TL;DR: Crypto-based money laundering now extends beyond hiding on-chain proceeds and increasingly touches mixers, bridges, hops, and established laundering networks moving into cryptocurrency, according to Chainalysis. The governance challenge is no longer just tracing assets, but linking blockchain intelligence to AML workflows that can follow crime across on-chain and off-chain activity.
At a glance
What this is: Chainalysis argues that crypto money laundering is no longer limited to hiding proceeds on-chain and now spans crypto-native tactics and broader laundering networks.
Why it matters: For AML, fraud, and identity teams, the point is that transaction visibility alone is not enough if investigative workflows cannot connect wallets, actors, and off-chain behaviour.
Context
Crypto money laundering now needs to be treated as a cross-channel investigation problem, not just a blockchain tracing problem. When laundering methods include mixers, bridges, hops, and longer-established criminal networks, the governance gap is the handoff between transaction monitoring and broader AML casework.
For identity and financial crime teams, the key issue is evidentiary continuity. The article points to a world where investigators need to connect pseudonymous on-chain activity to real-world entities, which brings KYC, sanctions screening, and case management into the same operating picture.
Key questions
Q: How should AML teams investigate crypto transactions that use mixers and bridges?
A: Start by treating mixers and bridges as provenance-disrupting services rather than final conclusions. Correlate transaction timing, counterparty clustering, and account identity evidence, then move the case into a broader entity-based investigation. The goal is to reconstruct the laundering path, not to prove risk from a single hop or wallet event.
Q: Why is blockchain transparency not enough to stop crypto money laundering?
A: Because visibility does not equal identity or intent. A blockchain can show movement, but AML teams still need entity resolution, customer data, and escalation procedures to turn that movement into a defensible compliance decision or investigative action.
Q: What are the signs that sophisticated crypto criminals are adapting their laundering methods?
A: A key sign is when illicit funds shift quickly from a disrupted service to a replacement tool or route, rather than disappearing. The report shows this with mixer takedowns followed by migration to YoMix, and with increased use of cross-chain bridges. Another indicator is rising diversity in services used, especially when activity spreads across more addresses or chains to reduce exposure.
A: Prioritise blockchain analytics when the suspicious activity is already crypto-native or when funds repeatedly cross between digital assets and fiat channels. In those cases, traditional monitoring alone will miss key attribution steps and delay response.
Technical breakdown
How mixers, bridges, and hops change the tracing problem
Mixers, bridges, and hops are transaction-layer obfuscation techniques that interrupt simple path analysis. Mixers pool funds to blur source and destination, bridges move assets across chains, and hops create multi-step movement patterns that raise the cost of attribution. These techniques do not make tracing impossible, but they force investigators to rely on cluster analysis, timing patterns, and cross-chain correlation rather than single-transaction logic. The security issue is not just concealment, but the creation of investigative friction that delays containment and attribution.
Practical implication: investigators need analytics that preserve chain-of-custody across hops, not just point-in-time wallet tracing.
How established laundering networks enter cryptocurrency
When conventional laundering networks adopt cryptocurrency, they bring mature tradecraft into a faster, more programmable environment. That can include layering, mule coordination, and movement between digital assets and fiat touchpoints. The result is a hybrid laundering path where blockchain intelligence is necessary but insufficient on its own, because the criminal workflow still depends on off-chain actors, accounts, and institutions. This is where cryptocurrency becomes part of a broader financial crime stack rather than a self-contained threat category.
Practical implication: AML teams should connect blockchain signals to customer, counterparty, and account-risk data instead of treating crypto as a separate queue.
Why blockchain transparency does not equal investigative completeness
Public blockchains expose transaction history, but visibility is not the same as meaning. Investigators may see addresses, flows, and amounts, yet still lack the identity link needed for enforcement, sanctions action, or fraud interruption. The article’s core point is that transparency only helps when it is operationalised through casework, entity resolution, and compliance workflows. Without that linkage, the organisation can observe laundering activity without being able to act on it decisively.
Practical implication: integrate blockchain intelligence into AML case management, alert triage, and escalation workflows rather than leaving it as a specialist tool silo.
Threat narrative
Attacker objective: The objective is to move illicit funds through cryptocurrency with enough concealment to frustrate attribution, enforcement, and recovery.
- Entry occurs when illicit proceeds are placed into crypto-native channels or laundered through established networks that now operate in cryptocurrency.
- Credential access or concealment is achieved through mixers, bridges, and hops that obscure source and destination relationships across chains.
- Escalation happens as laundering networks combine on-chain obfuscation with off-chain movement and identity separation to reduce attribution risk.
- Impact is the movement and monetisation of illicit value while making investigations slower, costlier, and harder to evidence.
Breaches seen in the wild
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Crypto laundering is now a governance problem, not only a tracing problem. The article shows that blockchain transparency is useful but incomplete when laundering spans mixers, bridges, hops, and off-chain activity. For identity and financial crime programmes, the control gap is not visibility alone but the ability to bind transaction intelligence to an accountable AML workflow.
Hybrid laundering creates a verification gap between pseudonymous wallets and real-world entities. That gap matters because KYC, sanctions, fraud, and investigations are often run as separate operating models even when the adversary crosses them fluidly. The practical implication is that organisations need a shared evidentiary model that can support both compliance action and investigative escalation.
Established criminal tradecraft is adapting to crypto faster than many case workflows are adapting to it. The important shift is not that criminals use blockchain, but that they are importing layered laundering behaviour into it. That means static monitoring rules will miss the operational reality unless teams design for cross-chain, cross-entity, and cross-channel correlation.
Blockchain intelligence is becoming a control input for AML, not a specialist afterthought. Once laundering spans multiple venues and actors, the useful question is no longer whether a transaction is visible, but whether it can be actioned inside the institution’s risk process. Practitioners should treat blockchain intelligence as part of enterprise financial crime governance, not as an isolated analyst function.
Crypto laundering pressure is pushing identity programmes toward evidence integration. Identity verification, customer risk, and transaction monitoring must converge if institutions want to explain suspicious movement quickly enough to intervene. The broader signal is that financial crime teams need governance over data linkage, not just better pattern detection.
What this signals
Crypto laundering now behaves like a cross-channel governance problem. Teams that still separate blockchain tracing from AML casework will struggle to explain suspicious flows quickly enough to support enforcement or account action. The operational response is to make entity resolution and escalation part of the same control path.
Identity linkage is the real control point. Pseudonymous wallets are only useful to investigators when they can be tied back to customer risk, counterparties, and transaction behaviour. That makes KYC, sanctions, and financial crime operations part of the same evidence chain.
Traceability without workflow integration creates false confidence. A team can see the movement and still fail to act if alerts, investigations, and compliance decisions live in separate systems. Practitioners should focus on reducing handoff friction as much as improving analytics.
For practitioners
- Map crypto laundering patterns into AML case workflows Link mixer, bridge, and hop alerts to the same escalation path used for suspicious fiat activity so investigators can retain context across channels.
- Correlate blockchain intelligence with identity and account data Join wallet-level signals with KYC, customer risk, counterparties, and transaction metadata so pseudonymous activity can be resolved into actionable cases.
- Review cross-chain tracing coverage for blind spots Check whether your tooling can follow value across bridges, hops, and chain changes without breaking the evidentiary trail needed for compliance action.
- Align sanctions, fraud, and AML escalation criteria Use shared thresholds for suspect activity so the same case can move from detection to investigation without being trapped in a single team’s queue.
Key takeaways
- Crypto money laundering is expanding beyond simple on-chain concealment and now includes techniques that intentionally break straightforward tracing.
- The key operational weakness is not lack of blockchain visibility, but the gap between on-chain intelligence and AML workflows that can act on it.
- Investigators and compliance teams need shared evidence handling across crypto-native and off-chain activity to keep pace with hybrid laundering networks.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-63 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity linkage and account governance are central to turning blockchain signals into action. |
| DE.CM-01 — Networks and Systems Monitored | Cross-chain laundering requires monitoring that reaches beyond a single ledger or system boundary. | |
| Recommendation — Strengthen entitlement governance so suspicious crypto-linked access and account activity can be escalated quickly. Monitor crypto and fiat investigative signals together so laundering patterns are detected across channels. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Crypto laundering investigations depend on resolving pseudonymous activity to accountable identities. |
| Recommendation — Apply identity proofing controls where wallet-linked activity must be tied back to real-world entities. | ||
| GDPR | Art.32 — Security of Processing | Where AML data includes personal data, investigators must protect evidentiary and customer information. |
| Recommendation — Protect AML case data with security-of-processing controls that preserve confidentiality and integrity. | ||
Key terms
- Blockchain Intelligence: Blockchain intelligence is the use of analytics and enrichment data to trace cryptocurrency transactions, identify entities, and connect wallet activity to real-world behaviour. It supports investigations, but it does not replace case management, evidentiary discipline, or trained analysis.
- Mixer: A mixer is a service that pools and redistributes cryptocurrency to make source and destination links harder to trace. Mixers do not erase evidence, but they add enough ambiguity that investigators usually need clustering, timing, and external identity signals to rebuild provenance.
- Cross-Chain Transaction Tracing: Cross-chain transaction tracing is the process of following value as it moves across multiple blockchains, bridge contracts, and decentralized exchanges. It requires linking fragmented records into one coherent path so investigators can identify origin, destination, and intermediate steps without losing context.
- Entity Resolution: Entity resolution is the process of determining which accounts, wallets, devices, or records belong to the same real-world actor. It is essential for sanctions and AML programmes because transaction data alone often hides related activity unless it is linked back to a trusted identity model.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org