Cryptocurrency is not just a niche playground for tech enthusiasts anymore. It is a sophisticated financial ecosystem now and trillions of dollars moves through. A massive innovation has come with this growth. It has also created a high-stakes run and catch game between regulators and professional money launderers. There is also a paradox observed. The transparency that defines blockchain technology and made everyone excited when first surfaced, is now tested by complex obfuscation methods .
The estimation of illicit cryptocurrency activity is something around $160 billion in 2025. It was assumed around $65 billion in 2024. Interestingly, while the total dollar value of crime has spiked, the percentage of illicit activity relative to the total crypto market volume actually fell slightly to around 1.2%. This tells us that the market is growing faster than crime, but the "bad actors" who remain are becoming far more efficient and moving much larger sums.
Crypto-laundering fundamentals are also in a changing phase. They don't just send Bitcoin to a mixer and hope for the best. "Chain-hopping" and the heavy use of stablecoins is the new method. Stablecoins now account for over 80% of all illicit transaction volume. They provide the price stability of the US dollar with the borderless speed of blockchain. This tool is preferred from drug cartel settlements to massive sanctions evasion schemes.
Regulators are trying to catch up with the speed of the change in the tech for AML compliance. The regulatory net is tightening as they are taking major steps. The EU's Anti-Money Laundering Authority (AMLA) in mid-2025 got full activation. MiCA (EU), FATF Rec 15, FinCEN VASP registration, the Travel Rule implementation by the FATF are all getting in the game and they will be covered in the following chapters. It is getting harder to operate in a gray zone. Compliance is not just a legal hurdle now. It has become a core requirement for any firm that wants to survive. Over the next sections, we will look at exactly how these laundering methods work, the size of the issue, and what the newest compliance standards require from financial institutions.
The following topics are going to be covered in this article;
- Why Crypto Attracts Money Launderers
- How Crypto Money Laundering Works
- The Numbers: How Big Is the Problem?
- Key Crypto ML Techniques
- Regulatory Framework: MiCA, Travel Rule, FinCEN
- Red Flags for Crypto Money Laundering
- How Sanction Scanner Supports Crypto AML Compliance
1. Why Crypto Attracts Money Launderers
The appeal of cryptocurrency for money launderers isn't just about the technology itself. The structural blind spots it creates in the traditional financial system is. Blockchain is a permanent ledger. It doesn't function like a bank ledger where every account is tied to a verified identity from the start. This difference creates opportunities for money movement without the friction of oversight.
Pseudonymity: The Layer of Separation
Your identity is the key to your account in banking. In crypto, your key is alphanumeric characters. Law enforcement can see that Wallet A sent funds to Wallet B. But they cannot see the owners of those wallets immediately. Pseudonymity is a draw for money launderers.
"Peeling Chains" is a method they utilize. Big amounts of bad money are peeled off small amounts to many other addresses in a short window. The timing of one wallet being identified may be late. The funds would already be fractured into many different directions. "Nested Services" also provide an extra layer of anonymity by pooling illicit funds with legitimate ones. They are small, unregulated brokers operating inside larger exchanges.
Velocity and "Instant Settlement"
Using shell companies or real estate can take weeks or months to launder the money. Crypto moves at the speed of the internet. $50 million can be moved across five different blockchains and ten different countries in under an hour. This speed solves the problem of money laundering but it creates a massive hurdle for law enforcement. When a SAR is flagged by a compliant exchange it is too late. The funds are moved to another ‘safe’ jurisdiction or the assets are converted. The golden hour for freezing stolen or laundered crypto has shrunk. If the funds aren't flagged within the first 30 minutes, the success rate for recovery drops dramatically.
Cross-Border Ease Without Gatekeepers
Moving physical cash or wire transfers across borders is not easy for a money launderer because of the SWIFT network and customs agents. Cryptocurrency ignores physical borders entirely.
The use of stablecoins like USDT or USDC has revolutionized this. Because stablecoins are pegged to the US dollar, they provide the stability of fiat with the borderless nature of crypto. A cartel can receive payment in a stablecoin in one country and "off-ramp" it into local currency in another. They do it through a network of Over-The-Counter (OTC) brokers who often operate with very loose oversight. In 2025, stablecoins accounted for roughly 84% of all illicit crypto transaction volume, according to Chainalysis. The FATF’s Targeted Report on Stablecoins and Unhosted Wallets, published in March 2026 draws on Chainalysis data. The main reason is they are easier to trade for real world goods and services than volatile assets like Bitcoin.
DeFi and the "KYC Gap"
Decentralized Finance (DeFi) is currently the most significant challenge for regulators. A centralized exchange like Coinbase or Binance requires you to upload an ID. But many DeFi protocols are just code running on a blockchain. There is no compliance department to check your passport.
- DEX Aggregators: Decentralized exchanges are utilized by launderers. They swap one token for another without interacting with a human or a KYC check. Swapping stolen ETH for a privacy coin or a stablecoin is an example.
- Liquidity Pools: A criminal can mix their money with the funds of thousands of honest users. Illicit funds are deposited into a liquidity pool in this method. Criminals then withdraw their share. The initial illegal coins' contamination has either been dissolved or dissipated now.
- Unhosted Wallets: These wallets are controlled by the user only. A third party is not involved. These transactions are outside the regulated areas. So the FATF identified P2P transfers between unhosted wallets as a reason for sanctions evasion.
2. How Crypto Money Laundering Works
Cryptocurrency money laundering is becoming a multi-chain, highly automated process. The goal for a launderer now is to create a digital history so complex that it becomes impossible to trace in terms of economics. Here is the step-by-step flow of how these operations move from illicit proceeds to clean cash.
The On-Ramp: Placement (From Fiat to Crypto)
The first challenge is to get dirty cash or illicit bank transfers into the digital ecosystem. This has to be done without triggering a Know Your Customer (KYC) alert.
- Nested Services: Launderers often use small, unregulated brokers that operate inside large, compliant exchanges. These nested accounts use the liquidity of a major platform while bypassing its ID requirements.
- P2P Networks & "Smurfing": Criminals use a network of money mules to make small, non-reportable deposits into various accounts. Agentic Smurfing is on the rise where AI-driven bots manage thousands of tiny transactions to avoid the red flags that a human might trigger.
- Complicit On-Ramps: Groups like the Cambodia-based Huione Group act as massive gateways. They process billions in fraud proceeds by operating in jurisdictions where AML oversight is virtually non-existent. This group was sanctioned by the end of last year.
Mixing and Tumbling: Breaking the Link
Once the funds are in a wallet, the launderer must break the direct link between the sender and the receiver.
- Privacy Protocols: Traditional mixers have faced heavy crackdowns. Now decentralized protocols like Railgun have stepped in. They use Zero-Knowledge (ZK) proofs. These protocols let users prove they have the funds without revealing the transaction history. More than 70% of the privacy-mixing market was taken up by Railgun in 2025 according to the University of Cambridge Judge Business School research.
- Liquidity Pooling: Funds are placed into a DeFi liquidity pool. Clean tokens from countless other users are mixed with the dirty tokens of a criminal. They get new tokens that have no direct connection to the crime when they withdraw.
Chain-Hopping: The Multi-Chain Evasion
This method is widely used by professional money launderers. They don't stay just on one blockchain. They move assets from Bitcoin to Ethereum, then to Solana and to TRON.
- Cross-Chain Bridges: Assets can be swapped with Thorchain or Maya Protocol between different blockchains. Money is moved across ledgers. The chase of the trail only is possible with specialized tools.
- Asset Swaps: Bitcoin can be swapped for a stablecoin like USDT on the TRON network. They function as a highway for bad money flows. It has low fees and high speed transfer. Cross-chain laundering volume is estimated to be more than $21 billion last year.
Moving to Weak-AML Jurisdictions
To safely off-ramp the money, it must land in a jurisdiction where the local exchanges or banks don't ask questions.
- Safe Harbors: FATF Grey List or the ones with uncooperative status are safe places for launderers. Papua New Guinea and Kuwait were added to this list of jurisdictions with high monitoring lately.
- Russian-Linked Infrastructure: Networks like the A7 group have used Russian-linked infrastructure to move billions. Western sanctions were bypassed with routing funds through intermediaries in Hong Kong and the APAC region.
The Off-Ramp: Integration (Back to Fiat)
This is the final stage where crypto is turned back into clean money or assets.
- Over-The-Counter(OTC) Brokers: Unlicensed OTC brokers are the primary exit for large-scale launderers. They often trade crypto for physical cash in back-room deals or through shadow banking networks in Southeast Asia.
- High-Value Assets: Purchasing precious metals, artwork, or upscale real estate is a growing way for funds to be incorporated. The proceeds from the sale of the item seem to be valid earnings from a legitimate trade.
- Cash-Out through Casinos: Both actual and virtual casinos double as laundromats in places like Southeast Asia. After being transformed into casino chips, the cryptocurrency is cashed out as actual earnings.
3. The Numbers: How Big Is the Problem?
The scale of this problem has two main aspects. They are the absolute growth of illicit crypto volume and its relative share of the global financial system. The numbers are hitting record highs in dollar terms. They still represent a small slice of the overall money laundering pie.
The Record-Breaking Numbers (2025–2026)
According to the latest 2026 Crypto Crime Reports from Chainalysis and TRM Labs, 2025 was a watershed year. Illicit cryptocurrency address estimation is $154 billion to $158 billion in 2025. This is a big stretch from the 2024 number of $64 billion.
The reason for the spike is not that more individuals started using crypto for crime. The main drive was concentrated shocks. Massive nation-state sanctions evasion specifically. The A7A5 token alone facilitated over $93 billion in transactions in less than a year. It is Russia’s ruble-pegged token. Removing these sanctioned flows, the growth in everyday crypto crime like scams and darknet markets was much more gradual.
Terrorist Financing
The relation between cryptocurrency and terrorism can be confusing. Cryptocurrency is believed to be the primary engine for modern terrorism is a misconception. Transcrime analyzed 121 global cases in 2024 and reported only 7% of terrorist financing (TF) cases involved crypto tech. The main part relied on old school methods. These are physical cash smuggling, the Hawala system, which is informal value transfer, and shell companies/ wire transfers.
Some terrorist groups may have increased their use of virtual assets. But regulators note that traditional banking remains the backbone of their financial networks. One main reason is it offers deeper liquidity and is easier to hide in the noise of global trade.
Crypto vs. The Traditional Giant
The United Nations Office on Drugs and Crime (UNODC) suggests that 2% to 5% of global GDP is laundered every year through the traditional financial system. That amounts to roughly $800 billion to $2 trillion annually. Compared to that, the $158 billion in illicit crypto, even at its record high, is still less than 10% of the total global money laundering problem.
The Legitimate Majority
The ratio of clean to dirty money is an important metric. Despite the increase in absolute illicit volume, the percentage share of illicit activity relative to total crypto volume actually fell to roughly 1.2% in 2025 down from 1.3% in 2024. This tells us that the honest part of the crypto economy is growing faster than the criminal part.
4. Key Crypto Money Laundering Techniques
While the basic concept of money laundering was hiding the source of money. This is still on table but the tools have become incredibly specialized. High-frequency tactics that use everything from decentralized finance to artificial intelligence are making money laundering automated.
Mixers and Tumblers (The Evolution to Privacy Pools)
Traditional mixers like Tornado Cash are still around, but they have become high-risk targets for regulators. Privacy Pools are in rise as a response. These are smarter versions of mixers that use Zero-Knowledge (ZK) proofs. They don't just mix everyone’s money into a giant pot. They let users prove their funds didn't come from a known criminal list without revealing their identity. While marketed for privacy, launderers use them to create a clean proof of funds. The U.S Treasury warned that these decentralized privacy protocols are becoming a major heaven for stolen assets.
Privacy Coins (Monero and the Rise of ZK-Stablecoins)
Due to its default opaque ledger, Monero (XMR) continues to rule the privacy currency market. The sender, recipient, and sum are not visible. However, in the last year, we’ve seen a shift toward ZK-Stablecoins. These take the privacy of Monero and pair it with the price stability of the US dollar. Criminals prefer these because they don't have to worry about the price of their dirty money dropping with high volatility while they are trying to move it.
Chain-Hopping (Multi-Chain Evasion)
This is perhaps the most effective technique in a professional launderer’s toolkit today. It is moving funds across different blockchains. They swap Bitcoin for Ethereum, then move that to Solana. It is harder to be traced, as the money has already hopped to another crypto with a different ledger system. Cross-chain laundering volume hit an estimated record $22 billion last year. It acts as a digital smoke screen that exploits the lack of communication between different blockchain networks.
P2P Exchanges and "Agentic Smurfing"
Peer-to-Peer (P2P) platforms allow people to trade crypto directly for cash or bank transfers. The Agentic Smurfing method uses AI agents to automatically create thousands of burner wallets. It then performs tiny, sub-threshold transactions across dozens of P2P platforms at once. Because the amounts are so small and handled by bots, they often stay under the radar of traditional "red flag" systems that look for large, suspicious transfers.
Decentralized Finance(DeFi) Protocols
Launderers use DeFi to clean money without touching a regulated exchange. They deposit illicit funds into Liquidity Pools where people trade tokens and then withdraw different tokens. Since there is no human oversight or KYC in many of these protocols, it is a frictionless way to break the paper trail. The FATF 2026 updates have started pushing for "DeFi gatekeepers" to be held responsible for these flows. The enforcement remains difficult as the protocols are just decentralized code.
NFTs (Wash Trading and Value Inflation)
NFTs are used for a modern version of trade-based money laundering. A criminal creates an NFT and then buys it from themselves. A different, anonymous wallet with illicit funds is used. Now money looks like a legitimate profit from an art sale. This is scaled up into NFT Wash Trading, where bots buy and sell the same digital asset hundreds of times. The goal is to artificially inflate its price before using it as collateral for a loan in a DeFi protocol. Dirty crypto is effectively turned into a clean loan.
Over-The-Counter(OTC) Desks
These are private brokers that handle massive crypto-to-cash trades outside of public exchanges. Many of them are legitimate. But Shadow OTCs in regions like Southeast Asia and Eastern Europe act as the final exit point. They operate with zero compliance mostly. The physical cash is provided which cartels or sanctioned groups beg for. INTERPOL highlighted these unlicensed recently. These brokers are mentioned as the primary off-ramp for nearly 60% of all high-level crypto crime proceeds in the APAC region.
5. Regulatory Framework: MiCA, Travel Rule, FinCEN
Cryptocurrency regulations are moving to strict enforcement. They are building a global net for virtual assets to be treated as bank transfers. The EU’s MiCA regulation is fully operational in mid-2026. It has replaced the old national laws with a single passportable license. A firm authorized in one EU country can provide services across all member states.
A main change under MiCA is the classification of tokens. Stablecoins are now strictly regulated as either Asset-Referenced Tokens (ARTs) or E-Money Tokens (EMTs). Stablecoin issuers face bank-grade requirements. This includes high liquidity reserves and a total ban on paying interest to users. Stablecoins are trying to be prevented from unregulated shadow bank behaviour. AMLA) also is targeting high-risk crypto-asset service providers (CASPs) that operate across borders.
With FATF Recommendation 15, virtual assets and their service providers are mandated to be regulated for AML. The main part of this is the "Travel Rule." Any crypto transfer above a certain threshold must be accompanied by both the sender, originator, and the receiver ,beneficiary identification. In March 2026, the FATF released a targeted report focusing on the compliance gap in unhosted wallets and peer-to-peer (P2P) transactions. Exchanges must now perform counterparty risk assessments even when their users are sending money to private, unhosted wallets. This is ending the era of anonymous transfers to and from regulated platforms.
In the United States, FinCEN has significantly ramped up its requirements. A major proposed rule specifically targets stablecoin issuers. It requires them to maintain robust AML/CFT programs as banks.
The Digital Asset Market Clarity Act of 2025 (CLARITY Act) has also provided the legal backbone for these rules. It defines which agencies have jurisdiction over different types of tokens. VASPs have to register with FinCEN and file SARs for any red flag transactions. Using mixers or engaging in chain-hopping are examples for red flags.
The regulations are also the front line of Counter-Terrorist Financing (CTF). Cutting off digital terrorist financing is the goal. The March 2026 FATF Ministerial Declaration urges to prevent the misuse of virtual assets for terrorist logistics. These crypto regulations are linked to international security clusters.
6. Red Flags for Crypto Money Laundering
Suspicious activity in the crypto world is not just large transfers. Sophistication of the behavior is also an aspect. FATF 2020 Red Flag Indicators are still the foundation, but now new methods like AI-driven laundering and the dominance of stablecoins are also taken into consideration.
The Foundational Indicators are set in FATF 2020 Baseline. Regulators have expanded on these to account for the speed of modern blockchains. The red flags can be summed up as follows:
- Structuring (Smurfing): Making multiple small transactions just below the $1,000 reporting threshold. The aim is not to trigger an alert.
- Chain-Hopping/Velocity: Receiving a large deposit and immediately moving it out to multiple other wallets or exchanges. Using multiple types of assets. Swapping BTC for ETH then to a privacy coin in a short window. The aim is to break the audit trail. They are also called "u-turn" transactions. This is viewed as a clear sign of an attempt to break the digital paper trail. The user can be an unintentional "money mule" or a victim of a "pig-butchering" fraud.
- Irregular Transaction Patterns: A user with no history of crypto suddenly receiving large amounts and immediately moving them to an external wallet. A low-income profile starts to trade in stablecoins with millions.
- Mixing/Obfuscation: There is an interaction with mixing services. There is an effort to hide the identity from the start with high privacy tools.
- Agentic Smurfing Patterns: Thousands of wallets are created and with micro-transactions at the same time across different time zones. They end up in a single consolidation wallet.
- The "Coached" Customer: A customer at a crypto ATM or exchange appears to be taking instructions over the phone. Austrac provides main indicators of suspicious activity for virtual asset service providers. A victim may be directed to send funds to a scammer or a launderer.
- High-Privacy Email Services: Using encrypted email providers like Proton or Tuta for account registration is now listed as a red flag by when combined with other suspicious behaviors.
- Blockchain "Taint" Exposure: Using wallet addresses that have even a 1-2% exposure to known darknet or scam clusters. Advanced analytics tools can flag a wallet not just for direct interaction. They also catch being two or three hops away from a sanctioned entity like the Lazarus Group.
- Stablecoin Dominance: Since stablecoins now account for over 80% of illicit volume. Any large-scale movement of USDT or USDC into unregulated offshore VASPs is treated as a high-risk event by FinCEN.
- The gray list transactions, from or to Papua New Guinea or Kuwait for instance.
- Heavy interaction with "Offshore VASPs" (oVASPs) located in jurisdictions that have not yet implemented the FATF Travel Rule.
7. How Sanction Scanner Supports Crypto AML Compliance
Sanction Scanner has complex, real-time risk intelligence with latest tools and technology. The new FUSION platform is a good example of how it serves what compliance teams are searching for. The FUSION platform represents a unified "AI-powered risk intelligence" ecosystem. A person normally is run through one database and the wallet address is searched through another database. With FUSION, a single, dynamic risk profile is created and it evolves as the customer interacts with the exchange.
For Virtual Asset Service Providers (VASPs), interacting with a sanctioned entity or a high-risk PEP is a risk. Sanction Scanner accesses global sanctions data with 3,000+ sanctions lists from 220+ countries. The data is updated every 15 minutes. Sanction Scanner provides OFAC crypto-specific designations. The digital currency addresses are filtered. Sanction Scanner integrates OFAC’s Specially Designated Nationals (SDN) list.
Risk is not contained in a single lane. A transaction may involve a sanctioned entity. A fraud alert could be triggered by a high-risk customer. A risk score may be altered by a screening match. This reality is the foundation of Sanction Scanner Fusion's design. Your compliance program stops responding to fragments and begins to view the whole picture when all four capabilities function within the same platform and exchange the same data. PEP screening, adverse media screening, and ongoing monitoring for crypto exchange customers are provided. FUSION platform combines these services and pulls data from onboarding (KYC), real-time transaction behavior, and monitoring into one place.
AI-powered adverse media reports, or starting chain-hopping to a high-risk jurisdiction, triggers FUSION to update the risk score and give an alert. False positives can reduce up to 97 percent in the identification process.
Compliance isn't a one-time event at onboarding. FUSION provides always-on protection with automated daily ongoing monitoring. Every 24 hours the platform re-screens the entire customer base against the latest sanctions and PEP updates. How frequent depends on the risk level. If a clean customer becomes dirty a month after joining the exchange, the VASP is the first to know.
