TL;DR: Cryptocurrency is reshaping money laundering, fraud, DeFi exploitation, ransomware and cross-chain criminal activity, while investigators increasingly use blockchain transparency and analytics to trace assets and cases, according to Chainalysis. The governance issue is no longer whether crypto is criminally useful, but whether controls, investigation workflows and identity assurance can keep pace.
At a glance
What this is: Chainalysis says crypto crime is evolving across money laundering, fraud, DeFi exploits, ransomware and cross-chain activity, while defenders increasingly use blockchain transparency and analytics to trace assets.
Why it matters: Fraud, financial crime and identity teams need to treat crypto not as a niche payment rail but as an operating environment where controls, investigation workflows and identity assurance must keep pace with criminal adaptation.
Context
Crypto crime is not a single threat category. It spans fraud, laundering, ransomware, DeFi exploitation and asset movement across chains, which means control failures can sit in onboarding, transaction monitoring, wallet governance or investigation handoff.
For security and identity teams, the key issue is governance at the boundary between legitimate financial activity and criminal abuse. Where crypto is embedded in mainstream finance, investigators need stronger identity assurance, better case linkage and faster evidence handling than many traditional fraud programmes were built for.
Key questions
Q: What breaks when traditional fraud controls meet crypto-native crime?
A: Traditional fraud controls break when they assume centralised oversight, reversible transactions and stable account identities. Crypto crime exploits wallet churn, cross-chain movement and automated laundering to outrun those assumptions. Security teams need controls that connect wallets, identities and case evidence across venues, not isolated rules for each platform.
A: Blockchain transparency gives investigators a durable transaction trail that can be queried, traced, and correlated with known entities. That makes it easier to connect addresses, identify suspicious patterns, and build evidentiary narratives. Even when criminals use mixers, bridges, or exchanges, the underlying ledger still preserves enough structure to support lead generation and asset tracing.
Q: What do security teams get wrong about cross-chain laundering?
A: They often treat it as a pure blockchain tracing problem when it is also an identity and governance problem. Criminals can split funds, move through bridges and shift between services faster than case workflows can correlate evidence. Effective programmes join on-chain analytics with off-chain identity controls and escalation processes.
A: They should prioritise crypto-specific monitoring when value can move irreversibly, across multiple chains, or through DeFi and wallet infrastructure that generic transaction rules do not model well. In those environments, generic review is too slow and too shallow. Behavioural monitoring and evidence linkage become the higher-value controls.
Technical breakdown
How crypto crime scales across wallet, chain and platform boundaries
Crypto-enabled crime often succeeds by moving across systems faster than controls can reconcile ownership, intent and destination. A fraud scheme may start with social engineering, then use wallets, bridges, exchanges and DeFi protocols to obscure proceeds. Unlike a single-bank payment environment, the investigative surface is fragmented across chains and services, so attribution depends on correlating addresses, transaction timing and platform metadata. That makes the security problem partly one of identity linkage: who controlled the wallet, who approved the transfer, and which service boundary failed to challenge it.
Practical implication: Map transaction flows across chain boundaries and tie wallet activity back to verified identity evidence where your risk model requires it.
Why traditional fraud controls struggle with crypto-native abuse
Traditional fraud controls were built for account-based systems with central intermediaries, reversal options and stable trust anchors. Crypto crime removes several of those assumptions. Transfers are often irreversible, assets can be moved through automated contracts, and the same actor can create or rotate wallets quickly to fragment behaviour. That does not make blockchain invisible. It makes pattern recognition and operational correlation more important than a single point control, especially when scam infrastructure, laundering and theft happen in the same campaign.
Practical implication: Recalibrate fraud rules for non-reversible transfer environments and build investigation workflows that assume address churn and cross-platform movement.
Blockchain transparency changes the investigation model, not the threat model
Blockchain transparency gives investigators a durable ledger to trace funds, but transparency alone does not stop theft, fraud or laundering. The practical shift is that detection and recovery can happen through analytics, clustering and case enrichment, provided teams can connect on-chain behaviour to off-chain identity and service data. In identity terms, this is a trust problem as much as a data problem. If onboarding, account recovery or support workflows are weak, investigators may see the chain path but still lack the human or organisational identity evidence needed to act quickly.
Practical implication: Pair on-chain analytics with stronger identity, support and case-management controls so traceability turns into action.
Threat narrative
Attacker objective: The objective is to convert stolen, extorted or fraudulently obtained value into assets that are harder to trace and recover.
- Entry begins with fraud, scam infrastructure or access to a crypto-facing service that lets criminals initiate or receive value.
- Credential or wallet control is then abused to move funds, split proceeds and route assets through laundering or cross-chain paths.
- Escalation occurs as attackers combine DeFi exploits, ransomware proceeds or scam automation to widen impact and reduce traceability.
- Impact is realised through theft, laundering and faster criminal monetisation before traditional fraud controls can contain the campaign.
Breaches seen in the wild
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Crypto crime governance is now an identity problem as much as a financial crime problem: when wallets, exchanges, support flows and off-chain case records do not align, defenders lose the ability to prove who controlled value at the point of transfer. The article's themes show that transaction visibility is not enough if identity assurance, evidence linkage and escalation paths are fragmented. Practitioners should treat wallet control and account provenance as core governance inputs, not after-the-fact investigation data.
Cross-chain movement creates a control gap that traditional fraud programmes were not designed to close: the same criminal campaign can span laundering, DeFi abuse and scam infrastructure faster than legacy rules can classify it. That means the operational unit of defence is no longer a single transaction, but the sequence of linked behaviours across services. Practitioners should redesign detection around behaviour chains rather than isolated alerts.
Blockchain transparency is a detection advantage, but only when paired with authoritative off-chain identity records: ledgers show movement, not intent, ownership or organisational responsibility. That makes case quality dependent on KYC, account recovery, support tooling and evidence handling. Practitioners should focus on improving the identity trail that makes on-chain evidence actionable.
Fraud teams now need a named concept for the gap this article exposes: control drift between payment speed and investigative speed: criminals can move value, rotate infrastructure and hop chains before many traditional control loops complete. The practical consequence is that policy, monitoring and case handling must be built for immediate correlation rather than retrospective review. Practitioners should optimise for response latency, not just alert volume.
What this signals
Control drift between payment speed and investigation speed is the central governance issue in crypto crime: criminals exploit the gap between how fast value moves and how slowly many fraud programmes correlate evidence. That means security leaders should measure whether case handling, wallet attribution and support records can keep pace with chain movement.
As crypto becomes more embedded in mainstream finance, fraud and identity programmes need to treat wallet control, recovery flows and off-chain evidence as part of the same assurance model. A team that can see a transfer but cannot prove control at the time of transfer still has a governance gap.
For practitioners
- Tighten wallet-to-identity linkage Require stronger linkage between wallet activity, customer identity and case records so investigators can reconstruct control over funds quickly.
- Rebuild fraud rules for cross-chain movement Tune detection logic to follow funds across bridges, exchanges and DeFi protocols instead of treating each venue as an isolated event.
- Strengthen off-chain evidence handling Preserve support logs, recovery actions and platform metadata alongside blockchain traces so investigations can join chain and identity evidence.
- Shorten escalation paths for crypto incidents Create a fast path from suspicious wallet behaviour to fraud, legal and investigation teams when laundering or scam activity is suspected.
Key takeaways
- Crypto crime now spans fraud, laundering, ransomware and DeFi abuse, which makes isolated fraud rules less effective than end-to-end behavioural monitoring.
- Blockchain transparency improves tracing and recovery, but it does not replace the identity, support and case records needed to prove control and attribution.
- The practical response is to align on-chain analytics with identity assurance and faster escalation workflows so investigations move at the speed of the threat.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | Crypto crime here centers on control of wallets and movement of value for laundering or theft. |
| Recommendation — Map wallet abuse and laundering patterns to TA0006 and TA0010 to improve detection and investigation coverage. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Wallet control and service access are governance issues where authorization evidence matters. |
| Recommendation — Apply PR.AA-05 to tighten authorisation evidence for wallet actions and investigation handoff paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Crypto-facing accounts, support access and recovery workflows depend on disciplined account lifecycle controls. |
| Recommendation — Use CIS-5 to review account provisioning, recovery and deactivation across crypto-facing services. | ||
| GDPR | Art.32 — Security of Processing | Where fraud cases involve customer data and identity evidence, processing security becomes material. |
| Recommendation — Apply Art.32 to protect identity and case data used in crypto fraud investigation workflows. | ||
Key terms
- Cross-Chain Laundering: Cross-chain laundering is the movement of stolen crypto across multiple blockchains to make tracing harder. Attackers use bridges, swaps, and intermediary wallets to fragment transaction history and obscure the destination of funds. For investigators, the challenge is maintaining continuity across networks while identifying control points and cash-out paths.
- Blockchain Analytics: Blockchain analytics is the use of transaction tracing, wallet screening, and risk scoring to understand how crypto assets move across addresses and services. In compliance programmes, it supports source-of-funds checks, sanctions screening, and escalation decisions, but it only becomes effective when the output drives an actual control action.
- Wallet Attribution: Wallet attribution is the practice of linking blockchain addresses to entities, campaigns, or behaviours. In compliance work, it turns a raw address into an identity context that can be screened, monitored, and escalated when associated with sanctions, fraud, or laundering activity.
- Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity control to broader security operations and resilience planning.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org