The Banking Industry and Cybersecurity

by Jack Barkstrom - Attorney, CPA

Blockchain technology and Bitcoin - Is it money or not?

Is Bitcoin money? It seems to be, in some cases anyway - anything commonly accepted as a legal tender currency for payment of debts. By one measure, anything used as a medium of exchange for payments between consumers, businesses, and government is considered money. By another measure - acceptance as legal tender - it is not. Legal tender, by that definition, is limited to money recognized by law as acceptable payment for debts owed by creditors. Legal tender, in other words, is something that has the backing of the government. In the United States legal tender is limited to all forms of circulating paper money, mostly Federal Reserve Notes, and coins. Bitcoin is not on that list.(1)

Legal tender, or not, there are certainly a growing number of digital currencies being sold, along with digital services, or platforms, intended to conduct trades, or facilitate trading. Bitcoin may be the most famous of the digital currencies being offered, but there are others: Etherium, Hyperledger, Fabric, Corda, and Quorum, as well as DogeCoin, and Stablecoin. There are also the businesses created as trading platforms or virtual currency exchanges, such as Coinbase and Robinhood, Inc., allowing others to buy and sell digital currencies. For them, digital currencies are clearly money - a medium of exchange.(2)

Counterfeit Bitcoins - Do they exist?

One of the few events remembered, for those who do not follow history closely, is the assassination of President Abraham Lincoln at Ford's theater at the end of the American Civil War. What may not be known is that on the afternoon of the assassination, President Lincoln had signed an executive order creating the U.S. Secret Service. At the time one of the main mandates for its creation was an economic one, to deal with combating the counterfeiting of U.S. currency. It was officially formed on July 5, 1865, as a division of the U.S. Department of the Treasury.(3)

Within the Secret Service there was an entire division devoted to making making paper money difficult to counterfeit, and counterfeiting efforts easy, or easier, to detect, with the development and use of special inks and paper. This did not prevent people with the experience and skills from trying.

There has always been a market for copies - and those skilled in the art of making perfect copies. Not all of it involves criminal activity. Photography and cameras, as a field, is in demand because of the ability to accurately capture scenes of nature or physical objects in the real world. The fashion industry is quick to copy the latest trend, whether it is shoe styles, coats, or dresses. In the auto industry, the latest models seem to look very similar. There is even a market for individuals who can paint realistic copies of famous paintings. Some of this market is fraudulent, but some of it is done for individuals who simply want to display a copy of an admired work, without paying the millions of dollars demanded for an original.

Do counterfeit Bitcoins exist? There are two possibilities. One answer is yes - probably. There are those with the skills needed looking for the ultimate challenge to prove their abilities. The second answer is - there's no need to create counterfeit copies, when you can get the real thing. If someone simply wants to get their hands on genuine Bitcoins, there are easier ways to get them - the classic way - "beg, borrow or steal" them, and there are plenty of ways to do that.

A Fundamental Flaw

When Bitcoin made its first appearance, one of the arguments for its value as money, was that there would be a limited number of Bitcoins created - the computer version of the economic field which deals with a nation's money supply. The value of money, according to the economic argument, acts like any other commodity - determined by the laws of supply and demand. If there is a limited supply of anything, for example, a commodity, such as wood, its price, or value, will increase. Anyone with experience in concert or sporting event tickets, would agree that it's a valid assumption. The problem for Bitcoin was that there was an underlying assumption. That assumption was premised on the idea that Bitcoin represented, or would remain, the entire world supply of cryptocurrency. Unfortunately, from a programming standpoint, the Bitcoin cryptocurrency was a programming template which was open source, meaning that anyone could look at the code. They could copy it and create their own version of cryptocurrency - meaning their copy didn't have to be in Bitcoin. So, while Bitcoin itself was said to have a limited number of coins, which would increase its value over time, that limit went out the window, if anyone could create their own version of coin. The "money supply" was now unlimited, which was the equivalent of printing more money in economic terms. It did reduce the likelihood of counterfeiting. Why go to the effort of counterfeiting, when you could create a new crytocurrency which was equivalent to Bitcoin, and worked just as well?

Bitcoin Beginnings

In 2008, Satoshi Nakamoto, (believed to be a pseudonym for an individual whose identity is still unknown) published a white paper proposal for the use of blockchains in cryptocurrencies, called "Bitcoin: A Peer-to-Peer Electronic Cash System." In 2009, the first blockchain, Bitcoin, was created or mined, supposedly by Satoshi Nakamoto himself. He limited the total number of coins which would ever be minted to 21 million, by hardcoding that number into the original program, estimated to be reached in the year 2140. Approximately 144 blocks, or 1,728 bitcoins are generated per day. Bitcoin was created using a programming language called C++, and was an open-source version, meaning that anyone could contribute code anonymously. Despite the 21 million limit, in what became known as the "Value Overflow Incident of 2010," on August 15, 2010, a hacker was able to create 184 billion bitcoins. A correction was made in 5 hours, supposedly by Satoshi Nakamoto himself, and the 184 billion Bitcoin were disposed of. At least that was what was reported publicly. A second incident in 2018, considered more serious, the "Value Overflow Incident of 2018," reportedly occurred without being reported until it had been fixed.(4)

Perhaps the most important point to remember about Bitcoin, blockchain technologies, and cryptocurrencies, are that they involve cryptography and its encryption tools, and a desire for secrecy. Cryptography is the science or study of protecting information by converting it into a form which is unreadable, using a process called encryption, unless it can be deciphered or decrypted, by the receiver on the other end. It has been around for thousands of years. The use of the Internet to send messages and conduct transactions has revived an interest in secrecy and cryptography. It is something of a two-edged sword. On the one hand, it provides a certain level of privacy and protection for individuals who do not want ordinary messages read by anyone, as well as for businesses, such as banks, who do not want customer transactions or information made public. On the other hand, secrecy can hide fraudulent transactions and illegality. The auditing profession seeks to discover and bring fraudulent practices to the light of day. Blockchain technologies, in contrast, seem to represent the polar opposite. They seek to hide transactions from public view, make them difficult to understand, or take other measures to shroud them in secrecy.

Bitcoins and blockchain technologies use what are called secure hash algorithms (SHAs), which involve running data through a number of encryption cycles, so that the original data cannot be recognized without using what called a key to change the data back into the original message. The current version is SHA-3, which describes a family of SHA-3 functions. The algorithms and data transformations are so complex that they require special computer chips, called Application-Specific Integrated Circuits (ASICs). Complexity is only one requirement, speed is another. It is not really necessary to understand very much about cryptography, or its associated terms, since the computer chips do most of the work and all that is required is to become familiar with whatever dashboard is being used.

Discovering how blockchain technology works in pracice is not very hard. Find a cryptocurrency site on the Internet and follow the directions they give. Sometimes they require that special software needs to be downloaded, sometimes not. There are even various third-party services, similar to Software-as-a-Service (SaaS), which will provide Blockchain-as-a-Service (BaaS). Some are offered by major companies, such as Oracle or IBM. Others are offered by independent businesses. While most are probably focused on cryptocurrency, some deal with other uses of blockchain technology, such as inventory or supply chain control within a single business or between a business and its suppliers.

The Mt. Gox Attack of June 2011

The first Bitcoin blockchain was created or mined (publicly offered) in 2009. It did not take long for others to get into the act. Jeb McCaleb, a US programmer, had actually launched an online trading venue in 2006. At the time it traded in digital collectibles (not Bitcoin). He called it Mt. Gox, short for the online role-playing game called "Magic: The Gathering Online." When he learned of Bitcoin in 2010 he decided to make trading in Bitcoin a Mt. Gox specialty, which was in July 2010. In March 2011 he sold the site to Mark Karpeles, a French expatriate residing in Toronto. Shortly after, in June 2011, Mt. Gox announced that 25,000 bitcoins, worth more than $8.5 million had been lost from the accounts of several thousand customers as the result of a hack. An auditor's computer had been compromised.(5)

For some two years following the 2011 announcement, little was heard from Mt. Gox. Then, in the spring of 2013, the US Department of Homeland Security seized several million dollars of funds from an account belonging to a US subsidiary of Mt. Gox. In June 2013, Mt. Gox suspended US dollar withdrawals. In February 2014, it prevented all users from withdrawing their bitcoins, as well. It also announced that it had lost more than 700,000 bitcoins, worth more than $350 million at the time. The loss was related to the June 2011 hack. The hacker had managed to access the private keys to Mt. Gox's Bitcoin wallet (a generic program which can hold cryptographic keys, track balances, and receive and disperse bitcoins). Over the course of the next two years, the hacker slowly drained most of the bitcoins from the Mt. Gox wallet. Shortly after, Mt.Gox filed for bankruptcy in Japan.(6)

Due to the size of the losses, Mt. Gox made most of the headlines, however there were other losses around the same time. In October 2011, the Bitcoin7 exchange reported the theft of of 5,000 bitcoins, allegedly the result of a Russian hack, although there was speculation that it was an inside job. In September 2012, another exchange, Bitfloor, announced that it had lost 24,000 bitcoins, worth about $250,000, to a hack. Security experts pointed out that two mistakes were made. The first was that an unencrypted backup of the wallet keys was made following a manual upgrade. The second error was that the backup was saved to a "hot wallet," a wallet which was accessible on-line. Hot wallets normally are necessary for crypto transfers, but a third mistake was in storing such a large amount of bitcoin in a hot wallet. Bitfloor was one of the largest exchanges at the time, but it would go out of business as a result of the loss.(7)

The DAO Hack of 2016

In June 2016, one of the more infamous hacks occurred. This time, it was not Bitcoin which was stolen, but another cryptocurrency, called ether (ETH), which was a product of the Ethereum blockchain. This time, the theft was not the result of a "traditional" hack, where someone breaks into or hacks a site and then steals the coin. It was instead, the exploitation of an inherent flaw in the Ethereum blockchain program. The Ethereum blockchain network was the creation of another "math and science whiz-kid" programmer named Vladimir Buterin, an admirer of the Bitcoin platform, but who thought it could be improved. He came up with the idea of what he called a decentralized autonomous organization (DAO), which would allow users more active control of the entire blockchain process. This particular DAO had been created by a German company named Slock.it to facilitate the raising of capital for a project. DAO investors received a token, called a "DAO," which allowed them to vote on projects in which to invest in. Buterin provided a tool, called a smart contract, which, once its terms were set by the user, would be self-executing. He included the smart contract in the code for Ethereum. The smart contract made Ethereum different from Bitcoin, but in other ways it was quite similar. Since the Bitcoin blockchain involved a type of concensus or vote amoung its members, there was a time lag between when a transaction occurred and when it was recorded. In other words, all members had to be sent notification of a transaction, agree that it was valid, and then send back a response. It was a vulnerability ripe for exploitation.(8)

On June 17, 2016, a hacker either discovered the vulnerability or exploited it. The hacker withdrew ether funds by requesting a withdrawal of ether, providing an external address where the ether cryptocurrency was to be sent. Under normal conditions, the Ethereum platform is supposed to record the transaction as a withdrawal and reduce the balance showing the amount of ether in the account. In this case, before the initial withdrawal transaction had been completed, the external address would request another withdrawal. Since the original balance looked the same the second withdrawal was done. As a result the smart contract allowed funds to be withdrawn multiple times. By the time the hack was over, the hackers had withdrawn 3.6 Million ether (ETH), worth approximately $55 to $60 million at the time.(9)

The Badger DAO Ice Phishing Attack of 2021

Badger DAO was a decentralized finance (DeFi) protocol, (a protocol intended to facilitate online financial transactions), such as lending, borrowing, and trading, services normally offered by banks. It marketed itself as a protocol for earning interest on Bitcoin deposits. One of the security features it relied on was the use of digital signatures to approve transactions. Digital signatures have become commonplace in the business world as a means of authenticating documents and approvals remotely. Individuals can authorize transactions and contracts remotely, without having to be physically present. At least one vulnerability is the tendency of individuals to almost automatically approve transactions without thinking.(10)

Ice phishing is a type of cyber attack in which malicious actors manipulate the signing of transactions on blockchain networks, by tricking users into signing transactions that grant the attacker permission to access the user's accounts, without directly stealing the private keys of the user. In the case of the Badger DAO, the attackers crafted a transaction request that seemed innocuous and legimate, which prompted the victim to approve the transaction. Behind the scenes, a malicious script code re-directed funds to the attacker's wallet. The specific permission was for ERC-20 tokens, considered a relatively secure standard for tokens. The transaction request must have been very well crafted, since the approval response was high. The attackers were able to withdraw approximately $121 million in funds from nearly 200 accounts within just 10 hours.(11)

The Wormhole Bridge Attack of 2022

In February 2022, hackers stole approximately $320 million in what became known as the Wormhole Bridge Attack. A bridge, or crypto bridge, is a platform for converting or transferring digital assets from one blockchain to another. In this case, the transaction was between the Solana blockchain and the Ethereum blockchain. While blockchains may be created using similar techniques and cryptographic methods, they are not interchangeable. A bridge essentially conducts an exchange, using two separate smart contracts, one a sale request (instructions to burn, or destroy) a blockchain, the second a delivery in the other blockchain. If the blockchain is in stable coin tokens, which supposedly are backed by actual reserves, the destruction is to be followed by notification to a bank to take the equivalent amount out of reserve funds. In this case, the hackers wanted Solana to execute a smart contract sale, while the Ethereum side smart contract would deliver the Ethereum blockchain equivalent. The Ethereum side smart contract worked, allowing the hackers to mint, or create 120,000 wrapped ETH (wETH) tokens, while the Solana-side smart contract did not destroy the Solana blockchain, meaning the hackers didn't pay for the Solana blockchain. There remains the question of whether, if Solana's smart contract didn't uphold its side of the bargain, and its digital tokens weren't destroyed, does Solana still have the original blockchain assets?(12)

The Wormhole Bridge Attack, which allowed hackers to mint new coins without paying for them, fell into a type of transaction known as an "infinite mint glitch." In 2021, a platform called PancakeBunny had been hacked, and an infinite mint glitch allowed about 7 million of their BUNNY tokens to be minted. A similar hack allowed hackers to drain $52.8 million worth of USDC (US Dollar Coin), USDT (US Dollar Tether), and UST, three stable coins, from Cashio (CASH), a native (precompiled smart contract) stablecoin on the Solana blockchain, and Saber, an automated market maker for trading assets on Solana.(13)

The Ronin Bridge Attack of March 2022

Axie Infinity is an online blockchain-based video game. Game users could purchase and breed digital pets to be used in battles against one another, paid for using cryptocurrencies. The mechanism for moving funds was a decentralized application (Dapp), known as the Ronin Bridge, which was a type of smart contract-based application. Smart contracts are mini-programs which execute automatically once activated and, in the case of Axie Infinity, served as a "storage" location for tokens, which were locked into the smart contracts until activated. Because Axie Infinity players were constantly moving funds across the Ronin Bridge, the value of the amounts locked in the smart contracts was substantial.(14)

In March 2022 it was reported that the Axie Infinity's Ronin Network had been hacked for an estimated $625 million comprised of Ethereum's ether coins and the USDC stablecoins. It is believed that North Korea's Lazarus Group was behind the hack. The focus of the attack was the bridge's smart contracts since the tokens were locked in the smart contracts. It is believed that the hackers had created a fictitious company which, in turn, had advertised fictitious job openings. A senior engineer at Axie Infinity had been tricked into applying for one of the jobs. This enabled the hackers to obtain the private keys and to forge fake signature approvals to make fake withdrawals.(15)

The Terra (LUNA) Collapse of May 2022

In May 2022 the Terra network, which traded in LUNA, was hacked. A defect in a Mirror smart contract protocol was exploited. The protocol was supposed to check if the same ID was used more than once. It failed to do the check, which allowed the hackers to withdraw funds without any oversight. In addition, the withdrawals were not even noticed for seven months. An estimated 60 billion in the Terra USD cryptocoin was wiped out. The Terra (LUNA) collapse may not be familiar, at least by name, however the name of Sam Bankman-Fried and the cryptocurrency exchange FTX may provide a frame of reference. FTX had been founded by Sam Bankman-Fried in 2019, and had invested heavily in a hedge fund which had invested in Terra USD. FTX ultimately was supposed to cover customer withdrawals, which it couldn't and, in November 2022, it filed for bankruptcy. Shortly after, Bankman-Fried was arrested and charged with fraud and money laundering, for which he would ultimately be convicted.(16)

The Nomad Bridge Attack of August 2022

In August 2022 the Nomad cross-chain token bridge was hacked in the amount of approximately $200 million, which was the fourth largest crypto hack to that time. Ethereum tokens were removed in the form of Wrapped Bitcoin (WBTC) and transferred to other chains, such as Moonbeam and Evmos. It was unclear whether white hat hackers and ethical researchers had been involved in the theft.(17)

The BNB Smart Chain Attack of 2022 October 2022

In October 2022 the BNB Smart Chain, the Binance blockchain, halted transactions due to "irregular activity." The hackers were able to exploit a cross-chain bridge called the BSC Token Hub, which served two BNB blockchains, BNB Beacon Chain and BNB Smart Chain. The exploit, involving fake withdrawal proofs, allowed the hackers to improperly mint additional BNB tokens. Approximately $569 million worth of BNB tokens were minted.(18)

By one estimate, the value of funds stolen from DeFi (Decentralized Finance) protocols amounted to $2.7 billion during 2022 alone. Between 2020 and 2022, the total value of funds stolen was $5.1 billion.(19)

Bitcoin and Cryptocurrency - The Fraud Blackhole

Many of the publicly-reported, even "spectacular" and notorious DeFi attacks and thefts have involved flaws or vulnerabilities within the Bitcoin or blockchain program. There are suspicions that some of the thefts were perpetrated by insiders. Program vulnerabilities might be considered unique, or deserving of a special category. Since some involve the theft of someone else's cryptocurrency they have been classified as "direct theft scams." Hacking a wallet and stealing funds found there would be an example of a direct theft. A second category is what is known as "transfer scams" or "facilitation schemes" which involve a decision by someone to transfer "coins" to someone else. They get that description because they are "facilitating" the payment of cryptocurrency or digital assets to criminals. Ransomware scams, where someone pays the criminal to unlock encrypted files, might fall within this category. At the same time, threatening an individual or organization in order to make them pay a ransom, seems a little different from persuading them to voluntarily send payment as part of an investment or as payment for an expected service. Broadly speaking, some cryptocurrency scams are variations of familiar traditional fraud schemes, facilitated, or completed by the transfer of cryptocurrencies. The major difference is that they can be completed very quickly - more quickly than traditional banking or money transfers. Somewhat more difficult to classify are activities, such as crypto mining, which involve more the theft of electricity or computer resources, than the "coins" themselves. What category do the BNB Smart Chain Attack or the Nomad Bridge Attack fall within? Both involved the exploitation of system or program vulnerabilities to mint new coins. Another grey area is the manipulation of market prices, where perpetrators artificially increase crypto asset prices, sell their holdings, causing the value to fall. The victims still have their cryptocurrency assets, but the value is now zero or close to it.(20)

Apart from the various types of fraud involved directly or indirectly with crytocurrency transactions, there is an associated area related to other criminal activity. Money laundering would fall under this category. The perpretators are not stealing from the crypto broker or service used to transfer funds, but are using the service to cover for a fraud or theft against someone else.(21)

Bitcoin and Cryptocurrency - The Universal Solution

Bitcoin and the blockchain and cryptocurrency variants which followed seemed to offer solutions to a number of problems - or at least they were marketed that way. Fraud was just one. The solution to that was to have participants verify all transactions, and only to certify, by majority vote, transactions which were valid. There was a permanent ledger, or record, of all the transactions in the chain from beginning to the current end, which could not be changed, and which could be checked. For those who did not like the centralized control and bureaucracy associated with banking or government, they promised the elimination of the middle-man. People could avoid fees, reduce costs, and paper work by dealing directly with another party. For those who did not like the Big Brother feeling associated with the disclosure of personal or confidential information, they offered anonymity and privacy. The use of encryption within the program offered security. At the same time, blockchain offered a form of transparency, where transactions were available and disclosed to everyone - an unchangeable ledger of transactions. In overall terms, blockchain technology offered the promise of a more "democratic" system, where all the participants got a say, a vote, in how the system was to work, along with the ability to participate without external control or oversight. The promised solutions, seemingly simple answers, did not totally address problems on the computer and technological side. There were unexpected challenges and problems which had not been encountered or solved. Optimistically, whatever problems were encountered could eventually be overcome.

If the technological problems seemed relatively small, they proved more challenging than initially expected. A distributed computer network, where each participant had to be notified and given a chance to respond, took time. In addition, there was what has been called the "Byzantine Generals Problem," which posited the need to coordinate an attack on a city by the ancient Byzantine army. What if a messenger got lost or captured, one of the generals was a traitor and changed the message, or there was a change in plans with the need to send a new message. In modern computer system terms, what if one of the computer connections went down - how would it be detected - or what if an intercepted message was altered - how would that be detected and dealt with.(22)

Blockchain, bitcoin, and all other cryptocurrencies operate in what is known as a distributed system environment, i.e. an environment involving a collection of different computers and users. There are several definitions of what a blockchain is. "Blockchain is an ever-growing, secure, shared recordkeeping system in which each user of the data holds a copy of the records, which can only be updated if a majority of parties involved in a transaction agree to update. (Layman's definition)" "Blockchain is a peer-to-peer, distributed ledger that is cryptographically secure, append-only, immutable (extremely hard to change), and updateable only via concensus among peers. (Technical definition)" "Blockchain is a distributed public ledger that records information about transactions in a cryptocurrency network."(23)

A distributed system is a computing system where two or more players (computers) work with each other in a coordinated manner to achieve a common outcome. In this context, the term used to describe the players is a node. In order to keep track of changes/updates to a blockchain, a distributed system uses distributed ledger technology (DLT), which is a mechanism that enables a disbursed group of participants to ensure the synchronized and shared recording of data without the presence of a central administrator. The idea of a distributed ledger is that the ledger is spread across the network among the peers (members) in the network, and each peer holds a copy of the complete ledger. The distributed ledger system combines the ideals of democracy - everyone gets to vote on what gets included in the blockchain ledger - with "consistency" - the property that ensures that all nodes in a distributed system have a single, current, and identical copy of the data. In reality, the need for two-way communication - a question and response, including the transaction review - between nodes involves a time delay which is both a virtue, when it allows time for review and agreement, and a deficiency, since it means that an identical copy may or may not be current, i.e., available at the same time. The time delay may be signficant. At one time, Bitcoin was only able to process about three to seven transactions per second. The longer the blockchain, the slower the processing time. What was offered by way of defense to this criticism, was that consistency would be achieved over time - something called "eventual consistency" - multiple nodes would validate blockchains over time.(24)

Fraud - The Problem Which Won't Go Away

Advocates of bitcoin, blockchain, and cryptocurrency tend to downplay or disregard fraud or vulnerabilities. They will concede there are problems. They will at least mention them. Once brought up however, the list seems to grow and grow and grow. It brings to mind a scene from the Monte Python movie "Life of Bryan," for those who have seen or remember it. The John Cleese character, speaking to a meeting of followers, asks the question: "Well, what have the Romans done for you?" One audience member answers: "Well, the streets have been paved." The response was "Apart from the streets, what have the Romans done for you?" Another audience member responds: "They did construct an aqueduct which brought water into the city." The response was "Apart from the paved streets and the water system, what have the Romans done for you?" Another audience member answers: "Well, the Romans did stop attacks by robbers and thieves, so it was safer to travel." "Except for the paved streets, the water system, and safer roads, what have the Romans done for you?" By the time the scene ends, the manifesto attacking the Roman administration contains a long list of exceptions.

The list of problems associated with blockchain and cryptocurrency really needs to be divided into two categories. One category is the more traditional fraud-related schemes, which have been subdivided into types with their own names. The other category is the internal or built-in vulnerabilities of blockchain technology and systems. The more traditional scams have been given their own names, such as romance scams, rug pulls, pig butchering scams, investment scams, pump and dump, and celebrity impersonation scams. The names provide clues as to what they involve. In the blockchain vulnerability category, the descriptive names are different and not quite so obvious, such as a 51% attack, a Sybil attack, an eclipse attack, and a nothing-at-stake attack.(25)

Romance scams, as the name suggests, involve a fraudulent romantic relationship where one person tricks another person into giving them items of value, under the impression that there is real relationship. They sometimes begin with the use of online dating platforms. A rug pull scam is a type of scam where criminal developers create a seemingly legitimate project, trick investors into investing in the project, and then abandon the project, but not before running off with the invested funds. The name comes from the fact that the criminals "pull the rug out from under" the investors. Pig butchering scams get their name from the real-life process of fattening a pig before slaughtering or butchering them. While it is usually associated with romance scams, it can be applied to any type of scam. It involves a long-term relationship where the victim is persauded to send or invest larger and larger amounts of money, before the perpretator withdraws the funds. Various social engineering techniques can be used to convince the victim that the relationship is real.(26)

Investment scams involve the solicitation of funds for fraudulent purposes. In one sense it is just a generic term for any number of scams involving requests for money, although it is narrowed down to those scams which deal more with more the investment field and investment opportunities. Initial coin offerings (ICOs), where promoters invite investments in start-up cryptocurrencies, if fraudulent, would fall into this category. In 2017 there were a large number of ICO start-ups, which led to the ICO boom and bust of 2017. By one estimate as many as 80% of ICOs were fraudulent, costing investors hundreds of millions of dollars. Pump and dump schemes are not necessarily anything special, just another way of promoting a scheme. Pump and dump schemes are orchestrated attempts to artificially inflate the price of cryptocurrency through coordinated buying, followed by a mass sell-off by the orchestors at the expense of other investors. The "pump" phase involves disseminating information, frequently misleading or false, to hype the investment. This is followed by the "dump" phase, where the orchestrators sell their holdings at an inflated price. Celebrity (and corporate) impersonation scams involve the creation of fake accounts or websites, made to resemble the accounts of celebrities or corporations. Sometimes these involve false endorsements which appear to have been made by the celebrities.(27)

Flash loans, in terms of fraud, fall into a category of their own, since they usually involve one person rather than a group of investors. The amount of loss depends on the size of the loan. They are a form of borrowing where the borrower does not need to put up any collateral - a form of unsecured debt, like credit card debt. They involve smart contracts where the borrower is expected to take out a loan and repay it in a single transaction. One form of fraud involves market manipulation where the borrower actually repays the loan, but in devalued cryptocurrency. The lender is stuck with a cryptocurrency which is worthless, while the borrower may have profited by selling the borrowed currency at inflated prices.(28)

Fraud - The Blockchain Version of Insider Trading

The one thing that made Bitcoin and blockchain different was that blockchain had solved the fraud problem. The chain in blockchain was a permanent record of every transaction since the beginning of Bitcoin. The chain was immutable, which meant it could not be changed. Any changes would be found out. As a result, it was virtually impossible to counterfeit Bitcoin or commit fraud without being discovered. At least that was the claim. It turns out that claim was not entirely true.

It turns out that blockchain, Bitcoin, and other cryptocurrencies, are not immune from attack, are just as vulnerable, and are just as likely to be attacked and hacked as organizations and individuals are on the Internet. Some of the attacks and vulnerabilities come from the Internet itself and represent an external threat outside Bitcoin. Other threats come from within - blockchain contains its own vulnerabilities, which can also be exploited and manipulated just as effectively, although in different ways. One external threat comes from malware. Blockchain is created using computer code. With malware, it is possible to insert malicous code into the operating code, allowing the perpetrator to make changes to results, such as changing a transaction ID or sending output to an unknown address. Crypto malware, which allows for the use of someone's computer resources to mine for new crypto coins, can be inserted into browsers. Finally, attackers can execute a Denial of Service (DoS) attack on an individual node (computer) within the blockchain. The attack would overwhelm the node with bogus requests, preventing it from processing legitimate transactions, in addition to slowing down response time.(29)

Blockchain relies on a majority vote system, known as a "concensus" protocol, to determine which blockchains are valid. Despite the claims that concensus serves as a barrier to fraud, it is possible to defeat or rig the vote so that the official declared winner is not the actual winner, In other words, there are vote-buying schemes available which can change the results. There is more than one, and they use different methods, which gives them different names. Among those names are 1) A 51% attack; 2) Selfish mining; 3) An eclipse attack; 4) A Sybil attack; and 5) A nothing-at-stake attack.(30)

The 51% attack is named for the 51% ownership required to control voting within a network. When a miner or group of miners controls more than 50% of the mining power on a network, they have the ability to control or determine the confirmation of transactions on the blockchain. Ideally, only legitimate members of the group should be able to vote to determine whether transactions are valid and can be added to a chain. Potentially, this can allow a malicious user to engage in a double-spend attack, where they send the same cryptocurrency or token to two or more different recipients, effectively spending the same funds twice.(31)

Selfish mining, sometimes known as shadow mining, is not so much at attack on the network, but a mining process used to gain an advantage over other miners on the network. It occurs if a miner solves the puzzle and discovers a new block. Rather than passing it around and letting other nodes work on the new blockchain, it is not broadcast. The miner can continue mining new blocks and release them all at once at some future time. Once confirmed as accepted, the miner can take all the transaction fees and block rewards - additional coins. There is also a potential for double-spending by spending crypto assets without including those transactions in the blocks. Instead a transaction transfers the funds to a controlled wallet.(32)

An eclipse attack involves the isolation of a node from the rest of the blockchain network, effectively "eclipsing" them and preventing them from communicating with other nodes and stopping them from receiving new information. The attacker can control the information the node receives, potentially preventing that node from receiving current chain copies, along with participation in voting.(33)

The Sybil attack takes its name from a psychological study of a woman, named Sybil, who created multiple identities. It can take a number of different forms. An attacker creates multiple fake identities, or "Sybil nodes" which allow the attacker to increase their influence over the network, often with the goal of gaining enough shares to take control of concensus voting, which would allow them to outvote the honest nodes on the network. There are a number of possible results. The nodes can take over a network and refuse to recieve or transmit a block, rendering the network useless. In addition, they can reorder transactions, censor transactions, and effectively take over the entire network. One way this can be done is to send multiple requests, from fake addresses to a node requesting admission to a network. The target node will assume they are valid requests and include them in its network. In addition to its impact on voting, the victim node may be flooded with transactions, either slowing down the transaction response time or, at worst, so overwhelming the node that service is denied to that node - a Denial of Service (DoS) attack.(34)

A nothing-at-stake attack is a situation where an attacker is admitted to a network without putting up coin collateral. One solution to the problem of fake applicants is to require them to put up cryptocurreny as collateral in what is known as a Proof-of-stake (PoS) within a smart contract. The assumption is that only valid crypto miners would have accumulated large amounts of cryptocurrency. To prevent cheating the PoS is supposed to be validated. However, some PoS based blockchains do not require any collateral. The attackers in a nothing-at-stake attack, as a result, can be admitted anyway, which allows them to vote on multiple chains, potentially undermining the integrity of the network.(35)

The Zero-Day Attack

The idea of a zero-day attack may have been around for a while, although it is only within the last few years that it has seemed to enter the vocabulary of the cyber security field. Then everyone started talking about it. Vendors began talking about it at conferences. Companies began issuing patches for vulnerabilities they had just identified. Then were successful cyber attacks, attributed to a zero-day vulnerability. A zero-day attack is a new attack that uses a previously unknown vulnerability in operating systems, applications, or other software packages or code and for which no known mitigation or patch exists. The vulnerability, usually revealed when a cyber attack is successful, has been there all along, but the software or system operators or creators weren't aware that it was there. It should not be confused with the concept of "zero trust," which is a network security approach involving the verification of incoming traffic.(36)

The subject of zero-day vulnerabilities or attacks didn't come up much in promoter conversations about Bitcoin or blockchain, which focused more on the existence of an immutable chain which would ensure that any changes would be discovered. Technically that is true, but it may not be practical to try to verify which transactions are valid. Bitcoin, when it was first implemented, was an open-source project which allowed anyone to contribute code, and was simply known as "Bitcoin." As it grew, it evolved into what is known as "Bitcoin Core." In order to keep up-to-date, you would need a lot of computing power, a lot of storage space, and a lot of time. Bitcoin Core keeps a full copy of the blockchain by default, with nearly every transaction ever confirmed by the Bitcoin network since its inception in 2009. An initial download requires downloading and processing over 500 GB (gigabyte - approximately one billion bytes) of data. Once that has been done there are about 400 MB (megabyte - approximately one million bytes) of Bitcoin transactions per day. The speed of the initial download will depend on the speed of your CPU and Internet connection, but may take several hours or days. (That estimation is based on figures for 2023, which may not be current.)(37)

Bitcoin Architecture - Layer After Layer

Bitcoin Core and the sheer size of the entire blockchain should be one red flag when it comes to the possibility of zero-day vulnerabilities. In addition, Bitcoin and blockchain technologies represent only a small portion of the entire Internet, which is struggling to keep up with the growing number of attacks. Almost daily there is another headline reporting a successful attack, the release of a new patch, and a new zero-day vulnerability. It should come as no surprise that Bitcoin and other cryptocurrencies, mirroring the Internet, would suffer from the same vulnerabilities. Blockchain operates in, or is dependent on, a number of different technologies and operations, sometimes viewed as "layers." Each layer has its own vulnerabilities, which can serve as an attack surface. One classification system uses five layers: 1) Hardware layer; 2) Network layer; 3) Blockchain protocol layer; 4) Blockchain application layer; and 5) Interface layer. Separately, there might also be a sixth category, a Cryptography layer. It is not really a separate layer, since it exists in all the layers. (While it can serve as another attack possibility, it is much more difficult to attack.)(38)

The hardware layer is the core hardware on which a blockchain network node runs. The hardware layer is vulnerable to two main types of attacks: 1) Cryptojacking and 2) Denial of Service (DoS) attacks. Cryptojacking is a method of taking over a computer or web browser to mine for cryptocurrency without the user's permission. This is usually done through a malware called crypto malware, which can infect operating systems including Windows, Linux, macOS, iOS, and Android. It can significantly reduce machine performance as CPUs and GPUs (Graphical Processing Units) are running the mining process instead of their usual expected operations. In a Denial of Service (DoS) attack on a blockchain node, the attacker floods the node with a large number of requests, overwhelming it and preventing it from processing legitimate transactions. This is likely to impact the concensus (voting) process by delaying a response and potentially allowing a non-legitimate chain from being selected. The hardware layer may also be vulnerable to attacks unrelated specifically to the crypto process, such as remote execution attacks via open ports, which involve the insertionn of malicious script into the operating system or the node software.(39)

The network layer is the core network layer on which blockchain protocols run. This layer includes protocols like Transmission Control Protocol/Internet Protocol (TCP/IP), Peer-2-Peer (P2P), UDP, as well as other services and protocols. Attacks at the network layer can involve various methods used to attack networks, including those discussed, such as the Sybil attack, DoS attacks, and Eclipse attacks. In addition, there can be network spoofing attacks where an attacker sets up a node which impersonates the boot node (a node which is hardcoded in the node client software downloaded by the client). If the false node is good enough to appear genuine new nodes may connect to it instead of the real network node.(40)

The blockchain protocol layer is the layer where concensus, transaction execution, incentive management, and mining processes run. Concensus protocol attacks can include those mentioned, such as a 51% attack, selfish mining, an eclipse attack, a Sybil attack, and a nothing-at-stake attack. In addition, there is a double-spending attack, in which a malicious user sends the same cryptocurrency or token to two or more different recipients, effectively spending the same funds twice. There is also a stake grinding attack, which involves trying to bias the validator selection algorithm to favor the selection of the attacker's validators. This would result in the attacker's validator being selected more than their fair share, allowing them to mint more unjustified rewards. Transactions can be attacked through the injection of malicious code or infection by a virus. Hackers can modify the script, which might allow a change to a transaction ID or the embedding of malicious code which would cause nodes to malfunction. Another category of attack is a transaction replay attack, where the attacker captures a valid transaction from a network, and tries to reuse it by "replaying" it on the same of a different network.(41)

The blockchain application layer is the layer that consists of smart contracts and virtual machines. A smart contract is a secure and unstoppable computer program representing an agreement that is automatically executable and enforceable. While smart contracts can be used in many situations, they have been adapted in the field of cryptocurrency to facilitate transfers of crypto assets. They have a number of vulnerabilities: 1) The transaction ordering dependency bug, which involves the manipulation of transactions so that any given transaction can be submitted another transaction; 2) Timestamp dependency bugs occur when the timestamp of the block is used as a source of decision-making within the contract. Its vulnerability is that miners can manipulate the timestamp; 3) Send fail issue is a situation where funds intended to be sent to another contract simply fail to get sent; 4) Timestamp dependence is a variation of the timestamp dependency bug, but instead of being related to the smart contract itself, involves the manipulation of other functions relying on timestamps. Functions involving randomness to determine lottery game winners, by manipulating the timestamp, can increase the chances of becoming the next winner; 5) Reentrancy bugs exploit a time differential. The perpretator initiates a new transaction before the first transaction has been completed and recorded. This happened in the DAO attack of 2016, which involved multiple transactions and millions of dollars in losses; 6) Oracle manipulation involves the modification of data provided to a smart contract by an oracle. An oracle, in this context, is a component of a smart contract which stores data from an external source, and allows the smart contract to access the stored data.(42)

Smart contract vulnerabilities represent the largest category of vulnerabilies or source of attacks within the blockchain application layer. The blockchain application layer includes a second category of attacks, connected to smart contracts because they were built using smart contracts, known as Decentralized Finance (DeFi) attacks. These include: 1) Flash loan attacks; 2) Sandwich attacks; 3) MEV/BEV; 4) Stablecoins stability/security risks; 5) Identity spoofing; 6) Forged NFTs; 7) NFT DoS; 8) Unlimited (scarcity-free) token generation; 9) Airdrop hunting.(43)

Flash loan attacks, as discussed, allow an attacker to borrow large amounts of funds, without putting up any collateral. The main problem is that the attacker can manipulate the market in their favor. If they can increase the cryptocurrency price on one exchange, they can gain funds, at which point they will sell the asset on another market. They may walk away without repaying the lender or if, as expected, the price of the original cryptocurrency drops, they may buy it back and repay the loan with a crypto asset that is now almost worthless. Sandwich attacks primarily relate to the Ethereum network. Ethereum charges a fee for transactions, a crypto fuel, which it calls "gas." In a sandwich attack the attacker sandwiches the victim's transaction between two transactions submitted by the attacker. In the Ethereum network, a mining node verifies blocks by starting with the highest-paying transactions and working down, executing transactions in order. An attacker will scan for high-value transactions on the blockchain, then placing a transaction ahead of the victim's transaction. This causes the price of the coin to increase, making the victim pay more. With the price increase, the attacker sells their own coins at the inflated price. Over the period from May 2020 to April 2022, it was estimated that over 60,000 Ether, worth over 72 million dollars, was lost due to sandwich attacks.(44)

MEV/BEV. MEV stands for Miner Extractable Value or Maximum Extractable Value. MEV is a category of what are referred to as "front-running" schemes where block producers can reorder transactions within a block to trade ahead of others in the block queue. A sandwich attack falls under this category. There are software programs known as MEV Bots which identify and trade on MEV opportunities automatically. In addition to "front-running" strategies there is a category called "back-running" where a miner enters a sell order after observing significant bullish (buying) activity. A third strategy is called "exchange arbitrage" in which a crypto asset is purchased from one exchange and then sold for a higher price on another exchange.(45)

Stablecoins stabiity/security risks. Stable tokens or stable coins are not another type of crypto attack but an attempted solution to the instability (market unpredictability) of Bitcoin and other cryptocurrencies. Supposedly, stablecoins are pegged to, or backed by, a stable asset, such as a national currency such as the U.S. dollar or gold. The idea or goal was that the issuer of stablecoin would back the stablecoin by purchasing additional assets when the stablecoin changed in value. Unfortunately, in many cases, the issuer did not follow through with asset purchases sufficient to serve as a reserve. The most famous example is the case of FTX Trading, Ltd., (FTX), and its collapse in November 2022 famous for its association with Sam Bankman-Fried. It had been preceded by, or was part of, the Terra (LUNA) collapse in May 2022, which had wiped out an estimated 60 billion dollars from the cryptocurrency world. FTX creditors lost another 8 billion dollars. Neither Terra (LUNA), which was to peg its currency to the US dollar, nor FTX had backed their currency with a reserve fund, as promised. Instead of backing its currency, FTX had spent large amounts for naming rights for sports stadiums, received high-profile endorsements from sports celebrities, and political figures, such as Bill Clinton and Tony Blair, and made political contributions to the campaigns of both the Democratic and Republican parties.(46)

Identity spoofing is just one form of spoofing, which is broadly the act of impersonating a user or machine. Spoofing can take a number of forms, from creating fake websites suggesting an endorsement by, or association with a famous celebrity, when they have not actually given an endorsement. At the more malicious end, website spoofing can involve attempts to deceive victims into divulging sensitive information like login credentials or financial information. Identity and access control are not unique to Decentralized Finance (DeFi) systems, but they do require some adaptations. One adaptation is the creation and use of verifiable credentials (VC), which involve an issuer, who will maintain some form of registry, a verifiable data registry (VDR). Another adaptation is a decentralized identifier (DID), which are cryptographically-generated generated and verifiable IDs.(47)

Forged Non-Fungible Tokens (NFTs) involve the creation of art, or the generation of art online, possibly using artificial intelligence (AI), by a scammer, who claims it is by a famous artist. In some cases, the scammer may take original art from an artist, copy it, create an NFT out of it, and sell it with their name. In both situations, the original artist is cheated out of their payment. In theory, a non-fungible asset is unique and non-interchangeable, such as an original rare painting by a famous artist, such as Rembrandt. Does an exact-looking replica fall into that category? A perfect copy is unlikely to fetch the millions of dollars which an original Rembrandt is likely to bring at auction. (There is actually a market for painters talented enough to paint perfect copies of famous works. Buyers will pay thousands of dollars for such replicas, simply to display in their homes, with no intention of selling them at auction.) Where digital copies are concerned, anyone trying to prove originality faces an uphill battle. It may be possible to prove that fact, but it may be a waste of time and money to try.(48)

Non-Fungible Tokens (NFT) Denial of Service (DoS) attacks can focus on individual nodes. In a distributed blockchain network, storage in a distributed node carries its own risks. Off-chain storage of actual NFT art may be vulnerable to a Denial of Service (DoS) attack where an attacker takes over of takes down the server where the actual art is stored.(49)

Unlimited (scarcity-free) token generation attacks represent an economic threat to a blockchain. A fundamental assumption of Bitcoin and blockchain technology has been that there would be a limited number of coins produced, leading to a form of relative scarcity. Current economic thinking assumes that scarcity will, over time, lead to inflation, meaning an increase in the price of cryptocurrency and of value. However, if token generation is not limited, resulting in an unlimited supply, then there will be no scarcity. Rather than an increase in value, there will be a decrease or leveling off of the price and value.(50)

Airdrop hunting involves a search for individuals or organizations offering free coins. Sometimes a crypto project gives away free tokens to encourage adoption or investment, known as airdrops. There is nothing wrong with airdrops by themselves, since they can involve legitimate projects. Usually airdrops offer only a small, limited, fixed number of coins intended for a single user. It might be possible for a scammer to create multiple identities (usually just multiple e-mails) and claim more airdrops than intended by the airdrop provider.(51)

Bitcoin Architecture - The Interface Layer

The interface layer, considered as a separate layer by some experts, includes bridges, oracles, governance, user interfaces for Web3 Decentralized Applications (DApps) and Application Programming (Program) Interfaces (APIs). Alternatively, since these components primarily serve, or would be considered blockchain applications, they could be grouped with the blockchain application layer. Some of the attack methods, such as Sybil attacks and Denial of Service (DoS) attacks are somewhat familiar, with their modified versions at work against blockchain applications. A bridge, in the blockchain context, is a platform technology by which users can take digital assets on one blockchain and use those assets in some fashion on another blockchain. Bridges are sometimes called crypto bridges or cross-chain bridges. An oracle can be defined as an interface that delivers data from an external source to a smart contract, in other words a mini-program or component of a smart contract. The term governance normally refers to blockchain voting requirements, such as majority voting by node members, to validate a block. It can also refer, at the technological level, to measures, such as verifiable credentials (VCs), used to athenticate credentials and cryptographic transactions, in addition to the validation of blockchain participants (qualified members entitled to vote), computers, and nodes. Web3 is more of a descriptive term for expected changes in the use of the World Wide Web, not a Web version 3.0. The current web is Web 2, which started to emerge around 2003, with the entry of E-commerce websites, social networking, social media, blogs, and web applications. An Application Programming Interface (API) is software that enables programs or parts of programs to interact. In the early stages of personal computer development, API usually referred to the connection between the various applications stored on a single computer and the central processing unit (CPU). With the advent of the Internet and cloud-based services, there are a number of Web app interfaces - whole programs or programming sections known as microservices - which may be involved in the Application Programming Interface. One microservice might handle user logins, another the inventory database. In this context, APIs mean the interfaces that different parties use to access Web applications.(52)

Bridges, including some operated through exchanges, have had their share of problems. Several high-profile attacks, such as the Ronin Bridge attack, Wormhole (a crypto bridge used to move digital assets between the Solana and Ethereum blockchains) attack of 2022, BNB smart-chain attack, and Nomad Bridge have resulted in the loss of over a billion US dollars.(53)

Oracle attacks/oracle manipulation attacks can be variations of other similarly named attacks, although with other goals and outcomes. Blockchain oracles pose a potential security risk due to their dependence on external information which they, in turn, provide to others. This data can include anything from price feeds (involving crypto asset prices) and market data to weather conditions and election results. The data, if manipulated, or out-of-date, may be incorrect. Supplying incorrect data can result in detrimental consequences for processes relying on it. The manipulation of data can trigger unplanned, unwanted, and unexpected asset liquidations (sales) or other malicious trading practices. There is an oracle version of a Sybil attack, involving the creation of multiple fake identities to gain voting control of the oracles in order to manipulate data fed into the blockchain. There is also a Denial of Service (DoS) attack in which attackers overload oracles with too many requests, making the oracle unavailable to the smart contract and potentially causing it to fail. There are ways to influence decision-making, leading to incorrect decisions, such as tampering with data sources, bribing oracles, or oracle censorship, where attackers prevent oracles from accessing certain data sources. Freeloading attacks involve the use of publicly-available data, such as weather data or crypto pricing, without validation.(54)

Wallets represent another group of vulnerabilities within the interface layer. Phishing attacks are most often associated with e-mail campaigns. However phishing, more broadly, involves something that poses as a trusted source but attempts to deliver a malicious payload or gather personal or sensitive information from an individual, such as social security numbers or credit card information. Often, if they are part of an e-mail campaign, they direct the recipient to click on a link or log in to a website to provide requested information. The crypto wallet version involves the creation of a stand-alone fake wallet website or app that looks similar a real one, tricking users into revealing their seed phrase or private keys. Malware attacks are another broad category with their wallet version where the malware infects a computer or mobile device with the goal of accessing a cryptocurrency wallet and stealing seed phrases or private keys. Man-in-the-Middle (MITM) involve a situation where an attacker inserts themselves between the victim's computer and a website or server. It allows them to intercept information, such as log-in passwords, before forwarding the victim's information to the real site. There are any number of ways to execute this type of attack. In the crypto version the attacker intercepts and manipulates transactions by posing as a trusted entity during the communication between the wallet and the crypto network. It could involve almost any cryptocurrency.(55)

Hardware wallets represent another vulnerability, or series of vulnerabilities. Some involve attacks, which can involve modification of the wallet during production or distribution to gain access to private keys or seed phrases. There can also be physical tampering, where an attacker physically opens the hardware wallet and accesses the private keys or seed phrases stored there. Malware can infect the computer used to connect to the hardware wallet to steal private keys or seed phrases. Man-in-the-Middle (MITM) can be used against hardware wallets. Finally, user carelessness represents another problem. Users can lose hard disks contain cryptocurrency information or the wallets themselves. They can also forget passwords or pin codes to hardware wallets.(56)

Rollup vulnerabilities represent another problem. Rollups are a form of compressed version of a blockchain, intended to solve the problem of blockchain size. As blockchains became longer and larger it takes longer to process and transmit responses. Rollups are independent blockchains, executed through smart contracts, which process blocks of data, essentially transactions considered the most important, with a means of validating and preventing fraud. The main advantage of rollups is faster execution speed, since they are processing only part of the blockchain, and not the entire chain. To the extent that rollup services are centralized through the use of a single rollup provider, they may involve the risk of "transaction censoring" which is a form of manipulation which involves blocking transactions from a particular address. In addition a rollup provider could be attacked through a (DoS) attack, viruses, malware, or network attack.(57)

The interface layer, finally, is the layer where some of the most high-profile bridge or cross-chain bridge attacks have taken place. A bridge or crypto bridge, as discussed, is a platform or technology, by which users can take digital assets on one blockchain and use those assets on another blockchain. These included the Ronin Bridge attack, the Wormhole attack, the BNB smart chain attack, and the Nomad Bridge attack. The combined loss was over a billion US dollars. The Terra (LUNA) collapse of 2022 wiped out between 50 and 60 billion dollars.(58)

Dark DAOs, Dark Money and Collusion - Voting Fraud

Dark DAOs are a relatively recent phenomenon (or at least recently discovered) where vote buying can occur without detection. Dark DAOs operate by accumulating votes in secrecy, leveraging the anonymity provided by trusted hardware to orchestrate large-scale vote-buying schemes without revealing the identities of participants or the extent of their influence. The idea of gaming the system through vote manipulation did not begin with Dark DAOs. The 51% attack or the Sybil attack, which involves the creation of multiple identities to gain a majority are other examples of voting schemes. These have been mentioned in the context of a scheme perpetrated by an individual. This does not mean they are necessarily limited to single actors. Multiple block members can collude, or agree, with other members to vote together. Collusion may not even leave much of a "paper trail," with e-mail records saying "let's vote together." Members may form an agreement over the phone. Another variation, on-chain vote buying, seems a hold-over from the big city machine politics of earlier eras. On-chain vote buying, using smart contracts, involves the transfer of value, in the form of cryptocurrency, in exchange for votes. The ease with which a new cryptocurrency can be launched and promoted also means that vote manipulation does not have to begin only after a crypto asset has been in existence for a while. Voting can be rigged from the start, planned and implemented, even before the launch date.(59)

Attacks on voting can take different forms. Bitcoin blockchain rules require a majority vote to validate blockchain transactions before they are added to the blockchain. This can impact the blockchain itself, since only validated blocks are supposed to be added to the blockchain. Majority approval of fraudulently validated blocks is also likely to lead to the approval of other fraudulent transactions, such as approval of token transfers to hackers. Voting attacks, whatever their form, have been referred to as governance attacks.(60)

Social Media, Social Engineering, and New Versions of Old Tricks

Social media is the term used to describe the various media platforms people use to communicate, convey ideas or socialize on the Internet. It includes websites, apps, and social networking sites. Social networking sites are websites where users can build a personalized community (of other users) to socialize with. Examples include Facebook, LinkedIn, Twitter, Instagram, Snapchat, and Pinterest. Social engineering is the process of using, manipulating, or persuading people, usually to obtain information or to take some action in furtherance of the perpetrator's goals. Social engineering techniques include use of authority figures, intimidation or threats, concensus or group association, rewards, urgency, familiarity/liking, and trust.

There are a few problems with classification, when it comes to fraud. Is it better to classify fraudulent scams as traditional fraud, with updated Internet variations? Or is it better to give them Internet or crypto categories, but organized using traditional fraud names. Some of the traditional fraud schemes are familiar or at least descriptive enough to easily know what they involve, such as insurance fraud, credit card fraud, romance fraud, bank fraud, and election fraud. Some names may be familiar, such as Ponzi schemes and Pyramid schemes, although not familiar enough to know what they mean. A second problem is that advances in technology have allowed for more sophisticated cyber attacks, with highly realistic fake websites or other advanced techniques to deceive users. Such tactics are not limited to the world of Bitcoin and cryptocurrency scams, but are placing the entire Internet at risk of attack. Cryptocurrency scams and attacks are more of a subset of the field of cybersecurity.

Deepfake technology is one area where new developments have created new attack opportunities. Deepfake technology is a form of electronic analysis and output capable of generating realistic copies of images, videos, or audio combined with the ability to interact with victims. It is an advance over the tape recorder or movies, which could create realistic copies. Deepfake technology can seemingly react or interact with individuals in a realistic manner. It has been convincing enough to cause individuals to make large money transfers under the impression that they were speaking to a company executive. That is the real financial world. Other similar advances have involved e-mail phishing, fake job postings, investment schemes, and fraudulent dating profiles. They are part of the arsenal of attacks in the real world, but have their counterparts in the crypto world.(61)

The advanced tactics have inspired various specialist services and new terms: Attackers-in-the-Middle (AITM), Phishing-as-a-Service (PhaaS), Interactive Voice Response (IVR) Phishing, Deepfake Frauds, and Artificial Intelligence (AI) Powered Phishing. The terms may be new, but they are only variations of familiar technology. They also represent significant advances in cyberattack capabilities generally, with applications in the Bitcoin and blockchain environment. The only blockchain variant with a unique name is what has been called a "honeypot scam," which, because of its characteristics, has usually been applied only to cryptocurrency fraud. (It is likely to be applied more broadly in the future as a category of malicious attacks because of the way it attacks.)(62)

The term honeypot is already in use in the cybersecurity world. It refers to a decoy system or deception mechanism intended to look realistic to attract attackers. It can serve only as an attack target so that attackers do not attack a real target. It is also used as a method of learning about an attacker by getting the attacker to begin its attack, if it can fool the attacker into operation. (Sometimes this works, but attackers have also developed defense mechanisms of their own, designed to differentiate between a decoy and a real target. If they sense they have been trapped by a decoy, they stay in a state of hibernation.) Crypto honeypots, while intended to attract potential vicitms, operate differently. They mostly focus on potential crypto investors. Even if their fake websites look realistic enough, individuals not interested in buying cryptocurrency are not likely to click on the website links, to provide any information, or to make an investment. Honeypot scams are usually done in connection with a crypto promotional scheme, where there is a promise of high returns and little information about the nature of an investment or who is behind the scheme. The main difference is that, once invested, the victim may find their crypto coins or tokens locked, thus preventing them from making withdrawals or selling their assets. Only the scammers may be able to sell. If the victims have provided personal information, the scammers may be able to use that to conduct other attacks.(63)

How big a role Artificial Intelligence (AI) will play in the world of cybersecurity and crypto fraud is unknown at this time. In August 2023 researchers uncovered a botnet connected to ChatGPT which they named Fox8. A conglomerate of some 1140 accounts on X, (formerly Twitter), connected to a variety of crypto website which used some variation of the Fox8 name. ChatGPT was used, according to the researchers, to draft posts on the social media platforms that would reply to each other. The goal was to get human victims to click through to the Fox8 network of crypto scam sites. Artificial intelligence was also believed to have been used by criminals involving a combination of romance scams and fake crypto trading schemes, categorized as CryptoRom scams. The ability to personaize user experience by analyzing user behavior and preferences and crafting believable responses makes it an ideal mechanism for fraudulent activities - everything from drafting phishing e-mails to creating fake job postings to making celebrity endorsements which appear genuine.(64)

Just what constitutes artificial intelligence can be difficult to determine, especially when compared to the term "machine learning" (ML). Are they interchangable terms, distinct steps, or totally different concepts? Machine learning has been defined as a capability of computing that enables a device to improve responses based on new information without human intervention. Artificial intelligence involves computing devices capable of "learning," assessing new information, and changing actions to accomodate. Maybe machine learning is a step on the path toward development of artificial intelligence, or maybe it's just another variation of artificial intelligence. The distinction is very subtle, if there is one.(65)

The technological advances which enabled the rise of exchanges and crypto trading have also led to the rise of MEV Bot hacks which involve automated trading. The term "MEV" stands for miner extractable value or maximum extractable value. In the mining area, it is possible for block producers to manipulate transactions by reordering transactions to move their orders ahead of other orders in the block queue. By manipulating the price, they can place buy and sell orders to their advantage, if combined with the ability to change their queue location. In Ethereum there is a transaction fee (called gas) charged for transactions. Regular users will effectively be charged higher transaction fees (gas) as a result of the manipulation.(66)

MEV Bots involve more than just crypto mining. In general they can extract value from reordering, inserting, or censoring transactions within a blockchain block. There are two types of schemes generally: 1) front-running, which involve manipulating transactions to create profitable trading opportunities, such as entering buy orders to increase the crypto price and 2) back-running, which involve benefiting from the outcome of transactions after they occur, such as entering a sell order while the price is high, after there has been a price increase. MEV Bot hacks are relatively sophisticated strategies involving both manipulation tactics relating to price, combined with the ability to quickly execute transaction trades to take advantage of the profit opportunities.(67)

Bitcoin and Electricity/Power Grid Availability

The way the Bitcoin program creates more bitcoins involves solving a cryptographic problem. The problem with that problem is that crypto mining requires large amounts of electrical power. For advocates of cryptocurrency, that's just the way the program works. It's a very creative programming solution to a problem. But is it something to be admired, even worshipped, or should it be viewed as a program flaw? Was it possible to design a program which creates new Bitcoin using some other method?

There has been a relatively recent trend in electrical use. Business and other organizations, such as universities have seen a huge, and unexpected, spike in electricity use. It's not limited to organizations. Countries, already facing power outages, have found their power being diverted to crypto mining. The new demand for power is not coming just from crypto mining. There is also the new demand related to the competition for Generative AI. It is believed that the only solution is to add more computing power, which requires more and more electricity. They are constructing huge date centers and contracting for more electricity delivery, placing demands on the U.S. electrical grid.

Data centers involve large banks of computers, which demand large amounts of electricity, and in addition, require large volumes of water for cooling. Both are in short supply. The U.S. electrical grid is struggling to keep up with normal usage, but also unexpected, or expected, weather events. Hurricanes, tornadoes, and fires, of growing severity, have caused regional disruptions.

Data centers and the computer industry, making the headlines, seem to have the upper hand, when it comes to claims on resources - at least for now. Yet, there are other happenings, slowly percolating up or creeping into the news. The shortage of water, in the Rocky Mountain West, is beginning to show up in more stories. Water shortages along the Colorado River are getting hard to ignore - with pictures of dried-up reservoirs appearing more frequently. This has prompted a fight between the states along the river - Colorado, Utah, Arizona, Nevada, and California - as well as Mexico, who rely on its water, about how much each gets to use, and even how clean it must be. Colorado is in a separate water dispute with the state of Nebraska. Water aquifers, reserves of water deep underground, are beginning to dry up, impacting California, Arizona, and Nevada.

The solution, for many companies, is to enter into contracts for future use, such as for electricity. We solved our problem - we have a contract. The problem is that, while contracts give the illusion of permanency, they are unlikely to withstand the pressure future events will generate. Crytocurrency devotees, even the computer industry, as important as its contributions have been, represent only a small part of society, as important as they seem in the current political climate. From a broader perspective, societies are unlikely to tolerate the claims of one group at the expense of the larger needs of society as a whole. Similarly, while advocates of Artificial Intelligence, and Generative AI (GenAI), have insisted there is a crisis which only GenAI can solve, their focus seems to be more on the need to create a newer version (AI version 2.2 or 5.5) of a program for home use which will help with household chores, turn on the lawn sprinkler, or answer questions such as "what are we having for dinner?" The interest is in making a better home-use product which can be sold. Alternatively, another goal seems to be to copy Google's AI model which is fairly good at answering questions and writing answers almost in essay form. (If the writing summaries are fairly complete and informative, it can be a little irritating when you find yourself in an argument about one of the points.) Finding a cure for disease or a solution for unemployment haven't exactly been among the priorities mentioned very often - unless asked about it.

Artificial Intelligence - A Solution in Search of a Problem

Artificial intelligence, for a number of reasons, has moved to center stage, almost taken over, all public discussion. Will it automate manufacturing or office work, displace or eliminate workers, cost jobs, or completely overhaul the economy? Will it create new opportunities? Is it the revolutionary game-changer, which will mean an economic transformation on a grand scale, as claimed? On the other hand, does it represent more of a fad, given prominence because Silicon Valley tech billionaires suddenly became aware of it? The race for global dominance is taking place on many fronts. Militarily, there is a race to develop the strongest, most advanced armies and navies, along with the race to develop the most advanced weapons systems. There is the space race and competition to reach and colonize the moon and Mars. There is the race to expand markets, such as the Internet, along with the expansion of satellite networks which comes with that.

The priority given to AI development is framed in terms of an epic struggle between good and evil. In that context it has been raised to the level of a military or economic contest - where the fate of mankind hangs in the balance. In reality the goal seems more mundane - create a model which can carry on a conversation about any topic which comes to mind. Is that the problem to be solved? As an afterthought, it is suggested that this could be used to find a cure for disease, world hunger, or war and armed conflict. At the same time, it may be wondered why it has been decided that there is only one solution - copying everything that has ever been written and hoping that the patterns revealed will be the answer to the world's problems. Yet this somehow seems at odds with the idea of entrepreneurship where the market determines which ideas win out. From the outside it looks to be just a competition between billionaires to beat each other - but a competition focusing on just one approach, one idea, and one method. That approach, which has decided that the training method involves sorting through large amounts of data. Is it really the only way to train something? Is it the most efficient training method? Are there alternatives which might be better.

The approach to AI development, as currently employed, plays by one set of rules intended for one type of competition. Yet it seems to be confined to just one competition arena. Are there other places to compete? Some may provide more opportunities, or greater challenges, with their own set of rules. Ping pong is one game and being a champion ping pong player is an accomplishment, but what about other games, such as tennis, swimming or running. What about achievements in other fields, such as medicine or business. In the AI area, how will anyone know who won? And what does winning mean? Will victory result in complete dominance, or the total elimination of competition, or just a somewhat bigger market share? It may also be asked, since the practice of "poaching" the leading engineers and employees seems widespread, why are all the participants essentially focusing on the same technology and approaches? This even extends to the use of data centers, the need for more computing power, and the demand for more electricity.

The "doomsday extinction" scenario, may be terrifying. At some point in the future, AI may develop to the point where it is more intelligent than humans, and would be capable of destroying everyone, if it decided to. With so many other current problems and threats, perhaps the question is, how could we tell the difference between an AI catastrophic end and one brought about by some other threat? The COVID 19 pandemic didn't have anything to do with computer technology, nor is the threat posed by global warning. It may be helpful to keep the addage - when you're a hammer, every problem looks like a nail - in mind, when it comes to the computer profession.

In the context of the race for the AI prize, it may be helpful to ask about the sustainable economic foundation which underpins everything. The basic assumption is that winning the AI race and claiming the prize is so important that it must be pursued at all costs - including taking over the power grid and the demand for energy. But if data center electricity use crowds out all other uses no one will be able to afford electricity. How will consumers be able to afford computers or even a connection to the Internet? With that market gone or reduced, will there be any market for AI searches, no matter how good?

The fear among analysts is that much of the investment is based on debt, without any plan or ability to pay it off. Some of the major players have sufficient cash to make large investments without borrowing, so not all investment involves borrowing. In addition, analysts point to the absence of any business model which will provide revenue over the long-term (or short-term, for that matter.) While investors are often criticized for a tendency to focus on immediate profits and returns, there is a growing concern that early product roll-outs have not lived up to expectations.

Most of the advances in technology, computer programming, and computer applications to this point, have come without the use of GenAI. Maybe it will be beneficial, and speed things up, or maybe it will just be another helpful tool. Maybe there are programs available now, or in the developmental stage, which will work just as well.

Ultimately, future events and circumstances will shape societal decisions. American society may come to agree that cryptocurrency and artificial intelligence are important enough to allocate a larger share of resources. On the other, there may be a feeling that, as important as these efforts are, they benefit just a small group of individuals at the expense of other groups or needs. Society has more important priorities to deal with.

Blockchain The Invincible

Bitcoin and blockchain have been marketed as the ultimate answer to centralized control. It would be nice to cut out the middle-man, eliminate unnecessary fees and paperwork, and avoid the control which organizations, such as banks or government, can exercise over what should be the freedom of individuals to make their own decisions. Making a virtue out of necessity, the tendency has been to emphasize the blockchain capability to determine which transactions are valid, as the only standard of measurement which matters, outweighing all other considerations.

Cryptography is being seen as one of the more important considerations, even a necessity, in today's world. Blockchain argues that cryptographic technology plays a central role in its operations, or that it has found a new, even unique, use for cryptography. Unfortunately that special quality does not make it immune to attack. Experience is teaching that blockchain is subject to the same vulnerabilities and attack methods to which the computer world generally has been subject. Immunity is not universal. There is no niche or overlooked space which is immune to attack.

The Genius Act - How stable is Stablecoin?

The Genius Act, signed by President Trump on July 18, 2025 provides a framework for the issuance of stablecoins. The full name is Guiding and Establishing National Innovation for U.S. Stablecoins Act (Genius Act.) It does provide a framework for cryptocurrencies and sounds like it brings stability to a volatile market. There are two things it does not do. First, it does not establish stablecoin as U.S legal tender - a national currency backed by the U.S. government. Second, it does not set the permanent value of stablecoin itself as equal to one U.S. dollar, although that is what it sounds like it does.(68)

Stockbrokers - The Mechanics of Buying, Selling, Margin Calls and Short Selling

In order to understand what the Genius Act does, in terms of maintaining/pegging the value of stable coin at 1 to 1 with the United States dollar or currency, it is helpful to understand the mechanics of buying and selling stock, as well as lending practices, by stock brokers, including margin calls and short selling. Investors who want to invest in stocks or bonds can do it on a strictly cash basis, paying cash for stock purchases, and receiving cash for sales. This works For small investors - or extremely wealthy ones. At the same time, if the investor can increase the size of its purchase, beyond what it holds in cash, and can re-sell the purchased stock at a profit, its profit will be that much greater. For example, buying $50,000 in stock and selling it for $55,000, provides a profit of $5,000, or 10 percent. Buying $1,000,000 in stock and selling it for $1,100,000 yields a profit of 10 percent, but, in dollar terms, providing a $100,000 profit. Buying $10,000,000 in stock and selling it for $11,000,000 yields a profit of 10 percent, but, in dollar terms, providing a $1,000,000 profit. The investor could go to their bank or lender and take out a loan for the million dollars. Another option, in the securities industry, is to borrow the money from the investor's broker. The term used for this arrangement is called "buying on margin," and involves setting up a "margin account" with the broker. Making a huge profit, if the stock goes up, represents the upside of this arrangement. It has a downside, which involves risk - a high level of risk. If the $10,000,000 stock value, instead of going up as the investor hopes, drops to $9,000,000, the investor has lost $1,000,000. With a loan, the investor could sell the stock for $9,000,000, pay the bank the $9,000,000 from the sale, but still need to find $1,000,000 plus interest to pay the bank back the balance of the loan. Similarly, the broker can recover $9,000,000 in the margin account by selling the stock, but will expect the investor to cover or repay the $1,000,000 owed to the broker. In practice, the broker does not suddenly ask for repayment for the total amount. It will track the current price of the stock and issue what is known as a "margin call," where the investor is asked to put in additional cash to cover the difference between the current falling stock price and the amount advanced by the broker.(69)

Regulation of margin accounts and margin trading currently fall within the jurisdiction of different government agencies and organizations. The Federal Reserve Board, normally concerned with banks and financial institutions rather than brokers, nevertheless oversees brokers through Regulation T, which places restrictions on broker margin accounts and sets limits on the amounts which can be purchased on margin. (The Federal Reserve was given responsibility for regulating margin requirements by the Securities Exchange Act of 1934.) The Financial Industry Regulatory Authority (FINRA), a non-governmental, self-regulatory organization whose members are scurity trading firms (brokers) has its own rules covering margin accounts and requirements. The Securities and Exchange Commission (SEC), through Rule 15c2-1, exercises some direct control over margin accounts as well.(70)

The Stock Market Crash of 1929 was one of the more high-profile examples of the risks of borrowing to purchase beyond one's means. In this case the purchases involved stocks and the borrowing mechanism involved stock brokers and margin. There had been earlier crashes, some involving speculation in land, where the lenders had been banks. The lessons learned from 1929 were, whether quickly or not, ultimately forgotten. More recently there was the Dot.com boom, investments in Internet startups, followed by bust, when their promised returns failed to materialize. There was the Savings and Loan Crisis in the 1980s, which resulted in the 1989 creation of the Resolution Trust Corporation to deal with the large number of failed savings and loan institutions. Not to forget the 2009 Recession, which involved institutional investments in collateralized mortgage obligations (CMOs) and another government bailout. In 1929, the margin purchases often involved putting down as little as 10 percent, coupled with the fact that a large number of small investors were involved. When stock prices fell, investors, including individuals, lost pretty much everything. Brokerage firms, entitled to sell the stock held as collateral in their margin accounts, found that the value of the stock kept falling, and, when sold, resulted in a loss.(71)

The Genius Act - Only a Framework

Discussions of the Crash of 1929 and the broker margin accounts may not seem relevant to bitcoin, cryptocurrency and the Genius Act. Margin accounts and the lending practices of brokerage firms represented just one aspect of the larger credit market. The legislation and regulatory framework which followed the Crash were an attempt to restrict unwise lending practices of lenders, whether banks, brokerage firms, or other entities which extended credit, or at least to limit the damage when losses occured. The Federal Deposit Insurance Corporation (FDIC) and the federally-backed insurance on bank accounts, which eventually increased to $250,000, were another such reform measure. Margin restrictions and regulations were not designed to prevent broker lending altogether, but to limit the amounts investors could borrow, beyond what they could afford to lose.

The Genius Act uses language which sounds reassuring. It implies that cryptocurrency which fell within a classification called "payment stablecoin," was now converted from an unpredictable and volatile means of exchange to one of stability and reliability, with a fixed value. While it tries to provide some reassurance and stability, through reserve requirements of digital asset issuers, it does not make a digital asset the national currency of the United States, like coins or currency or Federal Reserve notes. (Some members of Congress, not impressed by the optimistic predictions, objected to making cryptocurrency a national currency.) Stablecoins are not defined as securities under federal securities laws. Payment stablecoins are something "that is not" a national currency or a security. National currency, defined separately, means "a Federal Reserve note," "money issued by a central bank," and "money issued by an intergovermental organization pursuant to an agreement by 1 or more governments." Perhaps just as significant, payment stablecoins are not federally insured. The Genius Act, in other words, is only a framework, not a guarantee. It does not stop investors from buying and selling cryptocurrency or from making a profit, but it will not cover losses, if they occur.(72)

The idea of pegging the value of one stablecoin to one U.S. dollar is a laudable one. Well, good luck with that! The mechanism touted by the Genius Act as the answer is a little cumbersome at best, and, to say the least, not very efficient. In an era of anti-big government and anti-regulation, the Genius Act is just begging for regulation. The Genius Act itself is almost one big regulation. Bitcoin and almost every other cryptocurrency fluctuates on a daily basis. Yet stablecoin issuers are supposed to maintain reserves of real assets, such as US coins and currency, or bank accounts, on a 1 to 1 basis. Each month they must publish on their website the number of payment stablecoins issued and the amount and composition of the reserves backing the stablecoins issued. The following month they must have the information examined by a registered public accounting firm. Apparently that examination is to serve as the basis for a monthly accuracy certification issued by the Chief Executive Officer and Chief Financial Officer. The timeframe seems a little short, involves a lot of calculations and bookkeeping, but is likely to provide a guaranteed source of employment for the accounting and insurance industries, along with the securities industry. (At least it will for those willing to accept the risks involved.) Well, good luck with that too!(73)

The Genius Act and discussion of its implications sheds light on the problems of regulatory control of an emerging technology. It somewhat mirrors the wider problems involved in dealing with the Internet as a whole. As important as cryptocurrency regulation seems now, the world of cryptocurrency is just one priority, whether big or small, among many, in dealing with computers and information technology.

The Bank Secrecy Act of 1970

If the Bank Secrecy Act is about secrecy, how come it shows up in a Google search? The Bank Secrecy Act, despite what its name sounds like, was not about keeping banking activity secret, but about exposing activities in the "underground" or secret economy, such as money laundering, tax evasion, drug trafficking, and other criminal activity to the light of day. Its name is actually the "Currency and Foreign Transactions Reporting Act" and its intent, at the time, was to discourage the use of currency in illegal transactions. Cash deposits, withdrawals, or transfers of $10,000 or more must be reported, if made within the United States, and $5,000, if into or out of the United States.(74)

With Bitcoin, blockchain, and the Genius Act dominating the headlines, the temptation is to discount traditional banking laws. The Bank Secrecy Act, updated with more recent amendments, may be the one constant which remains constant in banking legislation. Perhaps the only other constant in the banking sector is the Federal Deposit Insurance Corporation (FDIC) and the Deposit Insurance Fund (FIC), which insures depositor accounts for $250,000. It was part of the Banking Act of 1933. (The $250,000 insurance or, at least the idea of federal deposit insurance, is the one constant which has survived. The amount itself has not been a constant, but has changed over time.) Banking legislation could not be said to be constant. It swings between a desire to protect consumers, with greater regulation, on the one hand, and a relaxation of regulations, favoring financial institutions, on the other.

The debate over Bitcoin and blockchain, which culminated in the Genius Act, mirrors the larger debate between two conflicting goals: 1) Protecting society from threats and 2) providing individuals with freedom. On the protection side, the money laundering, fraud, and criminal activity aspect of cryptocurrency represented the government interest in protecting society. Providing individuals with freedom, in contrast, epitomized the free market ideal - freedom from regulation, a desire to be free from government intrusion, a desire to be free from unnecessary bank charges and fees, and in general, the individual's desire to conduct their affairs with minimal regulation.

Surprisingly, the basic requirements of the The Bank Secrecy Act have managed to survive almost intact since 1970. The $10,000 threshhold for reporting was the number enacted into law in 1970. (Perhaps it was feared that setting a lower amount would overwhelm the system while a higher amount would allow too many transactions to slip through.) In addition to maintaining records, financial institutions must file Suspicious Activity Reports (SARs) on a regular basis.(75)

The Bank Secrecy Act was strengthened by the passage of the 2001 USA PATRIOT Act. Title III of the act had its own title, the "International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001." The new provisions criminalized the financing of terrorism. It also augmented the existing BSA framework by strengthening customer identification procedures; prohibiting financial institutions from engaging in business with foreign shell banks; requiring financial institutions to have due diligence procedures and, in some cases, enhanced due diligence (EDD) for foreign correspondent and private banking accounts, and improving information sharing between financial institutions and the U.S. government.(76)

Fair Credit Reporting Act (FCRA) of 1970

The Fair Credit Reporting Act (FCRA) of 1970 was an attempt to deal with the transformation of the credit card industry from a paper-based record-keeping system to a computerized one, contained in single, centralized, database. At the time the threat was seen as coming from the private sector and the fear of a "surveillance society." Over time, the threat of a "surveillance society" would be expanded to what it is now, including not only private entities, but government efforts to collect data as well. The focus of the FCRA was primarily the credit card industry. It was intended to ensure the confidentiality of consumer credit information held by lenders and credit reporting agencies. It prohibited the disclosure of credit files, other than for specific purposes, such as employment, insurance, and bona fide credit applications. It also required credit bureaus to give consumers a copy of their credit report when requested, and specified procedures which allowed consumers to disputed information in a credit report.(77)

Fair and Accurate Credit Transactions Act (FACTA) of 2003

The Fair and Accurate Credit Transactions Act (FACT) or (FACTA) of 2003 was an amendment to the Fair Credit Reporting Act (FCRA) of 1970, intended to correct deficiencies of the FCRA. Key provisions of the FCRA, which preempted State law, were set to expire on December 31, 2003. Industry wanted the preemption made permanent, so that individual states could not pass their own laws. Consumer and privacy groups, in contrast, felt that privacy concerns and fair information requirements were largely being ignored by industry. In addition, there was a growing awareness of identity theft as a growing problem, with one major source of the problem being credit reports. FACTA gave consumers the right to receive one free copy of their credit report annually and required credit bureaus to disclose credit scores to individuals.(78)

Gramm-Leach-Bliley Act (GLBA) of 1999

The Gramm-Leach-Bliley Act (GLBA) of 1999, also known as the Financial Services Modernization Act of 1999, repealed parts of the Glass-Stegall Act of 1933 and the Bank Holding Company Act of 1956. One of its main goals was to make more financial services available to consumers. Which financial services were successful would be determined by the market, not regulators, and the free market would replace government regulation. There was also the concept of "functional regulation" where regulation would be subdivided into different categories: banking would be supervised and regulated by the banking agencie; insurance activities by the state departments of insurance; and securities transactions by the Securities and Exchange Commission (SEC) and state securities divisions. The modernization was to be accomplished by allowing business affiliations between banks, securities firms, and insurance companies through a structure called a financial holding company. It turned out to be a case of "it worked until it didn't." In 2008, the near collapse of the financial markets was blamed on the conglomerates created after Gramm-Leach-Bliley, and led to the passage of the Emergency Economic Stabilization Act (EESA) of 2008. This was followed by the Dodd-Frank Act of 2010, which brought back government regulation, although in not quite the same form. It also sought to restore some consumer protections.(79)

Blaming the 2008 collapse entirely on the Gramm-Leach-Bliley Act, and its repeal of the Glass-Stegall protections, seems to be a popular explanation. It is a convenient scapegoat for everything, and probably does deserve its share of the blame. Some have questioned the assumption that GLBA was entirely to blame. While conceding that it played a part, they point to a complex set of contributing factors. Advances in technology alone, with an increasing reliance on computers and electronic communications, had created a larger geographical network - the entire United States and even the world. Information was available almost instantaneously, and to a wider audience. The world of 1929 made Wall Street and New York the center of the financial world, with information trickling out slowly. Television had not been invented and the fastest means of popular communication was the radio. Newspapers provided fairly up-to-date information to a national audience, but there was a lag of a day or two before it was available. The world of 1999 confronted a different reality. Information, whether financial or general, was available almost instantaneously through television, radio, telephone, or through the Internet. Financial information, whether on a grand scale, such as international central bank operations, or on the mundane level, such as local bank interest or mortgage rates, was now available to anyone who wanted it. With all these changes, Gramm-Leach_Bliley, was just catching up to reality - whether that reality was technological or economic.

One economic reality was consolidation within the banking industry. In 1984 there were 14,000 commercial banks. By 1999, the year of Gramm-Leach-Bliley, there were fewer than 9,000. If the number of banks had fallen, they were expanding financial services. Where Glass-Stegall was intended to separate commercial banking from investment banking from insurance, some commercial banking organizations in the late 1980s were beginning to underwrite securities anyway (stocks and corporate bonds), and a few were also selling insurance. GLBA was, not so much, an attempt to prevent such activities, but an acknowledgement of existing practices, along with an attempt to align legislation with practices, and to provide a control framework. Perhaps the real shortcoming of GLBA was that, while it gave the Federal Reserve Board greater responsibility on paper, there may have been an assumption that federal agencies, such as the Securities and Exchange Commission, as well as state agencies, would continue their normal oversight activities as usual.(80)

The temptation is to blame everything on the banking industry, with Gramm-Leach-Bliley being a kind of stand-in for the banking industry, which, in turn, serves as a kind of shorthand for the 2008 collapse. Credit default swaps, a new financial mechanism, seemingly arising out of nowhere, is sometimes mentioned as a contributing factor. There were some seemingly unrelated financial events, which occurred around this time - the 1998 Financial Crisis, starting with Russian markets, followed by the Dotcom Bubblem, which actually began around 1995, reached its peak in March 2000, and impacted the markets until October 2002. This was followed by the Subprime Mortgage Crisis, which lasted from 2007 to 2010, considered the immediate cause of the 2008 collapse. The only common thread, or threads, seems to be unrealistically high earnings expectations, too great a reliance on credit, and a failure to take risk into consideration. Was there any causal connection between these events, or did they just happen to occur about the same time? It is true that they all involved money, and banks deal with money, so maybe Gramm-Leach-Bliley is to blame, after all.(81)

Risk may have not have been taken seriously in any of these scenarios because markets kept going up, whether in securities or in housing. As long as homeowners could sell their homes for more than they paid, which they could in a rising market, no one had to worry about risky or bad mortgages. This worked until housing prices peaked. The first major signal that some mortgages could be risky came in April 2007, whe New Century Financial Corp., a leading subprime mortgage lender, filed for bankruptcy. A reluctance to lend, by major lenders, led to a fall in housing prices. Two government-sponsored enterprises, Fannie Mae and Freddie Mac, suffered large losses and were seized by the federal government in the summer of 2008. In October 2008 President Bush signed the Emergency Economic Stabilization Act of 2008 (EESA). This was accompanied by the Troubled Asset Relief Program (TARP) Capital Purchase Program (CPP), which authorized the Treasury Department to buy $700 billion preferred shares from qualifying financial institutions.(82)

Mortgage-Backed Securities (MBOs), Collateralized Debt Obligations (CDOs), and Credit Default Swaps (CDSs) are considered another contributing factor to the 2008 recession. If financial institutions were already pushing the boundaries before GLBA, they were quick to create novel instruments to take advantage of their new-found freedom, once GLBA passed. Mortgage-backed securities are investment grade securities (high-quality) backed by a pool of mortgages or trust deeds. The problem was that, while they were marketed as safe because they were backed by mortgages, the pool of mortgages backing the securities fell far short of investment grade Collateralized Debt Obligations (CDOs) are backed by pools of bonds, bank loans, or other assets, which are divided into several classes (tranches). Each class is risk-rated and offered separately to investors. Collateralized Mortgage Obligations (CMOs) are similar, but the pool consists of mortgages. Credit Default Swaps (CDSs) are arrangements where the seller, in return for regular payments by the buyer, agrees to buy the assets, if they are in default - a form of credit insurance. They are a standard arrangement for commercial banks making large loans.(83)

The role credit default swaps played in the 2008 financial crisis was an unusual one. Instead of commercial banks, it was short-selling investers buying the credit default swaps. Betting that the market for MBOs and CDOs would go down, they placed a "buy" order, which would be triggered at a certain point once the price had dropped sufficiently. They would then turn around and sell the purchased securities, at a profit. American International Group (AIG) had sold over $500 billion worth of CDS protection. It had not set aside enough capital to cover the losses, nor had it hedged (insured) against loss payouts. Lehman Brothers went into bankruptcy (the largest bankruptcy in U.S. history) on September 15, 2008, which triggered nearly $400 billion in CDS payouts. The next day, Septmber 16, 2008, AIG received an $85 billion government bailout. Faced with $500 billion in CDS payouts, AIG was considered too big too fail without bringing down the entire financial system.(84)

The 2008 financial crisis, whatever the cause, was serious enough as a "crisis" to get the attention of Congress. The answer would be the Dodd-Frank Act of 2010. It was framed as a reform of Gramm-Leach-Bliley and, from that perspective, it did bring back some of the regulatory oversight, or seemed to. The problem was that, once the memory of the immediate crisis began to fade, there would be calls to bring back "common sense" or "sensible" regulations. The cycle would begin again. Possibly that was the nature of a financial "crisis," which, once solved, is no longer a crisis. The Bank Secrecy Act and Anti-Money Laundering requirements are much more intrusive, in terms of government regulation, but remain, because the "crisis" environment has not disappeared. Perhaps that is because there are any number of headlines, drawing attention to continuing threats. There is the opiod pandemic, the influx of dangerous drugs and organized crime violence, the threat of terrorism, and, at least, as we are constantly reminded, the threat of cyber attacks.

Dodd-Frank Act of 2010

The Dodd-Frank Act, whose full name is the "Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010," was signed into law by President Obama on July 21, 2010. It was certainly long enough, boasting over 2,300 pages (848 pages of substance in the Conference Report), covering 16 separate titles. In contrast, the Gramm-Leach-Bliley Conference Report had 185 substantive pages covering six titles. In addition, the Dodd-Frank Act created 13 new federal offices, such as the Bureau of Consumer Financial Protection, the Financial Stability Oversight Council, the Federal Insurance Office, the Office of Investor Advocate, and many more. As if that wasn't confusing enough, within the Dodd-Frank Act are individual acts, such as the "Financial Stability Act of 2010," the "Enhancing Financial Institution Safety and Soundness Act of 2010," and the "Federal Insurance Office Act of 2010." The newly created federal offices are split among various agencies and departments. One question is whether they will be fully funded, and will they be real offices or just be assigned an empty room with a name plate outside.(85)

The Dodd-Frank Act and the Gramm-Leach-Bliley Act are perhaps the last and most significant legislative endeavors in the banking area, at least that seems to be the case based on how much mention they receive in publications. On balance, despite complaints from the banking industry, both acts probably favor the banking sector over the consumer. GLBA did not grant consumers a private right of action and many of the violations are only enforceable by government agencies. Dodd-Frank seemingly granted consumers greater protection, but it was unclear if it was more lip-service than real, or whether any of it will survive changes in administration. In a hostile political climate, newly created agencies might be eliminiated or enforcement activities curtailed.(86)

• 1) Thomas P. Fitch, Dictionary of Banking Terms, 293-294, Sixth Edition, (Hauppage, New York: Barron's Educational Series, Inc., 2012, 2006).
• 2) Fitch, Dictionary of Banking Terms, 293-294.
• 3) US Secret Service website: https://wwww.secretservice.gov/about/history/timeline, accessed August 20, 2025.
• 4) Akira Summers, Understanding Blockchain and Cryptocurrencies A Primer for Implementing and Developing Blockchain Projects, 360-361, Sixth Edition, (New York: Kaplan, Inc, d/b/a Barron's Educational Series, 2015); see also Imran Bashir, Mastering Blockchain: Inner workings of blockchain, from cryptography and decentralized identities, to DeFi, NFTs and Web3, 8-10, 4th Edition, (Upper Saddle River, New Jersey: Packt Publishing, 2023); see also MDF Law Blog, Bitcoin's 21 Million Cap Can be Hacked, MDF Law website https://mff-law.com/bitcoin-value-over-flow, accessed August 30, 2025.
• 5) Jason Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook, Volume II, 200, 202-203, (Cham: Switzerland: Palgrave Macmillan 2024); see also Imran Bashir, Mastering Blockchain: Inner workings of blockchain, from cryptography and decentralized identities, to DeFi, NFTs and Web3, 8-10, 4th Edition, (Upper Saddle River, New Jersey: Packt Publishing, 2023); see also David Carlisle, The Crypto Launderers: Crime and Cryptocurrencies From the Dark Web to DeFi and Beyond, 28-29, (Hoboken, New Jersey: John Wiley & Sons, Inc., 2024).
• 6) Carlisle, The Crypto Launderers, 28-29.
• 7) Carlisle, The Crypto Launderers, 124; See also Vitalik Buterin, Bitfloor Hacked, $250,000 Missing Bitcoin Magazine website: https://bitcoinmagazine.com/business/bitfloor-hacked-250000-missing-1346821046, September 5, 2012, accessed September 11, 2025.
• 8) Bashir, Mastering Blockchain, 241-242, 250; see also Carlisle, The Crypto Launderers, 77, 140-142, 149.
• 9) Bashir, Mastering Blockchain, 241-242, 250; see also Carlisle, The Crypto Launderers, 77, 140-142, 149; see also Scharfman, Fraud Casebook, Volume II, 67-68.
• 10) Scharfman, Fraud Casebook, Volume II, 200, 202-203; see also Nick Furneaux, There's No Such Thing as Crypto Crime An Investigative Handbook, 89, (Hoboken, New Jersey: John Wiley & Sons, Inc., 2025).
• 11) Scharfman, Fraud Casebook, Volume II, 200, 202-203.
• 12) Jason Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 100-101 (Cham, Switzerland: Palgrave Macmillan, 2023)
• 13) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 87.
• 14) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 103; see also Carlisle, The Crypto Launderers, 150-152; see also Bashir, Mastering Blockchain, 634.
• 15) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 103; see also Carlisle, The Crypto Launderers, 150-152; see also Bashir, Mastering Blockchain, 634.
• 16) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 88; Scharfman, Fraud Casebook, Volume II, 18; see also Carlisle, The Crypto Launderers, 158-162; see also Bashir, Mastering Blockchain, 620, 634.
• 17) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 104; see also Carlisle, The Crypto Launderers, 150-152; see also Bashir, Mastering Blockchain, 634.
• 18) Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 81-82; see also Carlisle, The Crypto Launderers, 150-152; see also Bashir, Mastering Blockchain, 620, 634.
• 19) Carlisle, The Crypto Launderers, 150.
• 20) Scharfman, Fraud Casebook, Volume I, 7-8.
• 21) Scharfman, Fraud Casebook, Volume I, 39; see also Carlisle, The Crypto Launderers, 149-158.
• 22) Bashir, Mastering Blockchain, 5.
• 23) Bashir, Mastering Blockchain, 4, 11; see also Carlisle, The Crypto Launderers, 201.
• 24) Bashir, Mastering Blockchain, 4, 6-7, 11, 552; see also Carlisle, The Crypto Launderers, 203.
• 25) Bashir, Mastering Blockchain, 623-627; see also Carlisle, The Crypto Launderers, 61, 177; see also Scharfman, The Cryptocurrency and Digital Asset Fraud Casebook I, 8-14; see also Scharfman, Fraud Casebook, Volume II, 56, 41-54, 169-174, 226-228; see also Summers, Understanding Blockchain , 191-197.
• 26) Scharfman, Fraud Casebook, Volume I, 9-11, 11-12; see also Scharfman, Fraud Casebook, Volume II, 39-50, 56-57, 169-174; see also Furneaux, There's No Such Thing as Crypto Crime, 76-79; see also Carlisle, The Crypto Launderers, 92-93.
• 27) Scharfman, Fraud Casebook, Volume I, 13; see also Scharfman, Fraud Casebook, Volume II, 16, 226-228; see also Furneaux, There's No Such Thing as Crypto Crime, 30, 79-82; see also Carlisle, The Crypto Launderers, 60-61, 145.
• 28) Bashir, Mastering Blockchain, 631, 701-702; see also Scharfman, Fraud Casebook, Volume II, 108-110; see also Furneaux, There's No Such Thing as Crypto Crime, 90-91.
• 29) Bashir, Mastering Blockchain, 622, 624.
• 30) Bashir, Mastering Blockchain, 626; see also Summers, Understanding Blockchain , 191-199.
• 31) Bashir, Mastering Blockchain, 626-627; see also Summers, Understanding Blockchain , 191-199; see also Scharfman, Fraud Casebook, Volume II, 86.
• 32) Bashir, Mastering Blockchain, 626-627; see also Summers, Understanding Blockchain , 193.
• 33) Bashir, Mastering Blockchain, 623, 626.
• 34) Bashir, Mastering Blockchain, 623, 626; see also Summers, Understanding Blockchain , 195-197; see also Scharfman, Fraud Casebook, Volume II, 86.
• 35) Bashir, Mastering Blockchain, 415, 626; see also Scharfman, Fraud Casebook, Volume II, 177-179.
• 36) Mike Meyers and Scott Jernigan, Mike Meyers' CompTIA Security+ Certification Guide (Exam SY0-601), 338, 347, 525-526, 563, 768, Third Edition (New York: McGraw Hill, 2021).
• 37) Andreas M. Antonopoulos and David A. Harding, Mastering Bitcoin Programming the Open Blockchain, 29-31, 36, Third Edition (Sebastopol, CA: O'Reilly Media, Inc., 2024).
• 38) Bashir, Mastering Blockchain, 619-635; see also Summers, Understanding Blockchain , 191-199; see also Scharfman, Fraud Casebook, Volume II, 89.
• 39) Bashir, Mastering Blockchain, 621-622.
• 40) Bashir, Mastering Blockchain, 621, 623-624.
• 41) Bashir, Mastering Blockchain, 621, 623-628.
• 42) Bashir, Mastering Blockchain, 222, 621, 628-631; see also Scharfman, Fraud Casebook, Volume II, 66-78.
• 43) Bashir, Mastering Blockchain, 621, 631, 690.
• 44) Bashir, Mastering Blockchain, 250, 258, 621, 631, 690; see also Scharfman, Fraud Casebook, Volume II, 108-111; see also Furneaux, There's No Such Thing as Crypto Crime, 90-91.
• 45) Bashir, Mastering Blockchain, 621, 631, 690; see also Scharfman, Fraud Casebook, Volume II, 332-334.
• 46) Bashir, Mastering Blockchain, 474, 620, 621, 631; see also Scharfman, Fraud Casebook, Volume II, 11-21; see also Carlisle, The Crypto Launderers, 158-162.
• 47) Bashir, Mastering Blockchain, 474, 620-621, 631, 651, 659, 661, 665-666; see also Scharfman, Fraud Casebook, Volume II, 212-213.
• 48) Bashir, Mastering Blockchain, 473-474, 631.
• 49) Bashir, Mastering Blockchain, 621, 631.
• 50) Bashir, Mastering Blockchain, 182, 621, 631.
• 51) Bashir, Mastering Blockchain, 621, 631; see also Scharfman, Fraud Casebook, Volume I, 18.
• 52) Bashir, Mastering Blockchain, 48-49, 231, 621, 631-632, 634, 671-672; see also Scharfman, Fraud Casebook, Volume I, 88, 100; see also Meyers, Mike Meyers' CompTIA Security+ , 274, 425-428, 527-528, 706.
• 53) Bashir, Mastering Blockchain, 634; see also Scharfman, Fraud Casebook, Volume I, 81, 101, 103, 104.
• 54) Bashir, Mastering Blockchain, 621, 632; see also Scharfman, Fraud Casebook, Volume I, 19, 82, 84-86; see also Scharfman, Fraud Casebook, Volume II, 72-78.
• 55) Bashir, Mastering Blockchain, 621, 632; see also Scharfman, Fraud Casebook, Volume I, 12-13; see also Scharfman, Fraud Casebook, Volume II, 197-199, 280-282.
• 56) Bashir, Mastering Blockchain, 633.
• 57) Bashir, Mastering Blockchain, 559-579, 634; see also Summers, Understanding Blockchain , 194.
• 58) Bashir, Mastering Blockchain, 620, 634; see also Scharfman, Fraud Casebook, Volume I, 81, 100-104; see also Scharfman, Fraud Casebook, Volume II, 18.
• 59) Bashir, Mastering Blockchain, 620, 626; see also Scharfman, Fraud Casebook, Volume I, 88; see also Scharfman, Fraud Casebook, Volume II, 86, 89.
• 60) Bashir, Mastering Blockchain, 620, 626, 671; see also Scharfman, Fraud Casebook, Volume I, 88; see also Scharfman, Fraud Casebook, Volume II, 86, 89.
• 61) Scharfman, Fraud Casebook, Volume I, 3-4, 12-13; see also Scharfman, Fraud Casebook, Volume II, 236, 241.
• 62) Scharfman, Fraud Casebook, Volume II, 196-198, 241.
• 63) Scharfman, Fraud Casebook, Volume II, 236, 254.
• 64) Scharfman, Fraud Casebook, Volume II, 56, 252-253.
• 65) Meyers, CompTIA Security+ Certification Guide , 577-578, 706, 735.
• 66) Scharfman, Fraud Casebook, Volume II, 332-333.
• 67) Scharfman, Fraud Casebook, Volume II, 332-333.
• 68) Dan Engoren, The GENIUS Act: A Framework for U.S. Stablecoin Issuance | Insights | Sidley Austin LLP, Sidley Austin LLP website: https://wwww.sidley.com/en/insights/newsupdates/2025/07/the-genius-act-a-framework-for-us-stablecoin-issuance, July 21, 2025, accessed July 21, 2025; see also Congress.Gov, Text - S.394 - 119th Congress (2025-2026) Genius Act of 2025 | Congress.gov | Library of Congress, Congress.Gov website: https://www.congress.gov/bill/119th-congress/senate-bill/394/text, February 4, 2025, accessed July 21, 2025; see also F. Dario de Martino, Susan Gault-Brown, Lena Kiely, Katherine Stoller, Bill Satchell, The GENIUS Act: Transforming U.S. Stablecoin Regulation, A&O Shearman website: https://www.aoshearman.com/en/insights/ao-shearman-on-fintech-and-digital-assets/the-genius-act-transforming-us-stablecoin-regulation, July 21, 2025, accessed July 21, 2025; see also Daniel J. Solove and Paul M. Schwartz, Information Privacy Law, 798-802, Seventh Edition, (New York: Walters Kluwer, 2021).
• 69) John Downes and Jordan Elliot Goodman, Dictionary of Finance and Investment Terms, 406, 423, Seventh Edition, (Hauppage, New York: Barron's Educational Series, Inc., 2006); see also Fitch, Dictionary of Banking Terms, 281.
• 70) Basics of Buying on Margin: What's Margin Trading?, Charles Schwab website: https://wwww.schwab.com/learn/story/basics-buying-on-margin-whats-margin-trading, May 2, 2025, accessed August 28, 2025; see also John Downes, Dictionary of Finance and Investment Terms, 406, 577, 626, 628-629; see also Margin Regulation | FINRA.org, FINRA website: https://wwww.finra.org/rules-guidance/key-topics/margin-accounts, accessed August 25, 2025.
• 71) Stock Market Crash of 1929 | Federal Reserve History, Federal Reserve History website: https://wwww.federalreservehistory.org/essays/stock-market-crash-of-1929, November 22, 2013, accessed August 25, 2025.
• 72) Dan Engoren, The GENIUS Act: A Framework for U.S. Stablecoin Issuance, Sidley Austin LLP website; see also Congress.Gov, Genius Act of 2025, Congress.Gov website; see also F. Dario de Martino, The GENIUS Act: Transforming U.S. Stablecoin Regulation, A&O Shearman website.
• 73) Dan Engoren, The GENIUS Act: A Framework for U.S. Stablecoin Issuance, Sidley Austin LLP website; see also Congress.Gov, Genius Act of 2025, Congress.Gov website; see also F. Dario de Martino, The GENIUS Act: Transforming U.S. Stablecoin Regulation, A&O Shearman website.

Bank Secrecy Act

• 74) Fitch, Dictionary of Banking Terms, 46; Information Privacy Law, 39, 798; FFIEC, p. 3, Appendix G, see also Karol K. Sparks and Harding de C. Williams The Keys to Banking Law A Handbook for Lawyers, 229-230, 252 (Chicago,Il: American Bar Association, 2012).
• 75) Fitch, Dictionary of Banking Terms, 46; Information Privacy Law, 39, 798; FFIEC, p. 3, Appendix G, Sparks Keys to Banking Law, 229-230, 252 .
• 76) Fitch, Dictionary of Banking Terms, 46, 294; Information Privacy Law, 39, 798; FFIEC, pp. 3-4, Appendix G, Sparks, Keys to Banking Law, 229-230, 252.

Fair Credit Reporting Act

• 77) Downes, Dictionary of Finance and Investment Terms, 237; Fitch, Dictionary of Banking Terms, 172; Information Privacy Law, 38, 756-757; Sparks, Keys to Banking Law, 255-256.
• 78) Downes, Dictionary of Finance and Investment Terms, 237; Information Privacy Law, 39, 756-757; Sparks, Keys to Banking Law, 255.

Gramm-Leach-Bliley Act (GLBA) of 1999

• 79) Downes, Dictionary of Finance and Investment Terms, 252, 296; Fitch, Dictionary of Banking Terms, 187, 216-217; Information Privacy Law, 39, 792-796; Sparks, Keys to Banking Law, 255.
• 80) Joe Mahon Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley) Federal Reserve History website: https://www.federalreservehistory.org/essays/gramm-leach-bliley-act, November 22, 2013, accessed January 13, 2026.
• 81) John V. Duca Subprime Mortgage Crisis Federal Reserve History website: https://www.federalreservehistory.org/essays/subprime-mortgage-crisis, November 22, 2013, accessed January 12, 2026.
• 82) Robert Rich The Great Recession Federal Reserve History website: https://www.federalreservehistory.org/essays/great-recession-of-200709, November 22, 2013, accessed January 13, 2026; Sparks, Keys to Banking Law, 38, 269.
• 83) Mahon Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley) Federal Reserve History website; Rich The Great Recession Federal Reserve History website; Duca Subprime Mortgage Crisis Federal Reserve History website; Sparks, Keys to Banking Law, 38, 269; Fitch, Dictionary of Banking Terms, 88, 114, 249, 299.
• 84) Mahon Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley) Federal Reserve History website; Rich The Great Recession Federal Reserve History website; Duca Subprime Mortgage Crisis Federal Reserve History website; Sparks, Keys to Banking Law, 38, 269; Fitch, Dictionary of Banking Terms, 88, 114, 249, 299.

Dodd-Frank Act of 2010

• 85) Sparks, Keys to Banking Law, 38, 269; Fitch, Dictionary of Banking Terms, 146-147.
• (86) Solove, Information Privacy Law, 792-796.