Cryptocurrency tied to the Canadian truckers protesting COVID-19 restrictions has been on the move, in defiance of the authorities’ orders to freeze funds, blockchain analysis shows.
Nearly all of the roughly 20 BTC (about $788,000 U.S. at current exchange rates) sent to the Tallycoin fundraiser is gone from that address, with only 0.11 BTC left, according to Blockchain.com data.
Most of the 30 bitcoin wallets identified by the Royal Canadian Mounted Police (RCMP) as being attached to the fundraising have been largely drained as well, with only 6 BTC combined between them, on-chain data shows.
Whether the recipients will be able to use the funds to buy goods or services remains to be seen, however.
A CoinDesk review of the public ledger shows that four small portions of the roughly 20 bitcoin raised – about 0.14 BTC each – ended up at two centralized exchanges, Coinbase and Crypto.com. It is not clear whether the funds were cashed out for fiat or frozen at those platforms.
The situation highlights the limitations of a government’s ability to thwart transactions through decentralized, censorship-resistant systems – but also the limitations of those systems to circumvent such sanctions.
While the authorities cannot veto transactions on Bitcoin and similar networks, they have leverage over regulated companies that serve as the on- and off-ramps to those networks.
Honk honk
Backing up, in recent weeks, thousands of Canadians took to the streets in major cities to protest vaccine mandates and other COVID-19 restrictions. Dozens of trucks blocked the roads of Ontario as well as various border crossings to the U.S., filling the air with honking and bringing economic disruption.
The nation’s capital, Ottawa, found itself practically under siege. In order to disperse the trucks and protesters and bring an end to the weeks-long disruptions, on Feb. 14 Canadian Prime Minister Justin Trudeau invoked the Emergencies Act for the first time since it was enacted in 1988. Part of the Act gives the government and banks the authority to freeze financial assets and accounts linked to protestors without a court order or judicial review process.
It also enabled police forces from across the country to coordinate and combine resources as they dismantled the convoy in Ottawa and elsewhere: As of Feb. 22, 191 people have been arrested and 107 people have been charged with obstructing police, disobeying a court order, assault, mischief, possessing a weapon and assaulting a police officer, CNN reported.
Unlike bank wires, transactions on decentralized blockchains typically cannot be stopped or frozen. An exception is when the smart contract for a non-native asset, such as an ERC-20 token on Ethereum, allows the issuer to freeze certain addresses and prevent any further transactions, as Tether, the issuer of the world’s largest stablecoin, USDT, has done several times.
In contrast, bitcoin is not controlled by any central entity, so in case of a criminal investigation authorities can only blacklist certain addresses and order regulated crypto services to freeze any funds coming from them and not let the money out of their custodial wallets.
Following the money
On Feb. 16, Canadian police ordered that all regulated financial firms stop facilitating transactions for 34 wallets associated with the protestors (30 were bitcoin wallets and the rest held other cryptocurrencies). The police sent a letter to a number of banks and crypto exchanges, Canada’s The Globe and Mail reported, but didn’t specify which ones received the warning.
That night, at least some of the funds were distributed among unidentified parties and later sent to centralized exchanges Coinbase and Crypto.com, blockchain data shows. An address connected to the Tallycoin fundraising address, which the truckers had used to accumulate funds, sent 14.28 BTC to 101 addresses in even fractions of 0.14 BTC each.
On Feb. 17, in a separate legal fight brought by locals affected by the protest, the Ontario Superior Court of Justice ordered that nine crypto platforms freeze accounts associated with 120 cryptocurrency addresses belonging to the movement. This means that if those platforms received funds from the listed addresses they should prevent any further movement of them. The list of addresses was provided via a Mareva injunction – a form of court-provided asset freezing.
The sending address for the Feb. 16 transaction was mentioned in the Mareva injunction, but not in the earlier list from the Canadian police.
On Feb. 17 and 18, four of the addresses on the Mareva injunction list sent 0.14 each BTC to Coinbase (1, 2) and Crypto.com (1, 2), either directly or via several intermediary addresses, according to data from the Crystal Blockchain analytics system. (Crystal confirmed CoinDesk’s findings.). It’s unclear whether users managed to sell the funds for fiat at these platforms.
Coinbase’s director of global policy communications, Ian Plunkett, said the firm has “nothing to share on specific transactions and accounts for obvious reasons,” and referred CoinDesk to a blog post by the exchange’s CEO, Brian Armstrong, on its rules for removing user accounts.
Crypto.com also declined to comment.
Do exchanges have to comply?
Centralized exchanges’ approaches to wallets sanctioned or blacklisted by authorities can vary, Crystal Blockchain’s head of data intelligence, Nicholas Smart, told CoinDesk.
“First off, does the exchange have to apply the sanctions? They may not if they are not facing the sanctioning market and don’t do business there,” Smart said.
Coinbase and Crypto.com both do business in Canada (although they are not listed among financial institutions ordered to freeze funds by the Mareva injunction in the private lawsuit).
“Second, did they know about the listing, and at what point did they find out?” Smart went on. “This will change if they will stop a transfer and report it or if they simply will report the activity. That detection is also dependent on how good their transaction monitoring system is.”
Regulated financial institutions are also subject to “strict rules on tipping off criminals or others who are suspected of money laundering, so in that case they may process a transaction and report it,” Smart noted. “It’s a sealed box though; we don’t know if they are or are not reporting.”
‘Eight grand in there’
The global bitcoin community has been closely watching the Freedom Convoy-related wallets, and the distribution of funds was immediately spotted by blockchain watchers.
The Twitter account of the privacy-focused Samourai wallet warned: “It is absolutely essential that any truckers who received bitcoin yesterday from @HonkHonkHodl do not attempt to cash out using a centralized exchange. These funds are subject to a Mareva injunction and violation of that order is a criminal act.”
On Feb. 16, Tim Pastoor, a digital identity researcher in the Netherlands, tweeted a video of a person coming up to a truck and handing a large paper envelope to the driver, saying it contained “some sats” – slang for “satoshis,” small fractions of bitcoin. “Eight grand of bitcoin in there,” says the donor, who then explains the envelope contains the recovery phrase for a software wallet containing bitcoin along with a set of instructions.
On Feb. 17, Twitter user NobodyCaribou wrote that fundraisers for the Freedom Convoy, as the protesting truck drivers are calling themselves, distributed 14.6 BTC among 90 protestors.
“Epic P2P bitcoin wallet airdrop. Team of two, distributed to 90 (ish) truckers over 24 hours. 14.6 btc,” he tweeted, adding: “This was the most satisfying thing I’ve ever done and also the hardest thing I’ve ever done.”
CoinDesk asked NobodyCaribou via Twitter direct message whether people had any problems cashing out the bitcoin on centralized exchanges, but the account’s owner hasn’t responded so far. Tallycoin also hasn’t responded to a request for comment.
This is a developing story. Check back for updates.
UPDATE (Feb. 22, 21:35 UTC): Corrects figure in fourth paragraph. An editing error was to blame.
Sage D. Young and Fran Velasquez contributed reporting.