How can the attackers eventually exchange crypto for fiat currency without revealing their identity? It seems that now their wallet address is known and all transactions will be closely monitored therefore it would seem that the whenever they try to buy real goods it might be possible to identify them. Maybe sell the crypto to criminals for cash? But than now the chain is tainted and the buyer will have the same problem.
The current meta is to use a mixer and then gradually move the funds through successively less sketchy exchanges.
E.g. coinbase don't let you deposit from mixers (at least in large amounts), but they do let you deposit from okx, which in turn accepts deposits from sketchy chinese exchanges which accept deposits from mixers.
Alternatively, you can go via monero but that only replaces the first few steps in the ladder.
Thankfully I don't think any proposed regulation does much to stop this, short of entirely banning crypto, which I don't see happening any time soon.
You can buy legitimate, verified, fully-KYC-ed accounts for major crypto exchanges and banks on the darknet for dirt cheap. Send crypto to exchange, sell or convert to a privacy coin, or transfer fiat to bank. Use virtual bank card to buy gift cards or whatever else.
Or use something like changelly or a number of decentralized exchanges.
You have more complicated ways to laundry crypto by having legit wallets profit from dirty crypto wallet ‘mistakes’. Think of doing swaps that are MEV profitable and you run it by your own node for example with a MEV bot
Sometimes it’s not about hiding an identity but delaying the tracing and identification via any means necessary (moving the crypto through mixers, less traceable coins, shady exchanges, unsuspecting third parties, etc.) until the whole value is extracted through various methods and fake identities.
The identity behind a wallet or account might be worthless. Years ago a common scam in Eastern Europe (maybe everywhere) was to pay old or homeless people a tiny fee to open bank accounts all over the city and then hand over the credentials to the criminals. Then they could operate a network of thousands of such accounts for various purposes, sometimes for reasons as simple as getting a small loan that doesn’t require any collateral and disappearing with the money.
This can work as long as they can move around the crypto in an obscure enough way so that it takes just hours or days longer for the authorities to trace than it takes for the criminals to cash out.
Do it in a country with much laxer KYC laws for a haircut and then use one of the myriad other methods of transferring large amounts of illegitimate wealth across borders that existed prior to cryptocurrency and which continue to be widely used. Frankly at this point tof you're transacting in cryptocurrency most banks and governments are going to assume that you are either an idiot, a conman or a criminal and treat you as such so the entire chain is already "tainted".
For better or worse, this is literally the use case and design for projects like Tornado Cash. I won't say "easily," but they'll probably be able to get away with it.
