Recently I found an interesting file on uppd.gov.si called nakazila.xls (translated: wire transfers) while I was doing some reconnaissance for a bug bounty program. After verifying that the file was published on purpose I started to look at it, here's what I learned:

According to the ZPPDFT-1 (prevention of money laundering and terrorist financing act) every financial transaction done by a Slovenian company which is bigger than 15 000 € should be checked for the following criteria:

• Is the receiving company registered in a high risk country?
• Does the company use a bank account registered in a high risk country?

If so, the transaction needs to be reported to regulatory authorities and will be published here: http://www.uppd.gov.si/si/javne_objave/podatki_o_transakcijah_68_clen_zppdft_1/

A list of high risk countries can be found here: http://www.uppd.gov.si/si/javne_objave/seznam_drzav_50_clen_zppdft_1/

The published data includes the date, sender, recipient, amount and arbitrary references. It‘s well known that the cryptocurrency exchange Bitstamp was founded in Slovenia. Although the exchange is now operated by Bitstamp Ltd. registered in London, Bitstamp still reports suspicious transactions to the Slovenian authorities complying with ZPPDFT-1, likely because of a Slovenian subsidiary or office.

Let's see what we can find!

1. Get the transaction data of 2017: wget 'http://www.uppd.gov.si/fileadmin/uppd.gov.si/pageuploads/NAKAZILA/Arhiv/nakazila_05012018.xls'
2. Install gnumeric to get access to ssconvert, a tool to convert xls files: apt-get install gnumeric
3. Convert the xls file to a simple text file: ssconvert -O 'separator=; format=automatic' nakazila.xls nakazila.txt
4. Now you can start filtering: cat nakazila.txt | grep "BITSTAMP LIMITED" | grep "WITHDRAWAL"

Of course withdrawals don't need to be connected to recent sales but they still provide valuable insights.

Example: January 2018 - March 2018, USD transactions

2018/03/30;"BLOCK SOLUTIONS SDN. BHD.";42539
2018/03/27;"MCM 965 D.O.O.";39964
2018/03/26;"BETUR INC";499550
2018/03/23;"BETUR INC";399640
2018/03/21;"DISCOVERLAND INVESTMENTS";102444
2018/03/20;"BETUR INC";499550
2018/03/14;"BANK FRICK   CO. AG";51412
2018/03/14;"BETUR INC";499550
2018/03/06;"BETUR INC";499550
2018/03/06;"AVEX CONSULTING SDN BHD";79928
2018/03/05;"BETUR INC";749325
2018/03/05;"BETUR INC";749325
2018/03/02;"BETUR INC";499550
2018/03/01;"BETUR INC";599460
2018/02/28;"BETUR INC";499550
2018/02/23;"BLOCK SOLUTIONS SDN. BHD.";33640
2018/02/21;"BETUR INC";499550
2018/02/21;"BLOCK SOLUTIONS SDN. BHD.";33441
2018/02/20;"MOVING MEDIA GMBH";1953840
2018/02/20;"ICFRAME, CORP";30038
2018/02/19;"BETUR INC";749325
2018/02/13;"AVEX CONSULTING SDN BHD";79928
2018/02/13;;34690
2018/02/12;"ICFRAME, CORP.";27246
2018/02/12;"BLOCK SOLUTIONS SDN. BHD.";21980
2018/02/06;"EIGHT TRADING W.L.L.";199820
2018/02/06;"BETUR INC";499550
2018/02/05;"ICFRAME, CORP.";26876
2018/02/02;"PICOSTOCKS INCORPORATED";1258643
2018/02/01;"PICOSTOCKS INCORPORATED";1116155
2018/01/30;"BLOCK SOLUTIONS SDN. BHD.";40316
2018/01/30;"BETUR INC";499550
2018/01/30;"EIGHT TRADING W.L.L.";179838
2018/01/30;"BLOCK SOLUTIONS SDN. BHD.";49527
2018/01/29;"BETUR INC";499550
2018/01/23;"EIGHT TRADING W.L.L.";259766
2018/01/22;"DISCOVERLAND INVESTMENTS";494629
2018/01/18;"DISCOVERLAND INVESTMENTS";64991
2018/01/18;"ICFRAME, CORP.";23722
2018/01/18;"BANK FRICK AND CO AKTIENG";1216201
2018/01/16;"BLOCK SOLUTIONS SDN. BHD.";22294
2018/01/10;"ICFRAME, CORP.";30599
2018/01/08;"AVEX CONSULTING SDN BHD";79928
2018/01/03;"DISCOVERLAND INVESTMENTS";55950

Combining the transaction data with the monthly BTCUSD performance on Bitstamp:

November: 685 362 $ / Performance: + 70 %
December: 1 473 385 $ / Performance: + 28 %
January: 3 516 861 $ / Performance: - 47 %
February: 7 064 272 $ / Performance: + 8 %
March: 5 311 787 $ / Performance: - 44 %
April: 7 460 621 $ / Performance: + 52 %
May: 10 735 557 $ / Performance: - 18 % (Note: MISSION GATE INC was responsible for 5 045 455 $)
June: 4 122 118 $ / Performance: - 16 %

Since the start of the bear market we can see an increasing amount of withdrawals which might be connected to late profit-taking and the need to pay capital gains taxes. Nevertheless, always remember correlation does not imply causation.

Besides that we can also track transactions to the Bank Frick that "is the first financial institution in Liechtenstein to offer the trading of five leading cryptocurrencies and secure safekeeping via offline storage." (Source: https://www.bankfrick.li/en/about-bank-frick/news/bank-frick-allows-direct-investments-in-leading-cryptocurrencies), the service is aimed at "professional market participants and financial intermediaries".