Shalini Nagarajan

<div id="highlights-block_6357c7fccd73f" class="highlights">
 <ul>
 <li>Guochun He and Zheng Wang sought bitcoin wallet Wasabi to hide bribe payments, Elliptic said</li>
 <li>The pair allegedly hoped to gather confidential documents related to a federal investigation into Huawei</li>
 </ul>
 
</div>



Two Chinese officials tried to hide bitcoin bribes paid to a US double agent with crypto mixing technology, once again thrusting privacy-preserving protocols into public discourse.



In 2019, authorities say Guochun He and Zheng Wang directed a US government employee to steal information about an ongoing criminal investigation into a global telecom company based in the People’s Republic of China (PRC), <a href="https://www.justice.gov/usao-edny/pr/two-chinese-intelligence-officers-charged-obstruction-justice-scheme-bribe-us" target="_blank" rel="noreferrer noopener">according</a> to the Department of Justice (DOJ).&nbsp;



The DOJ doesn’t name the company, but the <a href="https://www.wsj.com/articles/u-s-says-chinese-tried-to-obstruct-huawei-prosecution-11666633408">Wall Street Journal</a> and <a href="https://www.cnbc.com/2022/10/24/chinese-intelligence-officers-charged-in-huawei-prosecution-obstruction.html">CNBC</a> both reported the firm as Huawei.&nbsp;



The officials, said to be conducting foreign intelligence operations in the interest of Huawei, believed the US government employee was recruited to work for Beijing. He was in fact working with the US Federal Bureau of Investigation (FBI), the complaint alleges.



In Sept. 2021, the Chinese officials assigned the double agent with detailing their meetings with prosecutors at the US Attorney’s office in Brooklyn. 



They were especially interested in understanding which Huawei employees had been interviewed by the government, seeking a description of the prosecutors’ evidence, witness list and trial strategy.



Guochun He, one of the Chinese officials who paid the bitcoin bribes, allegedly told the agent that the company in question was “obviously interested” in the information. He first handed over $41,000 in bitcoin in Oct. 2021 for stealing a document and another lot worth $20,000 in September.



Huawei didn’t return Blockworks’ request for comment by press time.



<h3 class="wp-block-heading">Analytics unit traced bitcoin bribes despite Wasabi Wallet</h3>



In private messages, He allegedly asked the agent to accept bitcoin as he believed it would be &#8220;private and safe&#8221; from the eyes of the government.



Crypto has long been considered a means of engaging in discrete transactions, but mostly the opposite is true. Blockchain data, at its core, is almost always public and transactions are traceable, albeit pseudonymous.&nbsp;



Crypto mixers were designed to provide privacy for this open financial system. There are many different kinds but they generally work by commingling funds with other users. 



Mixers have increasingly come under the spotlight after usage by North Korean hackers and other bad actors in laundering illicit crypto gathered from exploits across the crypto ecosystem alongside ransomware attacks.



<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="243" src="https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png" alt="" class="wp-image-35480" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=1536 1536w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=80 80w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=50 50w, https://blockworks-co.imgix.net/wp-content/uploads/2022/10/Screen-Shot-2022-10-25-at-14.01.26-1024x243.png?w=1922 1922w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /><figcaption>Excerpt from DOJ <a href="https://www.justice.gov/usao-edny/press-release/file/1546456/download" target="_blank" rel="noreferrer noopener">indictment</a>.</figcaption></figure>



The US recently banned citizens from using Ethereum-powered crypto mixing service <a href="https://cms.blockworks.co/us-treasury-bans-citizens-from-using-mixing-service-tornado-cash/" target="_blank" rel="noreferrer noopener">Tornado Cash</a> for this reason.&nbsp;



Blockchain analytics firm Elliptic found that the two officials used bitcoin wallet Wasabi Wallet to conceal their transactions. Wasabi <a href="https://wasabiwallet.io/about.html" target="_blank" rel="noreferrer noopener">describes</a> itself as an open-source, non-custodial bitcoin wallet created to provide privacy by default. 



The wallet makes use of tech known as &#8220;<a href="https://en.bitcoin.it/wiki/CoinJoin" target="_blank" rel="noreferrer noopener">CoinJoin</a>,&#8221; which combines bitcoin of multiple transacting parties to render identifying fund provenance more difficult.



“All of the bribe payments can be traced back to Wasabi,” Elliptic <a href="https://hub.elliptic.co/analysis/chinese-spies-used-wasabi-wallet-mixer-to-pay-bitcoin-bribes-to-fbi-double-agent/" target="_blank" rel="noreferrer noopener">said in a statement</a>. Tom Robinson, co-founder and chief scientist at Elliptic, told Blockworks the firm was able to identify the bitcoin transactions based on details disclosed in the criminal complaint.



Elliptic was then able to use its blockchain analytics tools to trace the source of the payments and identify the use of Wasabi. Wasabi Wallet didn’t immediately return Blockworks’ request for comment.



<figure class="wp-block-image"><img decoding="async" src="https://lh3.googleusercontent.com/dDI2mJS2Dapq0klRiFWfX3fDsGarHVV-zKFl41X-5H1RxxUR8hyss_-YvCNRBZf5lneYNs3BnVu1eUb_pS8PSNwOauW2iCGdOb4uiOkdzw-IPV7MM4M2-hoELWThQiK1pFR2J6_kd_CP_cj7k6KLG041yFKPZTQzhi8CeMv3s3EZsfGDE6uFJKbMFw" alt=""/><figcaption>Image source: Elliptic</figcaption></figure>



Both officials are charged with attempting to obstruct a criminal prosecution of Huawei in the federal district court in the Eastern District of New York. He is additionally charged with two counts of money laundering based on bribe payments.&nbsp;



They currently remain at large. If convicted, He faces up to 60 in prison and Wang faces up to 20 years.



In any case, the matter once more highlights the difficulty of hiding crypto activity — whether illicit or benign — even after funds are sent through crypto mixing technology such CoinJoin.&nbsp;



Elliptic’s Robinson told Blockworks the firm has “special techniques for identifying bitcoin addresses associated with Wasabi use.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

coinjoin