Watch Out for Illicit Actors Gaming Crypto Games

Play-to-earn (P2E) crypto games are emerging as a popular blockchain application that is likely to bring a high risk for scams and money laundering, especially once the crypto winter thaws.

Although P2E crypto tokens, like a lot of the crypto ecosystem, have lost much of their value in recent months, they deserve attention from financial regulators because P2E crypto (also sometimes referred to as Game Finance, or GameFi) offers a glimpse into the types of financial crime complexities that will arise as tech companies work to usher in an even more nascent development on the horizon: the metaverse.

Yaya J. Fanusie is a former CIA analyst and now the chief strategist at Cryptocurrency AML Strategies, an advisory firm in the Washington, D.C., area, and an adjunct senior fellow at the Center for a New American Security. This article is excerpted from The Node, CoinDesk's daily roundup of the most pivotal crypto news. Subscribe to get the full newsletter here.

Blockchain analytics firm Elliptic recently published a great report explaining types of financial crime likely to accompany the growth of metaverse ecosystems. (Disclosure: A few years ago, I collaborated with Elliptic in both my think tank research work and my private consulting practice. Facebook/Meta has been a client as well.) If the metaverse is to become the virtual interactive world that its proponents aspire for it to be, a combination of gaming and crypto will expand the outlets for good and bad actors seeking riches alike.

Virtual money in online games is not new. But P2E crypto gaming adds a real-world financial dimension by offering tokens that can be easily sold outside of gaming environments. In many cases, gamers can sell their crypto funds earned in obscure P2E crypto games for more liquid ERC-20 tokens that run on top of Ethereum, especially stablecoins, on centralized or decentralized exchanges. Gamers then can convert their more popular tokens into the fiat currency of their choice.

Even before the advent of P2E crypto, anti-money laundering experts have flagged the illicit finance risks around online gaming. In 2019, researchers at the Royal United Services Institute, a U.K. think tank focused on international security issues, pointed out that if users can find ways to exchange in-game items (like virtual money, artifacts, tools or clothing) for real-world currency, those items will become attractive for criminals looking to launder illicit funds. But selling game virtual-assets for fiat money used to be difficult. In traditional online games, users had to access unauthorized secondary markets to trade gaming items outside the games’ platforms. These markets are often on the darknet, which requires a special browser like Tor to access. With crypto gaming, the virtual money earnings and the collected items are all created on blockchains and traded relatively freely, often wherever blockchain assets are sold.

P2E platforms vary widely in their gaming models and in how players earn and spend crypto. Many games offer digital collectibles via non-fungible tokens (NFTs). Some pair mobile app activity with geolocation and augmented reality, where gamers must physically go to locations to play the game, similar to Pokémon Go. Some P2E games literally give crypto funds away. For example, Coin Hunt World, which is available as a downloadable mobile app and was co-founded by the CEO of the Bittrex crypto exchange, lets players earn bitcoin and ether by completing various tasks without investing any crypto up front. Apparently, the game’s business model is to lure users into the game and show them paid advertisements in the game environment.

There are more than 1,000 P2E crypto games available, according to DappRadar. While some of these games have hundreds of thousands of users and hundreds of millions of dollars’ worth of crypto infused into them, the majority of the games have zero to no users and barely any funds associated with them. This phenomenon is akin to the initial coin offering craze of 2017, when developers created thousands of new cryptocurrencies, yet most of those projects soon lost almost all of the value of their digital tokens. Many were outright scams.

The illicit finance risks are high in the P2E crypto space largely because it is young and quickly developing, with few clear guidelines around governance and consumer protection. Some regulators are taking notice. In December 2021, financial authorities in Thailand warned consumers about the volatility and scam risks associated with P2E crypto/GameFi. In December 2021, the South Korean government ordered Google Play and Apple app stores to prohibit all P2E games from their platforms in the country, citing laws prohibiting gaming prizes exceeding the value of a few dollars. It would not be surprising for other jurisdictions to follow suit. Many P2E games are little more than new iterations of online gambling and are likely to be seen as contravening a nation’s casino and gambling laws.

Axie Infinity, one of the most popular P2E games, can probably be exploited easily by individuals seeking to launder illicitly earned crypto. Users must purchase NFT characters called Axies to play the game and can sell those characters on NFT marketplaces. The rules of Axie Infinity allow players to “rent” teams of other players’ characters inside the game and split profits. Since there’s typically no know your customer (KYC) screening involved in playing these games, a criminal actor could infuse ill-gotten crypto into the game, rent a character from another user, and then split the earnings as a way to pay the user for helping to obfuscate the origin of the dirty funds. Innovations like renting characters can certainly be benign, creative ways to play online games, but through a financial-crime fighter’s lens, they are ready-made for money laundering.

Because so many P2E games use non-fungible tokens (NFTs), it will be important for anti-money-laundering (AML) investigators to track NFT trends globally as an indicator of the P2E space’s trajectory. Interestingly, a recent international survey found the Philippines had the highest percentage of NFT ownership in any country, followed by Thailand, Malaysia, the United Arab Emirates and Vietnam. Nigeria had the highest percentage of people surveyed who were “planning to buy an NFT,” indicating that there will likely be a growth of NFT (and P2E) activity there.

Although P2E gaming is still pretty nascent, it is probably just a matter of time before a prominent illicit finance case arises through a P2E platform. In January, a colleague of mine who focuses on North Korea illicit finance at the Center for a New American Security wrote that it would be plausible for Pyongyang to exploit P2E software to earn crypto funds. Although North Korea directly using P2E games has not been publicly detected, U.S. authorities recently identified North Korea’s cyber unit known as the Lazarus Group as the culprit behind a theft of $540 million in crypto in March. The operatives stole the funds by hacking a blockchain platform that supports the Axie Infinity game. They gained access to the platform through a phishing campaign that tricked a senior engineer at Axie Infinity to download malware disguised as a fake job offer.

Even if P2E games remain a niche activity in the crypto space while crypto prices are low, regulators, AML compliance teams and financial crime investigators should keep an eye on the sector’s development. The gaming models and rules currently used will likely be adapted to larger projects that emerge in the metaverse ecosystem.

The best way to counter financial crime is to think like the criminals are thinking and to plan as they are planning. The metaverse will not be all fun and games.