# Crypto laundering
> Cryptocurrency rails used globally to launder illicit proceeds, linking ransomware gangs, North Korean hackers, and Russian exchanges in a US$82 billion shadow financial system.

**Meta:** type: reference · date: 2026-07-03 · heads:  · 4 takes · 2 lenses · 3 regions

## What it is

Crypto laundering is the use of cryptocurrency infrastructure to disguise the origin and control of criminal proceeds. The pattern mirrors fiat money laundering: placement (converting earnings into crypto via over-the-counter desks, unregulated exchanges, or ransomware payment demands), layering (obscuring the trail through mixers, cross-chain bridges, privacy coins such as Monero, or rapid wallet-to-wallet swaps), and integration (converting back to fiat via compliant exchanges or real-asset purchases). What distinguishes crypto laundering is that every transaction is recorded publicly on-chain, making it simultaneously traceable and, if layered skillfully, harder to freeze than a conventional bank transfer.

Stablecoins, principally Tether (USDT), have overtaken Bitcoin as the dominant vehicle. Chainalysis estimated stablecoins accounted for 84% of illicit on-chain volume in 2025, up from 63% in 2024, partly because large sums can move across chains without the price-volatility risk that disadvantages criminal holders.

## History

The first major use case was Silk Road (2011-2013), where Bitcoin settled drug payments until the US Federal Bureau of Investigation shut the marketplace and arrested founder Ross Ulbricht in October 2013. The Russian-linked BTC-e exchange, which processed an estimated US$4 billion in criminal proceeds, was seized by US authorities in July 2017. A more sophisticated era began with the rise of decentralised finance: Tornado Cash, an Ethereum-based mixer, had processed an estimated US$7.6 billion before the US Treasury's Office of Foreign Assets Control sanctioned it in August 2022, the first time OFAC targeted a software protocol rather than a person or organisation. Dutch and US courts later convicted its developers on money-laundering charges. By 2022, Russia-linked exchange Garantex faced OFAC sanctions after facilitating ransomware and darknet-market proceeds; it rebranded as Grinex in 2025 before a further redesignation and collapse (see [미 재무부, 자금세탁 거점 붕괴 속에 Garantex와 후계 Grinex를 재지정](/ko/n/garantex-grinex-crypto-sanctions-2026)).

## Current state

Chainalysis estimated total crypto crime at US$154 billion in 2025, with laundering flows accounting for roughly US$82 billion. Two actor groups dominate the scale. Chinese-language underground networks, including the Huione Guarantee marketplace (US$70 billion in cumulative transactions since 2021), laundered an estimated US$16 billion in 2025, about 20% of global illicit crypto volume. North Korea's Lazarus Group stole US$2 billion that year, nearly US$1.5 billion of it in the February 2025 Bybit hack, channelling proceeds through mixer services and over-the-counter brokers (see [북한 라자루스의 암호화폐 탈취 20억 달러 돌파, 미 재무부는 IT 노동자 자금세탁책 겨냥](/ko/n/north-korea-crypto-theft-it-workers-2026)). Ransomware crews that reconsolidated around Qilin and affiliated groups in early 2026 continue to demand payment in Bitcoin or Monero and launder proceeds via specialist OTC desks (see [랜섬웨어, Qilin과 'The Gentlemen' 중심으로 재집중, 의료 분야가 주요 타깃으로](/ko/n/ransomware-surge-fragmentation-2026)). Law enforcement disrupted several malware-based on-ramp networks in June 2026, freezing €41 million in criminal crypto (see [오퍼레이션 엔드게임, StealC·Amadey·SocGholish 랜섬웨어 진입로 초토화](/ko/n/operation-endgame-stealc-amadey-2026)).

## Relationships

Crypto laundering is the shared financial layer connecting otherwise distinct threat actors. Ransomware gangs depend on it to convert extortion payments into spendable fiat. Sanctions-constrained states, Russia and North Korea most visibly, use it to circumvent the SWIFT-based correspondent banking system and fund state programmes. The UNODC's October 2024 convergence report documents how Southeast Asian crime syndicates built purpose-built crypto exchanges alongside underground casinos to move fraud and trafficking proceeds across borders without bank accounts. Blockchain analytics firms, chiefly Chainalysis, Elliptic, and TRM Labs, now sit between law enforcement and regulated exchanges, flagging tainted addresses in near-real time; exchanges that ignore those flags face OFAC penalties and potential delisting.

## What to watch

The Financial Action Task Force's June 2025 targeted update found 21% of member jurisdictions still fail to meet basic crypto AML/CFT requirements. The Travel Rule, which requires virtual-asset service providers to pass counterparty identifying data with each transaction, has been enacted by 73% of FATF members but effective enforcement lags significantly behind legislation. Three dynamics will determine the trajectory: whether stablecoin issuers, particularly Tether (incorporated in the British Virgin Islands), institutionalise freeze cooperation with global law enforcement at scale; whether zero-knowledge proof technology creates a new generation of assets that blockchain analytics cannot trace; and whether the Financial Stability Board's proposed global virtual-asset service provider licensing framework, under discussion as of mid-2026, establishes binding cross-border standards that close the jurisdictional gaps that laundering networks exploit.

## Regional takes (batched by bias / lens)

### official record
- **Financial Action Task Force (FATF)** (Global, en) — Sixth targeted update on FATF member implementation of crypto AML/CFT standards: 21% of jurisdictions non-compliant as of June 2025; Travel Rule enacted by 73% of members; $51 billion in illicit on-chain activity projected for 2024.
  Source: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html
- **UNODC Regional Office for Southeast Asia and the Pacific** (Southeast Asia, en) — Documents how Asian criminal syndicates built purpose-built crypto infrastructure alongside underground casinos to launder fraud and trafficking proceeds across borders; details the convergence of cyber-enabled fraud with underground banking.
  Source: https://www.unodc.org/roseap/uploads/documents/Publications/2024/TOC_Convergence_Report_2024.pdf

### blockchain forensics
- **Chainalysis** (United States, en) — Annual report on illicit on-chain activity covering 2025: total crypto crime estimated at US$154 billion; laundering flows at US$82 billion; stablecoins accounted for 84% of illicit volume; Chinese networks moved US$16 billion.
  Source: https://www.chainalysis.com/reports/crypto-crime-2026/
- **Chainalysis** (United States, en) — 2025 report covering 2024 activity: US$40.9 billion in identified illicit addresses, projected to ~US$51 billion; North Korea took 61% of all stolen crypto; stablecoins at 63% of illicit transaction volume.
  Source: https://www.chainalysis.com/blog/2025-crypto-crime-report-introduction/

## Across the graph
- Related: [[operation-endgame-stealc-amadey-2026]], [[ransomware-surge-fragmentation-2026]], [[garantex-grinex-crypto-sanctions-2026]], [[north-korea-crypto-theft-it-workers-2026]]
- Entities: Crypto Laundering, Ransomware, North Korea Evasion, Russia, China

---
Canonical: https://rbtfl.xyz/ko/n/crypto-laundering-dossier