Stablecoins combine speed, cross-border reach, and low volatility, which makes them efficient for settlement and layering. Those same operational benefits also make them attractive to criminals and sanctions evaders. The risk is not the token alone, but the way it supports rapid movement through reusable infrastructure and counterparties.
Why stablecoins are useful to criminals, and why that matters
Stablecoins are attractive because they preserve the payment properties that illicit actors want most: speed, broad reach, low friction, and value stability. That combination supports rapid movement of funds across venues, chains, and counterparties without the volatility that can complicate settlement or timing. The same operational efficiency that helps legitimate users also reduces the cost and delay of abusive transfer patterns.
A stablecoin is therefore not inherently “criminal infrastructure”; it is a settlement instrument that can be repurposed. What changes the risk profile is how easily value can be split, routed, recombined, or transferred through reusable wallets, exchanges, bridges, and other intermediaries while still appearing routine at the transaction layer.
For more on the underlying controls and access patterns that often sit behind these flows, see FATF Recommendations, AML and KYC Framework and the EU NIS2 Directive, which both reflect why payment rails, counterparties, and service providers remain part of the control surface.
What on-chain properties make stablecoin activity easier to abuse?
Three properties matter most. First, stablecoins are highly liquid, so they can be moved quickly with little market impact. Second, they are interoperable across many venues and protocols, which expands the number of possible transfer paths. Third, they are simple to denominate and split, which makes structuring, layering, and dispersing value more operationally efficient than with more volatile assets.
Those properties are especially useful in illicit workflows that rely on repetition rather than sophistication. The actor does not need to “break” the token. They need to move funds through ordinary-looking rails at scale, often using many small transactions, multiple wallets, and service points that were designed for fast settlement rather than high-friction scrutiny.
The blockchain record can be visible while the activity remains difficult to interpret in real time. That is why the relevant security question is often not “can the transfer be seen?” but “can the counterparties, ownership, and source of funds be meaningfully governed before the value is already moved?”
For the attacker model behind rapid movement and concealment, the MITRE ATT&CK Enterprise Matrix is a useful analogue for thinking about chaining actions, while ENISA Threat Landscape provides the broader view of how abuse scales through common infrastructure and service dependencies.
Why sanctions evasion and laundering patterns fit stablecoin rails so well
Stablecoins are often attractive in jurisdictions where access to correspondent banking is constrained, delayed, or heavily monitored. They can also be used to move value through intermediary wallets or service providers in ways that complicate attribution and make sanctions screening less effective if controls are weak or applied only at a single checkpoint.
This does not mean the token itself is inherently opaque. It means that illicit actors benefit when monitoring is fragmented across wallets, exchanges, OTC channels, bridges, and custodial services. When those points are treated as separate problems, the overall trail can look thinner than the underlying economic activity really is.
That is also why compliance, customer due diligence, and transaction monitoring matter more than a narrow focus on token type. The meaningful control question is whether the ecosystem can identify patterns of rapid pass-through, counterpart risk, and repeated reuse of the same infrastructure even when individual transfers look ordinary in isolation.
For AML and sanctions context, FATF Recommendations, AML and KYC Framework is the core policy reference, and the EU NIS2 Directive is relevant where service resilience and access control in supporting infrastructure affect the effectiveness of those controls.
Risk and Threat Considerations
Stablecoins create a concentrated abuse surface when rapid settlement, low friction, and broad portability are combined with weak counterparty controls. The main risk is not that a transfer is technically invalid, but that the same utility prized by legitimate users also supports layering, sanctions evasion, and repeated reuse of infrastructure across many hops.
Failure mechanism: Criminals exploit fast finality, wallet reuse, and fragmented oversight across venues to move value before monitoring, freezing, or attribution catches up.
Impact: Investigations become harder, interdiction windows shrink, and the same rails can repeatedly support laundering, fraud proceeds, and sanctions avoidance at scale.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Stablecoin abuse is a flow and counterpart risk that needs explicit risk treatment. |
| Recommendation — Define stablecoin exposure as a distinct risk scenario and align monitoring to the transfer patterns that drive it. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | On-chain illicit activity depends on reviewable transaction evidence and pattern analysis. |
| IA-5 — Authenticator Management | Wallet and service access often depend on credentials and keys that must be controlled. | |
| Recommendation — Correlate wallet, venue, and transaction logs to detect suspicious movement patterns early. Rotate and protect credentials and keys that can move stablecoins or access related services. | ||
| CIS Controls v8 | CIS-5 — Account Management | Stablecoin abuse often exploits reusable accounts and high-risk counterparties across services. |
| Recommendation — Inventory and govern accounts that can initiate, receive, or approve stablecoin transfers. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access governance matters where transfer authority and service access determine fund movement. |
| Recommendation — Limit transfer authority to approved roles and verify access before trusting high-value flows. | ||
Practitioner Guidance
What to prioritise: Treat stablecoin risk as a networked counterpart and flow problem, not a token-label problem. The highest-value controls usually sit where identities, wallet ownership, exchange access, and transaction monitoring intersect.
What to verify: Confirm that your monitoring can correlate repeated wallet reuse, cross-venue movement, rapid pass-through, and interaction with high-risk counterparties. If you only review single transactions, you will miss the pattern that makes stablecoins attractive for illicit use.
Decision rule: If the activity can move funds quickly between many counterparties with weak beneficial-ownership visibility, treat it as elevated abuse potential even when each individual transfer looks small or routine.
Practitioner takeaway: The key judgment is to measure stablecoin activity by flow behaviour and counterparty trust, because the abuse signal usually emerges from movement patterns rather than from the token itself.
Related resources from NHI Mgmt Group
- Why do mobile retail apps attract so much fraud activity?
- Why do open prediction markets and digital collectible platforms attract both legitimate users and illicit activity?
- Why do cross-chain bridges create more risk for money laundering and other illicit activity monitoring?
- How should fraud teams respond when digital acquisition and account opening attract too much attack activity?