Crypto Laundering Networks
The theft is the easy part. This is the industry that turns stolen coins into spendable money.
Stealing crypto is a technical problem solved in one transaction. Spending it is a logistics problem that employs thousands of people — mules, brokers, shell companies, compliant-looking exchanges and a great deal of patience.
These investigations follow the money after the headline: how proceeds are layered, who moves them, which jurisdictions absorb them, and why victim funds so often surface in accounts belonging to other victims.
Documented cases in detail
The compliance variant is documented in our investigation into the Kraken dust attack that turned sanctioned micro-transfers into account locks — with the attribution limits kept attached.
The in-person version plays out exactly as described in the Dubai USDT cash swap scam, where the car leaves with the money and the stablecoins never move.
When the paperwork does the lying, the pattern matches the SEPA mandate scam that turns a forged bank authorisation into a crypto payout long before anyone checks the signature.
How it works
Sanctions screening abuse — a related vector
The Kraken case is compliance dusting, not proof of laundering by a recipient: unwanted transfers from an attributed sanctioned source can trigger account review. Receipt alone does not establish consent.
Placement
Proceeds are split across fresh addresses and mule accounts, often recruited with fake job offers.
Layering
Mixers, cross-chain swaps, privacy coins and thousands of hops designed to exhaust an analyst's budget rather than defeat the maths.
Integration
Cash-out through complicit OTC brokers, cash pickup networks or businesses that need volume more than they need answers.
Investigations in this vector
Kraken Dust Attack: 12,000 Transfers, One Compliance Trap
Kraken received nearly 12,000 transfers Arkham linked to HTX. How sanctioned dust triggered account locks and what the evidence proves.
Read the investigationLazarus $1.5B: How DPRK Laundered a Billion in 47 Chains
How DPRK-aligned actors laundered $1.5B in 9 days across 47+ blockchains. Technical autopsy of the 5-stage state-grade pipeline.
Read the investigationPig Butchering Pipeline: SE Asia's Crypto Fraud Factories
100,000+ trafficking victims forced to run crypto scams in fenced compounds. $5.5B stolen in 2025. A dating app laundered $5.5M via NFTs.
Read the investigation$16B Laundered: Inside the Chinese Crypto Laundering Machine
Chinese networks laundered $16.1B in crypto in 2025. Huione Group, Macao casino pipelines, Telegram guarantee services, and scam compounds exposed.
Read the investigationRed flags
- A remote 'payment processing' or 'financial agent' job that uses your personal bank account or wallet.
- Someone offers a fee to receive and forward funds you have no business receiving.
- A relationship built over weeks that arrives at an investment platform you had never heard of.
- Withdrawals from that platform require a tax, a fee or a topped-up balance.
- The counterparty is fine paying above market to move funds quickly and quietly.
If it already happened
- 1.Stop all transfers immediately — continuing makes you a participant, not just a victim.
- 2.Preserve every transaction record before deleting an app or account.
- 3.Report to your bank and to the receiving exchange; both can freeze faster than law enforcement.
- 4.Get legal advice if your account was used to forward funds; that exposure is real and time-sensitive.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.