containing several thousand dollars in cash. He puts the box into a duffel bag, places an empty one back into the slot, and within minutes the men are back in their car. By 8 a.m., the bag will hold almost $300,000: one night’s haul from more than two dozen Bitcoin ATMs, or BTMs, owned by Cottonwood Vending LLC, a New York-based operator.
The company—growing fast, full of promise—now operates 91 machines, which allow just about anyone to buy Bitcoins with cash, in New York, making it the biggest purveyor in the city. It has 13 employees and gross annual revenue exceeding $35 million—about $385,000 in cash per machine, according to court records. It’s awaiting approval from New York’s banking regulator for a BitLicense, a special permit for Bitcoin-focused companies.
Still, the nature of Cottonwood’s operations is a mystery. Its website contains almost no information beyond where to find its machines and tips on using them (“Don’t make a typo if you enter info on the touchscreen”). Cottonwood’s owner and founder, Aniello Zampella, has a LinkedIn profile that identifies him as a “freelance flame artist” (a reference to computer-generated special effects for television commercials) with no mention of Bitcoin or BTMs. Chad Russo, another founder, pleaded guilty to felony drug and gun charges in Arizona in 2009. Cottonwood did not respond to questions about Russo.
Later that morning, the former Rangers make their way to a WeWork office—a trendy co-working space normally occupied by millennial startups and e-commerce businesses—where the cash is counted and stacked along the window sills. The lead courier pays the members of his team in cash, about $400 each. Later, he’ll receive his own payment in Bitcoin.
Using ex-military to collect cash is a system adopted from the marijuana industry, which, like the world of Bitcoin, is generally barred from the banking industry. One Maryland company that operates dozens of machines in the Midwest recently advertised for an armed courier who could make two-day drives while wearing a body camera: “Combat veteran experience preferred.”
Bitcoin has crashed since hitting an all-time high last year, but the market for machines that allow people to buy Bitcoins in person hasn’t slowed down at all. BTMs are a legal and fast-growing part of the crypto world, despite flying under the regulatory radar. They’re fast and require less hassle than online exchanges such as Coinbase. Over the past few years, they’ve been popping up in corner stores, casinos, and smoke shops. There are more than 4,000 of these machines worldwide and 2,389 in the U.S. alone, with new ones installed at a rate of about five a day, according to Coin ATM Radar, a website that tracks the industry.
Almost anyone can buy a BTM for a few thousand dollars—a University of California student installed one on his Santa Barbara campus. Obtaining a federal money transmission license requires about 15 minutes on the U.S. Department of the Treasury website, and some states treat the devices as vending machines rather than money-service businesses. Owners do have to comply with banking regulations that prevent money laundering, which requires collecting information about customers. But that practice is very much theoretical, and some machines openly advertise that they flout the law. A company in Los Angeles with 17 machines tells potential customers online that they can buy Bitcoins instantly with no ID, and the transaction is “TOTALLY ANONYMOUS.” But if that’s true, it’s illegal.
BTMs are almost by definition perfect vehicles for dirty money. A Bitcoin bought at a machine in Harlem would be instantaneously deposited into a digital wallet, which could be owned by the person standing at the machine, a drug cartel in Colombia, or a ransomware hacker. Fees vary widely and can be changed in real time depending on demand. Cottonwood charges users 19 percent or more in transaction fees. (It sounds like a lot until you consider that the going rate for clean cash in the criminal underworld is about 30 percent.)
To date, U.S. regulators haven’t had the interest or resources to investigate BTMs, so it’s more or less an open secret that they’re used by drug dealers and other criminals. “There are people clearly trying to launder money through our BTMs in small amounts,” says Arnold Spencer, general counsel at Dallas-based Coinsource, the largest BTM operator in the world. “We’re catching most of them, if not all of them.” In August 2016, the company hired Spencer, a former assistant U.S. attorney who’d secured one of the longest sentences ever imposed by a federal judge for money laundering, to make compliance its competitive edge.
Part of his job involves looking for, and calling out, competitors’ legal and ethical failings. Spencer helped expose an alleged investment scam in Dallas after the owners of AriseBank publicized that they were planning to install 1,100 cryptocurrency ATMs by the end of 2017. (AriseBank’s chief executive officer was indicted after being sued by the Securities and Exchange Commission. He pleaded not guilty.) When Spencer visits a new city, he brings an envelope full of $100 bills to buy Bitcoins at one of his competitor’s machines to see if they’re complying with anti-money-laundering regulations.
Bitcoin ATMs
A guide to cleaning cash
Illustrations by Louisa Gagliardi
By his estimate, more than half the machines in the U.S. aren’t following the rules—meaning they don’t verify identification or impose limits on transactions—potentially resulting in more than $500 million in illicit cash being laundered annually. “That should be getting someone’s attention,” he says, adding that there are plenty of legitimate customers using BTMs—speculators, for instance, and immigrants sending money home to their families in countries like the Philippines and Mexico.
Earlier this year, according to Spencer, he walked into a convenience store in Plano, Texas, carrying more than $14,000, mostly in $20 and $100 bills. He’d persuaded a couple of federal prosecutors to make the trek to a strip mall about a half-hour’s drive north of Dallas with the goal of showing them how comically easy it is to buy Bitcoin without proper identification. He also brought with him a special ID: a fake New Jersey driver’s license bearing the name and photo of Frank Sinatra. Ol’ Blue Eyes died more than a decade before Bitcoin was invented, yet as far as the machine at Xpress Beer and Wine was concerned, the crooner helped buy more than $12,000 in Bitcoins that afternoon in June.
With the feds looking on, Spencer made three transactions, each over $3,000. (He made two smaller transactions at the machine before they arrived.) When the machine asked for ID, he held up Sinatra for the camera. When it asked for a phone number, he used one from a website that offers free temporary SMS codes. A couple of times, the machine asked for a scan of the bar code on the identification. For that, he used his or his wife’s driver’s license. He sent the Bitcoins to his digital wallet—minus the 10 percent to 12 percent in fees taken by DFWBitcoin, the operator of the machine.
By the end of the 45-minute experiment, several U.S. banking laws may have been ignored, Spencer said. Under U.S. law, cash transactions by a single person totaling more than $10,000 during a single business day must be reported by the financial company receiving the money (here the BTM operator) on a form that’s sent to the Treasury Department for review. The business would also be required to file a suspicious activity report with Treasury if it appeared the person making the transaction was seeking to structure the cash deposits in a way that avoided triggering the $10,000 rule. Spencer’s transactions were also nearly double DFWBitcoin’s advertised daily limit of $7,500 for that machine. In an email, DFWBitcoin founder Jimmy Scott said he did not find evidence of any wrongdoing. “My individual daily limit ranges from $3,000 to $7,500, depending on my supply and cash in the machine, much lower than many competitors. If I were a crook, I would be searching for the ATM with the least requirements and highest daily limit,” he said. Joshua Radbod, Scott’s lawyer, said his client complied with the law. He also said that DFW’s records showed no transactions from one person totaling more than $10,000 that day. Radbod produced records showing five transactions, including ones by Spencer, Frank Senatry, and Francus Seenra, which he says went to three different Bitcoin wallets. Spencer says he has only one. His account of the day is supported by two witnesses and screenshots from his own wallet.
Spencer told the feds this kind of thing was happening at machines all over the country, and unless law enforcement did something soon, the entire industry would be tarnished. It’s a spiel he gives to every prosecutor, regulator, lawmaker, or reporter he comes across in the hope that a cleaned-up industry will reach more adopters who currently distrust cryptocurrency. The federal agents signaled an interest but warned that they lacked familiarity with this new universe. “My best guess is nothing will come of that,” says Spencer.
The machine used in Spencer’s demonstration was produced by Genesis Coin Inc., the largest U.S. maker of the machines, based in San Diego. The most popular version costs about $7,000 and can convert dollars into a variety of digital assets including Bitcoin, Ether, and Litecoin. The machine plugs into any three-pronged outlet and connects via Wi-Fi to the internet. Each Genesis machine is loaded with software that manages transaction limits and verification procedures in accordance with banking laws. Genesis takes a 1 percent fee on all transactions and allows the BTM operator to adjust those controls or turn them off entirely.
Just a few years ago, trading cash for Bitcoin was predominantly a face-to-face proposition. The best spot in New York City was Union Square, known among Bitcoin enthusiasts as Satoshi Square, after the individual or individuals who developed the digital currency. Men in their 20s and 30s carrying backpacks of cash would meet by a statue of Abraham Lincoln for an auction and then barter over prices. After agreeing on terms, buyers would swap Bitcoin via QR codes with a phone or a laptop. Others would advertise their Bitcoin on websites and then meet buyers in coffee shops to make the exchange. The transactions were risky: a firefighter was kidnapped, stabbed, and robbed in what police described as a Bitcoin-for-cash scheme in Brooklyn in February 2015.
These in-person trades also attracted the attention of law enforcement officers who suspected money laundering. A 50-year-old real estate investor in California, Theresa Tetley, who went by the online moniker Bitcoin Maven, was sentenced to a year in prison after accepting $70,000 in cash from an undercover FBI agent who’d told her it was drug money. In August a 21-year-old from California was indicted on 31 charges for what prosecutors said was a “no questions asked” business accepting cash for Bitcoin.
Moving money through an ATM rather than in person was thought by many traders to be much safer, and by using the machines to “verify” customers, traders would at least have a buffer in place should the feds come calling. The first BTM was opened in 2013 in Vancouver, and by the end of October 2015 there were about 443 worldwide, according to Coin ATM Radar. As Bitcoin crossed over into the mainstream, there was a new market for BTMs: impatient speculators, who were stuck waiting, sometimes for weeks, for approvals to buy coins from many of the popular online exchanges, such as Coinbase and Kraken. BTMs allowed them to buy on the spot, although for a hefty fee. At some point criminals discovered the machines as well. Both Europol, the European Union’s law enforcement agency, and London’s Metropolitan Police Service have warned that low-level drug dealers use BTMs to pay their suppliers, who get a more or less untraceable asset and never have to touch the cash.
Dozens of companies raced to install their machines by offering store owners a monthly fee of a few hundred dollars or a cut of transaction volume. Urban neighborhoods or gas stations near interstate highways promised the most foot traffic. Operators, some of whom charged more than 20 percent per transaction, fought for control of street corners, sometimes resorting to violence.
The site of one of these fights was D&L Market in northwest Detroit, which sits just a few blocks away from one of the most dangerous neighborhoods in America, according to data from the FBI published in 2013. The area has a real estate vacancy rate of 42 percent, and more than 36 percent of its children are living in poverty, according to NeighborhoodScout, a website that analyzes public records. D&L advertises an eclectic mix of goods: booze, onsite phone repairs, lottery tickets, and fried fish. It also hosts a check-cashing service and a thriving BTM business.
During six months in 2016, the machine at D&L was used 7,513 times to purchase Bitcoin, bringing in about $808,000 in cash revenue and more than $120,000 in profit for its operator, Bitcoin of America, which charged a fee of 15 percent on the transactions. It was one of the most profitable Detroit-area machines owned by Sonny Meraban, a Chicago-based real estate investor. Then on Christmas Day 2016 someone smashed the screen with a hammer, knocking it out of commission. Two of the company’s other BTMs in the city were targeted the same day, one of them four miles away in Kenwood Liquor—a machine that had done $526,000 in business over the previous six months. Around the same time, machines in Chicago and Philadelphia owned by Meraban were also attacked. A month earlier, Bitcoin of America and other operators received email messages from someone identified only as Freddy Krueger, ordering them to each send 10 Bitcoins, which at the time were valued at about $700 per token, to a specific digital wallet “IMMEDIATELY or I will have to take appropriate action.”
Bitcoin of America says culprits weren’t your typical bank robbers—they were competitors. The company brought a lawsuit against four Detroit-area men, one of whom, Andrew Konja, has an extensive criminal record. Konja is alleged to have been affiliated with BitExpress, a BTM business that installed machines in Detroit after the attacks, according to a lawsuit filed by Bitcoin of America’s parent company. He and three other men were accused of having made threats to competitors to leave town or pay for protection. (BitExpress and Konja didn’t respond to requests for comment.) Another BTM operator was told if he didn’t leave Detroit, he’d be shot in the head, according to the lawsuit. “It’s not the Wild West. It’s anarchy,” says John Reed Stark, a former enforcement official at the SEC who now runs a consulting business focused on cybercrime and virtual currency.
Cottonwood, the New York BTM company, has since ditched the former soldiers for cash pickups and turned to a security company with armed couriers. It’s also retained a Wall Street law firm, Latham & Watkins, to help it obtain a New York BitLicense to stay in business. Winning approval would mean convincing regulators that Cottonwood has systems in place to ensure its machines aren’t being used for criminal purposes, including having a repository of transaction records going back to its beginnings.
That might be a problem: Cottonwood says all of its business records that were stored in a locked file cabinet at the WeWork office recently went missing, including transaction receipts, customer data, employee files, contracts, and tax records. Cottonwood sued WeWork in October, alleging its landlord entered the office and removed or destroyed the documents. WeWork declined to comment.
Two days after Halloween, Spencer, whose company recently received the first New York BitLicense, is in the city testing machines owned by Cottonwood. For several hours, Spencer works Cottonwood machines at three locations, searching for weaknesses. He says he finds violations of anti-money-laundering and New York State Department of Financial Services regulations but nothing on the scale of the Frank Sinatra stunt in Plano a few months earlier. Using his wife’s driver’s license and a fake phone number, he stands to the side of the machine so as not to be captured on its video camera and succeeds in buying Bitcoin in increments of $200 to $1,000. “They have no f---ing idea who just bought Bitcoin from them,” he says after buying $200 worth at Al Horno Lean Mexican Kitchen on Second Avenue. Cottonwood says it followed all “relevant anti-money-laundering statutes and regulations.”
A few minutes later, Spencer is flagged by Cottonwood’s system while trying to buy $3,000 worth of cryptocurrency. The machine asks him to punch in a Social Security number; he puts in a fake one and soon after gets a message saying his account has been suspended. Spencer’s total haul for the day is about $2,000 in Bitcoin, minus 15.5 percent in Cottonwood fees. To Spencer, it’s a sign that the company has some controls in place. Asked by one of the Bloomberg reporters shadowing him how Cottonwood fared, he says, “Better than I thought.”
Back at the Apollo Deli, the BTM there has been both a hit and a hassle, according to a cashier, who declines to give his name. Buyers have been asking him to break $100 and $50 bills so often that he put up a sign on the side of the machine saying the store wouldn’t give out change anymore. He says the store collects $500 a month from Cottonwood but doesn’t understand how or why people use it. “It’s legal, right?”
Edited by Silvia Killingsworth and Max Chafkin
Follow @crypto on Twitter for the latest news.