TL;DR: Chinese money laundering networks processed about $16.1 billion in 2025, accounting for roughly 20% of known illicit crypto laundering, with activity scaling far faster than exchange-based inflows and spreading across six distinct service types, according to Chainalysis. The governance challenge is no longer isolated platforms but resilient laundering infrastructure that adapts when enforcement shifts pressure elsewhere.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Chainalysis's research: Chinese money laundering networks have become a major organizing layer in crypto crime, with a 2025 processing volume of $16.1 billion and a broad mix of laundering service types.
Why it matters: IAM, fraud, and financial crime teams need to see how identity rental, mule accounts, and rapid channel switching make laundering ecosystems resilient to controls aimed at single platforms.
By the numbers:
- They accounted for about 20% of known illicit crypto laundering over the past five years, according to Chainalysis.
- Their inflow growth since 2020 was 7,325 times faster than inflows to centralised exchanges, according to Chainalysis.
Context
Chinese money laundering networks have evolved from a regional channel into a durable laundering layer for crypto crime, combining brokered access, mule activity, OTC conversion, and swapping services. The governance issue is not just transaction volume, but how quickly illicit actors can reconfigure identity, access, and cash-out pathways when one channel is disrupted.
For practitioners, the important question is how fraud, AML, and identity controls interact when criminal operators treat accounts, wallets, and platforms as interchangeable infrastructure. That makes this topic relevant to IAM and fraud teams alike, because the underlying pattern is identity abuse at scale, even when the money movement itself sits outside traditional enterprise boundaries.
Key questions
Q: What breaks when laundering networks can rent financial identities at scale?
A: When laundering networks can rent financial identities at scale, KYC and account ownership assumptions stop being reliable. The system no longer connects a transaction to a stable, accountable person, so fraud, AML, and platform controls lose attribution. Teams need identity proofing, behavioural correlation, and account lifecycle controls that can detect when an identity is being borrowed for criminal movement.
Q: Why do mule accounts make transnational fraud harder to stop?
A: Mule accounts distribute stolen funds across many legitimate-looking endpoints, which makes thresholds, alerts, and single-account review much less effective. The fraud pattern is relational, so the useful signal is often the cluster, not the individual account. Institutions need graph-based analytics and shared intelligence to see the network.
Q: What signs show that laundering activity is being structured to evade controls?
A: Watch for many small transfers replacing a few large ones, rapid counterparty churn, and repeated movement through the same service types in short cycles. Those patterns indicate the network is splitting value to avoid thresholds or pooling it to re-enter the formal system.
Q: How should AML, fraud, and IAM teams work together on laundering cases?
A: They should share entity resolution, account ownership intelligence, and transfer-pattern analysis so they can see both the identity boundary and the movement boundary. The article shows that the abuse spans onboarding, account control, and cash-out, so no single team sees the full picture.
Technical breakdown
How Chinese laundering networks structure crypto cash-out ecosystems
The article describes a layered laundering market rather than a single laundering method. Running point brokers bring funds in, money mule networks move and split them, OTC desks and aggregators consolidate them, gambling services add volatility and plausible transaction histories, and swap or mixing services obscure traceability. Each layer has a different role in the laundering chain, but the ecosystem is resilient because operators can shift between layers without losing the overall function. That resilience matters because disruption at one layer often only displaces activity to another layer.
Practical implication: Practitioners should model laundering as a network of interchangeable services, not as a single platform problem.
Why identity rental and mule accounts are central to laundering operations
A defining feature of these networks is the use of real people to lend financial identity. Running point brokers recruit individuals to provide bank accounts, wallets, and exchange deposit addresses, which turns normal account infrastructure into a laundering ingress. That is an identity governance failure as much as a financial crime technique, because the control objective is not just transaction screening but who is allowed to open, control, and reuse account access. In practice, mule networks are the bridge between online fraud, stolen crypto, and downstream cash-out.
Practical implication: Controls need to target account ownership, beneficiary risk, and identity reuse across financial channels.
How structuring and aggregation defeat simple monitoring rules
The article shows two opposite but complementary patterns. Some services break large transfers into many smaller ones to stay under detection thresholds, while others aggregate many inflows into fewer larger outflows that are easier to integrate into the formal system. That means rule-based monitoring can miss the ecosystem if it watches only transaction size or only one direction of flow. Effective detection has to account for movement patterns, counterparty clustering, and service role over time, not just a single suspicious transfer.
Practical implication: Tune monitoring for behavioural patterns such as splitting, pooling, and rapid counterparty reuse, not only thresholds.
Threat narrative
Attacker objective: The objective is to convert stolen or fraud-derived crypto proceeds into apparently legitimate funds while preserving speed, reach, and deniability.
- Entry occurs when recruiters persuade individuals to lend bank accounts, wallets, exchange addresses, or payment identities to laundering operators.
- Credential or account abuse follows when those identities are used to receive, split, route, and exchange illicit funds across multiple services.
- Escalation and layering happen as operators move money through OTC desks, gambling services, swaps, and aggregation channels to obscure origin and ownership.
- Impact is the integration of criminal proceeds into apparently legitimate assets and payment flows that are harder for platforms and investigators to unwind.
NHI Mgmt Group analysis
Chinese laundering networks have become identity infrastructure for financial crime: the core governance failure is not only payment movement but the conversion of personal and account identity into a reusable criminal asset. Once bank accounts, wallets, and exchange access can be rented or coerced into service, the line between fraud, mule activity, and laundering collapses. That is why account lifecycle control and beneficial ownership visibility matter as much as transaction monitoring. Practitioners should treat identity reuse across financial channels as a first-class risk.
Channel disruption alone is an incomplete response: the article shows that pressure on one platform or service type often just forces migration to another. That means enforcement or internal control strategies that focus on a single venue will underperform against distributed laundering ecosystems. The broader lesson is that resilience comes from modular service design, so disruption has to target the operator network, not just the front end. Practitioners should build investigations around network relationships, not isolated alerts.
Structuring and aggregation are the laundering equivalents of evasive traffic shaping: one set of services fragments value to avoid detection while another consolidates it to integrate into the formal economy. That duality makes simplistic threshold-based controls brittle, especially when the same actors can switch roles as needed. In governance terms, the named concept here is laundering role fluidity, where one network can behave as broker, mule, aggregator, or exchanger depending on enforcement pressure. Practitioners should detect role changes, not just suspicious transactions.
Financial crime teams need identity plus blockchain intelligence: the article’s most important implication is that neither account controls nor on-chain analytics are sufficient on their own. The former sees the identity boundary, while the latter sees the transfer boundary, and the abuse happens across both. That makes cross-domain evidence correlation the operating model, not an optional enhancement. Practitioners should align fraud, AML, and IAM workflows around shared entity resolution.
What this signals
Laundering role fluidity: criminal networks now shift between broker, mule, aggregator, and exchanger roles as pressure changes, which makes single-control responses weak. Practitioners should plan for adversaries who can recompose the same laundering function across different service types without changing the underlying objective.
The practical implication for IAM and fraud programmes is that account ownership, reuse, and cross-platform linkage matter more than venue-by-venue rule sets. When the same identity can be repurposed across wallets, exchanges, and payment rails, controls have to follow the entity, not just the transaction.
For practitioners
- Strengthen account ownership checks for high-risk payment and exchange onboarding Require stronger proof of control for bank accounts, wallets, and exchange deposits that can be used as mule infrastructure, especially where the same identity appears across multiple payment venues.
- Flag identity reuse across financial channels Correlate bank, wallet, exchange, and payment-provider identities to detect when the same person or credential set is being used to move funds through different services.
- Tune monitoring for splitting and pooling patterns Look for rapid fragmentation of large transfers into many small ones, followed by aggregation into larger outflows, because that is the operational signature of the laundering chain described in the article.
- Investigate operators, not just platforms When one service is disrupted, trace where the vendors, recruiters, and linked wallets migrate, because the article shows that the underlying network persists even when a front-end platform is taken down.
Key takeaways
- Chinese laundering networks now function as a distributed infrastructure layer for crypto crime, not just as isolated intermediaries.
- The article shows how identity rental, mule activity, structuring, and aggregation combine to defeat simple platform-level controls.
- Practitioners need shared IAM, fraud, and AML visibility if they want to trace the same actor across account ownership and value movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Account and wallet misuse is fundamentally an access and entitlement problem across financial channels. |
| Recommendation — Apply PR.AA-05 to tighten entitlements on accounts that can move or cash out value. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on recruited and reused accounts that enable laundering operations. |
| Recommendation — Use CIS-5 to identify, review, and revoke high-risk accounts used across multiple financial services. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The laundering chain depends on account access and movement across services and platforms. |
| Recommendation — Map mule and broker activity to TA0006 and TA0008 to spot cross-platform movement patterns. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Identity rental and account reuse make authenticator lifecycle governance directly relevant. |
| Recommendation — Use IA-5 to manage credentials that can be repurposed for mule and brokerage activity. | ||
Key terms
- Money mule: A money mule is an account holder or intermediary used to receive and move fraudulent funds on behalf of a criminal. Mule activity is part of the execution layer of many scams because it helps obscure the final destination and complicates recovery, tracing, and reversal.
- Laundering Role Fluidity: Laundering role fluidity is the ability of a criminal network to switch between broker, mule, exchanger, and aggregator roles as pressure changes. The same infrastructure can serve multiple functions, which makes detection harder if controls only look for one fixed pattern of behaviour.
- Structuring: Structuring is a money-laundering technique that breaks a large transaction into smaller ones to avoid reporting thresholds. The fraud works because each transfer can look ordinary on its own, so investigators need aggregated behavioural analysis and identity linkage to see the pattern.
- Aggregation: Aggregation is the process of combining findings from multiple security tools into a single, usable view. Good aggregation goes beyond collecting records. It removes duplicates, reconciles conflicting data, and adds business context so teams can see the actual risk instead of a pile of overlapping alerts.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, identity lifecycle, and secrets management. It helps practitioners connect identity controls to the access and ownership issues that underpin fraud and laundering risk.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org