Money Laundering in Crypto: How Dirty Money Gets Clean
Billions in illicit funds flow through crypto every year. Here's exactly how it works, why it's hard to stop, and why you might be helping without knowing.
Dive Deeper with AI
Click → prompt copied → paste in AI chat
$23.8 billion.
That's how much illicit cryptocurrency was moved in 2022 alone, according to Chainalysis.
Ransomware payments. Drug sales. Fraud proceeds. Stolen funds. Sanctions evasion.
All of it needs to be "cleaned" before criminals can use it.
This is money laundering. And crypto has become very good at it.
The three stages of money laundering
Money laundering isn't complicated. It's the same everywhere:
1. Placement. Get the dirty money into the financial system. In crypto, this is the easy part—just receive crypto to a wallet.
2. Layering. Move the money around to obscure its origin. This is where crypto shines. Hundreds of transactions across dozens of wallets and chains.
3. Integration. Get the clean money back into the real economy. Cash out through exchanges, OTC desks, or spend directly.
Crypto makes step 2 trivially easy. That's the problem.
Why crypto is attractive for laundering
Pseudonymous. No identity required to create wallets or transact.
Borderless. Move millions across countries in minutes. No bank approval needed.
24/7. No banking hours. No holidays. Always open.
Programmable. Smart contracts can automate complex laundering schemes.
Global liquidity. Exchanges everywhere. OTC desks. P2P markets. Many options to cash out.
It's not that crypto was designed for crime. It's that the features that make it useful also make it useful for criminals.
The laundering playbook
Here's how a typical crypto laundering operation works:
Step 1: Receive funds. Ransomware victim pays 50 BTC to attacker's wallet.
Step 2: Split and scatter. Immediately split into 50 wallets of 1 BTC each. Then split again. And again. Hundreds of wallets.
Step 3: Chain hop. Bridge to Ethereum. Bridge to Polygon. Bridge to Avalanche. Bridge back. Each hop obscures the trail.
Step 4: Mix. Send through Tornado Cash or other mixers. Funds come out disconnected from input addresses.
Step 5: Consolidate slowly. Over weeks or months, gather funds into new wallets. Never in amounts that trigger alerts.
Step 6: Cash out. Use exchanges with weak KYC. OTC brokers. P2P platforms. Gift cards. Luxury goods purchases.
By the end, the connection between the ransomware payment and the clean cash is nearly impossible to trace.
The mixing problem
Mixers are the key tool.
They work by pooling funds from many users, then redistributing them. You put in 1 ETH, you get out 1 ETH (minus fee), but it's not the same 1 ETH.
The link between input and output is broken.
Tornado Cash was the biggest. $7+ billion mixed before OFAC sanctions.
Other mixers:
- Wasabi Wallet (Bitcoin CoinJoin)
- JoinMarket (Bitcoin)
- Various smaller services
Mixers aren't inherently illegal. They're privacy tools. But when 30%+ of funds flowing through are illicit, regulators notice.
Chain hopping and bridges
Bridges are laundering superhighways.
Move BTC to Ethereum. Ethereum to BSC. BSC to Arbitrum. Back to Bitcoin through another bridge.
Each hop:
- Different blockchain with different analytics
- Different jurisdictions
- Different compliance standards
- Makes tracing exponentially harder
The Ronin hack ($625M): Funds went through Tornado Cash, then across multiple bridges, then to various exchanges. Took months to trace partially.
Bridges don't verify where funds came from. They just move value. That's the feature. And the bug.
The exchange problem
Eventually, launderers need to convert to fiat.
Regulated exchanges (Coinbase, Kraken): Strong KYC. Report suspicious activity. Hard to use for large laundering.
Offshore exchanges: Weaker KYC. Some look the other way. Popular with launderers.
OTC desks: Private trades. Less oversight. Can move millions quietly.
P2P platforms: Direct trades with individuals. Hard to monitor.
Nested services: Operate accounts at legitimate exchanges. Hide behind their compliance.
The weakest link is usually the cash-out point. That's where most arrests happen.
Real numbers
Chainalysis 2023 report:
- $23.8 billion in illicit crypto transactions (2022)
- 0.24% of total transaction volume
- Stolen funds: $3.8 billion
- Ransomware: $457 million
- Scams: $5.9 billion
- Darknet markets: $1.5 billion
Small percentage, huge absolute numbers.
And these are just what's detected. Real numbers are higher.
Why you might be involved
Here's the uncomfortable part.
When you:
- Use a DEX that doesn't check source of funds
- Provide liquidity to pools used by launderers
- Trade with counterparties you don't know
- Use mixing services for "privacy"
You might be facilitating money laundering.
Probably not intentionally. Probably not legally liable (depends on jurisdiction). But you're part of the infrastructure that makes it work.
The permissionless nature of DeFi means everyone's in the same pool. Including criminals.
The regulatory response
Governments are fighting back:
OFAC sanctions. Tornado Cash addresses blacklisted. Using them is illegal for US persons.
Travel Rule. Exchanges must share sender/recipient info for transfers over $3,000.
Exchange crackdowns. Binance settlements. FTX prosecution. Increased scrutiny.
Chain analysis contracts. FBI, IRS, and others pay millions for blockchain tracing.
Criminal prosecutions. Tornado Cash developers arrested. Mixer operators charged.
The noose is tightening. But it's a cat and mouse game.
Why it's hard to stop
Decentralization. No one to subpoena for mixer code on-chain.
Global nature. US sanctions mean nothing in North Korea.
Privacy tech improves. New mixing methods. Better anonymity chains.
Economic incentives. Billions to be made. People will find ways.
Whack-a-mole. Shut down one mixer, three more appear.
You can make laundering harder. You probably can't make it impossible. Not without killing the things that make crypto useful.
The honest reality
Crypto has a money laundering problem. It's real.
Most crypto users are legitimate. The vast majority of transaction volume is legal.
But the infrastructure that enables freedom also enables crime. They're the same infrastructure.
You can:
- Build surveillance into the protocol (kills privacy for everyone)
- Accept that some crime will happen (current state)
- Try to find middle ground (ongoing debate)
There's no easy answer.
What's clear: pretending the problem doesn't exist isn't working. Neither is pretending it can be easily solved.
What you should know
-
Using mixers has legal risk. Especially post-Tornado sanctions.
-
KYC exists for reasons. Annoying, but part of why exchanges aren't shut down.
-
Chain analysis is real. Your transactions can be traced. Pseudonymous ≠ anonymous.
-
You might interact with dirty funds. In DeFi, you don't know your counterparty.
-
Regulations are coming. The current Wild West era won't last.
The crypto dream of financial freedom includes freedom for everyone. Including people you'd rather not be free.
That's the tradeoff. Understand it.
Next: Tornado Cash - the mixer that changed everything.