Want to Launder Bitcoins? How Crooks Are Hacking iTunes and Getting Paid by Apple

Even though drug dealers and cybercriminals rake in mountains of the digital currency Bitcoin, crooks still face a key problem: how to convert that bitcoin, which at the time of writing is valued at around $16,000 per unit, into something much more usable, such as dollars.

Maybe meet someone in person to exchange it for cash, or purchase other items that they can later sell for fiat currency?

There’s one other bizarre method: Some schemers are essentially laundering their bitcoins through song purchases on Apple-owned media store iTunes. Although it’s unlikely to be widespread, the approach results in a legitimate payment from Apple—meaning fraudsters are then largely free to use their ill-gotten gains however they see fit.

“Pretty straight forward,” one scammer, who says they have carried out the laundering process, told The Daily Beast.

The method starts, funnily enough, with making some real music, the scammer said. Once they have some music to “sell,” they pay a publishing company, such as CD Baby, to push the music to iTunes. CD Baby allows musicians to list their own music on streaming platforms like Apple Music and Spotify, as well as stores like Amazon, or, in this case, iTunes, and get paid weekly.

“You pay them some money. After a week or two, they get it on iTunes and it’s up for sale,” the fraudster said, and added that the music “has to sound decent,” presumably so the track isn’t marked as suspicious by CD Baby or the publisher.

“You can do a lot these days with $500 of equipment,” the fraudster added.

Once the songs are up on iTunes, the scammer needs to get hold of a load of iTunes gift cards. The trade of these cards has blossomed into a fully fledged underground economy, with multiple fraudsters demanding payment from victims not in wire transfers but in gift vouchers instead. One of the main reasons is that gift cards award a decent level of anonymity: There’s rarely a need to provide any information to make a purchase than what is included on the card itself, just the code.

The scammer said they obtain their iTunes gift cards from a private source, but plenty of online marketplaces—some criminal, others more legitimate—also advertise the vouchers.

From here, the scammer simply buys their own music: They’ve turned bitcoin into gift cards, and finally into dollars.

“I purchase my music. I get a check from Apple,” the scammer told The Daily Beast.

The process, however, can be laborious, so the scammer said they sometimes hire others to create fresh iTunes accounts and purchase the music on his behalf, with his funds, for a cut.

“It’s quite tedious to do on your own,” the scammer said. They don’t convert the funds all at once because of the work involved, and the most they’ve laundered in a three-year span is $120,000, they added.

But others have seemingly made a lot more. Back in 2009, London’s Metropolitan Police, working with the FBI, arrested 10 people across the U.K. who allegedly produced several songs and then used them to launder funds through iTunes. In that instance, the fraudsters, who were apparently real DJs, used iTunes as well as Amazon to empty stolen credit cards rather than converting bitcoin, which wasn’t widely popular at the time. According to media reports, the gang allegedly spent around $750,000 on the songs, and the crooks also allegedly pulled in royalties from the tracks for an additional $300,000.

The gang’s supposed laundering scheme even had the bonus of pushing their tracks up through the charts, the Telegraph reported. Indeed, the scammer told The Daily Beast “I have a pretty good history on iTunes these days.”

“CD Baby can confirm that it works diligently with all partners to identify and combat streaming and download abuse,” the company told The Daily Beast in a statement.

Apple didn’t respond to multiple requests for comment.

“I’m still getting these crazy checks ;)” the scammer told The Daily Beast.

Update: This piece has been updated to include comment from CD Baby.