In the early afternoon on January 9, 2022, 8,888 “Frosties” non-fungible tokens (NFTs) were sold for 0.04 Ether each, selling out in just forty-eight minutes. These NFTs promised purchasers a unique NFT digital “Frostie” image, staking, NFT breeding, and additional rewards tied to a yet-to-be-released metaverse game. The only problem? None of the associated benefits existed and the sellers promptly deactivated the “Frostie” social media presence, closed shop, and went silent, pocketing about $1.1 million.
The sellers were two 20-year-olds, Ethan Nguyen and Andre Llacuna. According to the U.S. Attorney for the Southern District of New York, the two executed a “rug pull,” a trending term for a fraud scheme where sellers pitch a detailed digital asset investment opportunity and business plan to buyers only to take their money and disappear—pulling the “rug” out from under purchasers. Nguyen and Llacuna now face criminal charges for conspiracy to commit wire fraud and conspiracy to commit money laundering.
The criminal complaint, which was filed March 15 and unsealed on March 24, details how Nguyen and Llacuna utilized multiple crypto wallets, intermediaries, smart contracts, IP masking, and purported crypto “mixer” services to execute their scheme. In the end, it appears investigators had little difficulty uncovering the scheme and tracking down the perpetrators whose actions were largely memorialized on the public Ethereum blockchain.
To execute their rug pull, the defendants established the Frosties NFT smart contract which also served as the first of several crypto wallets that Nguyen and Llacuna would use. As part of the smart contract, Nguyen and Llacuna inserted a conditional withdrawal function that, when executed, would transfer all of the Ether collected in the smart contract wallet over to a separate wallet controlled by Nguyen and Llacuna. From that wallet, the defendants transferred the Ether to yet another wallet and then made three smaller transfers to the “mixer” service Tornado Cash, which commingled the Ether from the defendants with Ether from other users—to scramble and anonymize the true source of the Ether—and then distributed the Ether to several intermediary wallets in smaller quantities which, in turn, distributed the Ether to Coinbase wallets owned by Nguyen and Llacuna. According to investigators, “the blockchain recorded [the] series of cryptocurrency transactions” – enabling investigators to see through the scrambling and to trace the transactions back to the original wallets and smart contract, which had been opened using IP addresses, email addresses, and phone numbers linked to Nguyen and Llacuna.
This pattern of transfers between intermediary wallets is reminiscent of the classic account shell game that money launderers have long used to disguise cash and securities transactions and prevent detection by financial institutions’ anti-money laundering monitoring systems. Recognizing that this pattern applies equally to cryptocurrency transactions, Congress, in the Anti-Money Laundering Act of 2020, expanded the definitions of “money transmitting business” and “financial institutions” under the Bank Secrecy Act to include businesses engaged in the exchange or transmission of “value that substitutes for currency.” This placed crypto exchanges, like Coinbase, squarely within FinCEN’s regulatory purview.
The scheme deployed by Nguyen and Llacuna highlights the importance to exchanges and wallet services of maintaining thorough AML compliance programs. Indeed, the complaint might even serve as warning signal that more regulatory focus is on the horizon. The complaint explained that, “[t]o avoid anti-money laundering scrutiny and law enforcement detection, individuals in possession of illicit proceeds often insert intermediary [wallet] transactions between a KYC exchange like Coinbase and a high-risk source like Tornado Cash, a cryptocurrency mixer, to further obfuscate the source of funds.”
While the complaint doesn’t fault Coinbase or any other exchange, nor does it suggest a gap in their compliance programs, exchanges might consider revisiting their fraud and AML monitoring practices in the wake of the Frosties prosecution. Transaction monitoring for intermediary transfers involving “mixer” protocols or transfers tied to NFT sales could become fertile ground for future regulation. Indeed, an expectation for more robust AML compliance programs has already begun to emerge from recent regulatory reports.
The Department of Treasury, for example, recently examined money laundering risks in the art market, including the market for NFTs. A Treasury report stated that under some circumstances an NFT platform such as OpenSea may be considered a virtual asset service provider (VASP) and come under FinCEN’s regulations. However, the report distinguished between NFTs used as payment or investment instruments and NFTs “that are unique, rather than interchangeable, and that are used in practice as collectibles.” The Frosties NFTs would fall into the latter category. Nonetheless, the Treasury report warned about various AML risks associated with NFT sales. For the art market as a whole, the report concluded that “entities which have larger annual sales turnover and regularly transact in high-value art in the ordinary course of business may present a higher risk” and voluntary compliance programs may not be sufficient. This signals that regulation in this area could expand in the future, though limited to certain segments of the market. The report emphasized enhanced recordkeeping and information collection as options for the art market in combatting abuse by illicit actors.
While the money laundering concerns reflected in the Treasury report present a different risk from the fraud alleged in the Frosties complaint, the government urges a similar compliance action plan. The scheme described by the Frosties prosecutors illustrates how criminal actors can utilize exchanges and other legitimate cryptocurrency services to commit fraud and distort the source and path of illicit proceeds, using new technology to commit a crime that seems all too familiar. The characteristics of crypto technology provided both the means for the crime and the method by which the alleged wrongdoing eventually was traced and brought to an end by government investigators.
 United States v. Nguyen, 22-mag-2478, Complaint ¶ 16(d) (Mar. 15, 2022).
 See Dep’t of Treasury, Study of the Facilitation of Money Laundering and Terror Finance Through the Trade in Works of Art (Feb. 4, 2022), available at: https://home.treasury.gov/system/files/136/Treasury_Study_WoA.pdf.
 Id. at 26.