Cryptocurrency laundering is the process cybercriminals use to break the visible link between stolen or extorted crypto-assets and the cash they eventually spend, and it is where most theft, ransomware and scam proceeds are either frozen or lost for good. Public blockchains record every transfer, so laundering is less about hiding that money moved and more about making the trail too long, too fragmented or too cross-jurisdictional to act on before funds reach an off-ramp. This explainer describes the typologies that regulators and law enforcement have documented, mixers, cross-chain bridges, chain hopping, nested services and cash-out through weakly controlled providers, and then what defenders at exchanges, banks and incident response firms can do to spot, trace and freeze funds. It is written for fraud, AML, threat intelligence and incident response practitioners. It deliberately stays at the level of typology and red flags: programme design sits in the AML programme and transaction monitoring guide, and tooling in the Blockchain Analytics and On-Chain Monitoring Guide.
Key takeaways
- Laundering is a race against the freeze. The FBI reported that after the February 2025 theft of about USD 1.5 billion from a crypto exchange, attributed to North Korea's "TraderTraitor" activity, the funds were rapidly converted and spread across thousands of addresses on multiple blockchains; FATF later reported that only 3.8% had been recovered.
- Obfuscation tools change, the pattern does not. Mixers, bridges and swaps all serve the same purpose: lengthen and fragment the trail until it reaches a service with weak AML controls that will convert to fiat.
- Stablecoins now dominate illicit flows. FATF's June 2025 targeted update states that most on-chain illicit activity now involves stablecoins, which matters because some issuers can freeze tokens.
- The off-ramp is the defender's best chokepoint. US Treasury's 2024 National Money Laundering Risk Assessment describes ransomware and scam proceeds cashing out through VASPs with weak controls, nested services and money mule accounts.
- Speed of sharing decides recovery. Blocking addresses published by law enforcement, screening deposits against them and reporting fast does more than any after-the-fact tracing report.
What it is
Laundering of cybercrime proceeds follows the classic three stages of placement, layering and integration, adapted to crypto-assets. Placement is often trivial because the proceeds start on-chain: a ransom paid to an address, a theft from a hot wallet or bridge contract, or a victim's transfer in an investment scam. Layering is where the effort goes: moving value through many addresses, services and blockchains so that analytics firms and investigators lose confidence in the link. Integration is the conversion to fiat or to goods, typically through an exchange, an over-the-counter (OTC) broker, a peer-to-peer trader or a money mule's bank account.
The actors range widely. Treasury's April 2023 DeFi Illicit Finance Risk Assessment names North Korea, cybercriminals, ransomware operators, thieves and scammers as users of decentralised finance services to move and launder proceeds, and identifies non-compliance with AML/CFT and sanctions obligations as the primary vulnerability. The FATF Recommendations apply to virtual asset service providers (VASPs) through Recommendation 15, and the Travel Rule (originator and beneficiary information travelling with transfers) through Recommendation 16; FATF reported in June 2025 that 99 jurisdictions have passed or are passing Travel Rule legislation. See the Crypto Travel Rule Compliance Guide.
How it works
The typologies below are those described by FATF, US Treasury, FinCEN and OFAC. They are listed so that defenders can recognise them, not as a method.
| Typology | What it does for the launderer | Official source | What defenders see |
|---|---|---|---|
| Mixers and tumblers | Pool funds from many users and pay out to new addresses, weakening the link between input and output | FinCEN Section 311 proposal on international CVC mixing (October 2023); OFAC designations of Blender.io (May 2022) and Sinbad.io (November 2023) | Deposits with direct or near exposure to a known mixer cluster; round-number outputs; time delays |
| Chain hopping via cross-chain bridges | Moves value from one blockchain to another so that tracing must continue in a different ledger and often a different tool | Treasury 2024 National Money Laundering Risk Assessment (scam and ransomware sections) | Funds arriving shortly after a bridge or swap event from a chain where the source cluster is flagged |
| Peel chains and fragmentation | Splits large sums into many small transfers across many addresses | FBI PSA on the February 2025 exchange theft (funds spread across thousands of addresses) | Many small deposits from new addresses with a common upstream source |
| Swaps into stablecoins or other assets | Changes the asset type, often into a widely accepted stablecoin for cash-out | FATF targeted update, June 2025 | Rapid conversion after receipt; issuer-level freeze may be possible |
| Anonymity-enhanced coins | Moves value onto a ledger that hides amounts or counterparties | FATF red flag indicators (September 2020) | Conversion into or out of privacy coins shortly before deposit |
| Nested services | A smaller provider operates through accounts at a larger VASP, borrowing its liquidity while applying weaker checks | Treasury 2024 National Money Laundering Risk Assessment | One customer account showing many unrelated counterparties and pass-through flows |
| Cash-out through weak-control VASPs, OTC and mules | Converts to fiat where checks are weakest | Treasury 2024 NMLRA; FinCEN action on Bitzlato (January 2023) | Accounts opened shortly before large inbound transfers; immediate fiat withdrawal; mule profiles |
Why mixers attract enforcement
OFAC's Sinbad.io designation describes the service as a key laundering tool of the Lazarus Group and states that it processed funds from several heists; OFAC had designated Blender.io in May 2022 as its first virtual currency mixer designation. FinCEN's October 2023 proposal was its first use of Section 311 to target a class of transactions rather than a named institution, and would require covered institutions to report transactions they know, suspect or have reason to suspect involve international CVC mixing. Treasury's own position on one mixer changed: on 21 March 2025 it removed the sanctions on Tornado Cash, while saying it remained concerned about DPRK hacking and laundering. Compliance teams should therefore track the current status of each designation rather than rely on last year's list.
The cash-out problem for criminals
However long the layering, most criminals need fiat or spendable value eventually. That is why the FBI's February 2025 alert asked exchanges, bridges, RPC node operators, analytics firms and DeFi services to block transactions with or derived from the addresses it published, and why the Treasury assessment stresses VASPs with weak AML/CFT controls and money mule accounts. For the mule side, see the Money Mule Detection Guide.
Why it matters
- Recovery rates are low: Treasury notes that victims of crypto investment scams rarely recover funds because transfers are fast, cross-border and typically irreversible. FATF's 3.8% recovery figure for the largest theft on record makes the same point.
- Legal exposure for intermediaries: a VASP, bank or payment firm that processes proceeds can face sanctions and AML consequences, especially where the counterparty is a designated person. See the Ransomware Payments and Sanctions Guide.
- Incident response depends on it: after a theft or ransomware payment, the first hours decide whether stablecoin issuers, exchanges and law enforcement can freeze anything.
- State-level threat: FATF and Treasury both describe DPRK cyber actors laundering stolen crypto at scale; their proceeds touch ordinary exchanges and DeFi services.
Detection and measurement for defenders
| Control | What to do | Metric |
|---|---|---|
| Deposit and withdrawal screening | Screen every inbound and outbound address against analytics risk categories, sanctions lists and law enforcement address lists | Share of value screened before credit; time from published list to screening rule live |
| Indirect exposure rules | Score funds that reach you a few hops after a mixer, flagged bridge event or theft cluster, not only direct exposure | Alerts by hop distance; false positive rate per rule |
| Behavioural rules | Flag rapid in-and-out flows, new accounts receiving large transfers, conversions into privacy coins or stablecoins just before withdrawal | Median time from alert to hold decision |
| Freeze and report playbook | Pre-agreed contacts for issuers, peer exchanges and law enforcement; suspicious activity reporting | Value frozen versus value identified; reports filed within your regulator's deadline |
For framework mapping, these controls sit under NIST CSF 2.0 DE.CM (continuous monitoring) and DE.AE (adverse event analysis) for detection, RS.CO for coordination with external parties, and ID.RA for the risk assessment that sets which typologies you monitor.
Common misconceptions
- "Crypto is untraceable": most ledgers are public, and law enforcement routinely publishes addresses tied to thefts. The difficulty is speed, cross-chain continuity and the cash-out jurisdiction, not visibility.
- "Only mixers matter": Treasury's 2024 assessment describes chain hopping, unhosted wallets, nested VASPs and mule accounts alongside mixers. A rule set built only on mixer exposure misses most flows.
- "Direct exposure screening is enough": funds rarely arrive one hop from the theft. Indirect exposure and behavioural rules catch more of the layering.
- "A designation list is permanent": the Tornado Cash delisting in March 2025 shows status can change. Keep a dated record of which lists and versions a decision relied on.
- "Decentralised means out of scope": Treasury states that DeFi services engaged in covered activity under the Bank Secrecy Act have AML/CFT obligations even if they claim to be decentralised.
- "Tracing equals recovery": a tracing report is only useful if it reaches an issuer, exchange or court that can act while the funds are still there.
Related concepts
| Concept | How it relates | Where to read more |
|---|---|---|
| Blockchain analytics and clustering | Groups addresses into entities and assigns risk categories used for screening | Blockchain Analytics and On-Chain Monitoring Guide |
| Travel Rule | Originator and beneficiary data for VASP transfers, which helps follow funds between providers | Crypto Travel Rule Compliance Guide |
| Ransomware payments and sanctions | Whether a payment or onward transfer breaches sanctions | Ransomware Payments and Sanctions Guide |
| Money mules | The fiat end of many laundering chains | Money Mule Detection Guide |
| Exchange key and identity security | Preventing the thefts that create the proceeds in the first place | Crypto Exchange Identity and Key Security Guide |
| EU AML framework | AMLR and AMLA obligations for crypto-asset service providers | EU AML Regulation and AMLA Guide |
The identity angle is real: many large thefts begin with compromised signing keys, developer machines or privileged accounts, so stopping laundering starts with protecting the machine identities that control hot wallets and signing services.
Practitioner checklist
- Subscribe to law enforcement and sanctions address publications and measure how fast they reach your screening rules.
- Screen both direct and indirect exposure for mixers, flagged bridges, theft clusters and sanctioned entities on every chain you support.
- Write behavioural rules for rapid pass-through, new accounts with large inbound value and conversion into privacy coins or stablecoins before withdrawal.
- Identify nested services among your customers and apply enhanced due diligence to them.
- Keep a freeze playbook with named contacts at stablecoin issuers, peer exchanges and law enforcement, tested at least yearly.
- Record the list versions and analytics scores behind each hold or release decision, with dates, for auditors and courts.
- After any theft or ransomware payment involving your organisation, report to law enforcement immediately and share addresses with peer providers.
- Review designation status changes, such as the March 2025 Tornado Cash delisting, before updating rules.
Standards and references
- FATF: Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs (2025)
- FATF: Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing
- US Treasury: 2024 National Money Laundering Risk Assessment
- US Treasury: 2023 DeFi Illicit Finance Risk Assessment
- FinCEN: Proposed Section 311 rule on international CVC mixing
- US Treasury OFAC: Sanctions on mixer Sinbad.io
- US Treasury: Tornado Cash delisting statement
- FBI IC3: North Korea responsible for USD 1.5 billion virtual asset theft
Related NHI Mgmt Group resources: AML programme and transaction monitoring · Blockchain Analytics · Crypto Investigator Career Guide · Crypto Crime Statistics Guide