Pentester here: there’s a couple of ways they do this:
1) they require payment in bitcoin. While not totally anonymous, they put it through a tumbler scheme to make tracing much more difficult.
2) they use stolen accounts to pay the money into and withdraw from, meaning the transactions are not associated with them.
3) they reside in countries that couldn’t give less of a fuck about extradition requests from the west (eg: China)
Latest Answers