Money Laundering in Crypto: How Criminals Hide Their Tracks

Following a crypto crime, criminals must launder illicit funds to convert them into usable money.

First, the type of initial coin influences their laundering strategy. Then, they layer the illicit funds using multi-wallet transfers, peel chains, coin mixers, chain hopping, and other techniques. Finally, they cash out through an exit node like a crypto ATM or a non-compliant exchange.

This article explores the methods criminals use to launder crypto. It also highlights strategies to combat crypto laundering and secure the blockchain ecosystem.

Stage One: How the Initial Crime Shapes Crypto Laundering

Money laundering is often described in monolithic terms, but its execution varies widely. The type of coin a criminal or criminal organization steals significantly influences their subsequent laundering strategy.

Two key considerations that shape how criminals launder their funds are:

• Blockchain transparency - Widely used and transparent blockchains, such as Bitcoin and Ethereum, are frequent targets for hacks and other crimes. After obtaining them, however, criminals may then use chain hopping to move funds to more privacy-centric chains or use mixers to obscure their trail. 
• Token liquidity - Tokens with a low trading cap, such as meme coins, are also frequently targeted in crimes like rug pulls. After obtaining these tokens, criminals may prefer to swap them for tokens with higher liquidity. That way, they can more quickly launder the funds.

Criminals may also consider other factors, such as blockchain speed, transaction costs, and token volatility, when deciding how to handle stolen coins.

Stage Two: Evasion and Obfuscation Techniques in Crypto Laundering

A foundational principle of money laundering is layering—creating a complex web of transactions to make it harder to trace illicit funds.

Rather than relying on a single technique, crypto criminals now use a combination of tools and methods for layering, evasion, and obfuscation, such as:

• Chain hopping - Blockchains once operated as isolated systems. To convert one currency to another (e.g., Bitcoin to an altcoin), users had to convert BTC to cash first.  Today, thanks to cross-chain bridges and wrapped tokens, major blockchains now have interoperability. While this development is convenient for consumers, it has also been a boon for criminals, who can hop from one chain to another to obfuscate their laundering. Investigators now need to track multiple public ledgers, often requiring blockchain analytics tools to graph cross-chain movements.
• Coin mixers - Also known as tumblers, coin mixers pool funds from multiple users and redistribute an equal amount to each participant. The redistributed funds are not linked to the original deposits, making it difficult to trace the source. While authorities have been aggressively shutting down, black-listing, and criminalizing coin mixers, such as ChipMixer, in March 2023, many persist on the dark web or other channels. 
• Multi-wallet transfer and peel chains - In multi-wallet transfers, stolen crypto is distributed among various wallets without a change in ownership, complicating the trail. 
  
  A peel chain is a more specific type of multi-wallet transfer. In a peel chain, the criminals will break down the funds into increasingly smaller amounts by sending them to different wallets across more and more transactions. Criminals may later consolidate the funds into a single wallet or a few wallets, or keep them distributed as a risk management measure.
  
  
• Coin swaps - Coin swapping involves converting one coin to another, usually on the same blockchain. In the context of money laundering, however, coin swaps typically refer to swap protocols in DeFi. Consisting of smart contracts, liquidity pools, and automated market makers, swap protocols simplify the process of changing currencies. Criminals don't need to use any intermediary, such as an exchange, so their anonymity is preserved. They may use coin swaps as a general form of layering or to serve a specific function, such as converting Ethereum into a more privacy-centric coin. 

Stage Three: How Criminals Cash Out Laundered Crypto

The final step in money laundering is escaping with the illicit funds through an exit node. Common methods include:

• Darknet marketplace - The first large-scale darknet marketplace was Silk Road, which was shut down by the FBI in 2013 but copycats have since proliferated. Using a browser like Tor, consumers can go on these darknet marketplaces to shop for illegal goods, such as drugs and weapons, and even services, such as murder-for-hire. Darknet marketplaces are a convenient exit node for illicit funds because criminals can buy and resell goods, generating funds unrelated to their original crime. Depending on their jurisdiction, the items may not even be illegal, such as stolen luxury goods, gift cards, or electronics, making resale easier.  In some cases, criminals make fake transactions to simulate a legitimate exchange of funds.
• Non-compliant exchanges - Although exchanges may be centralized, they may not necessarily follow rigorous KYC procedures. They can be headquartered in rogue nations like Russia or Syria, where crypto regulations are weak or non-existent. They can overlook customers with questionable KYC information, such as clearly falsified ones, or even actively welcome this business. Criminals may represent a lucrative segment, given they have few options to work with. Surprisingly, non-compliant exchanges may even exist in countries with robust KYC mechanisms. For example, in October 2023, the Department of Justice and Commodity Futures Trading Commission (CFTC) accused Binance of willfully overlooking funds from the terrorist group Hamas, even though its compliance chief allegedly knew of the laundering as early as 2019. 
• Crypto ATMs - A crypto ATM is not like a regular ATM. With a normal ATM, people need a bank card, which they must obtain by opening a bank account associated with their real-world identity through proper documentation. Crypto ATMs generally enable anonymity—users can often get cash by scanning a QR code and sending crypto to the provider's wallet. Crypto wallets are usually unregulated or poorly regulated, but, even in markets with some regulations, such as those that may require a credit card to use a Bitcoin ATM, criminals can skirt around thresholds by breaking down a large transaction into multiple, smaller ones, a practice known as “smurfing”. Given their relative speed, crypto ATMs are a frequently preferred exit node for criminals. 
• Non-custodial wallets - As digital assets become popular, most consumers will generally use custodial wallets. A custodial wallet is one where the exchange or provider holds the consumer's private and public keys. Custodial wallets lower the barrier of technical expertise necessary to participate in crypto. Criminals generally prefer non-custodial wallets as part of their exit node. These are wallets where they hold the private keys, which they open through a wallet provider. Non-custodial wallets are ideal for criminals because they do not usually have KYC or AML procedures and are not associated with a centralized authority that can assist with enforcement action, such as freezing funds. Given the ease of opening a non-custodial wallet, criminals may also open multiple wallets to layer their transactions. 

The Role of Blockchain Analytics in Stopping Crypto Laundering

While crypto laundering has become more complex, tracking these activities doesn’t have to be. Law enforcement agencies and crypto businesses can rely on a blockchain analytics tool like Merkle Science's Tracker.

With Tracker, investigators can visualize the movement of illicit funds, identify their destinations, and take action. Law enforcement can seize assets and prosecute criminals, while businesses can maintain compliance with AML and CFT regulations to safeguard clients and users.

Stay one step ahead of crypto laundering schemes. Explore how blockchain analytics tools like Merkle Science's Tracker can help protect your business, ensure compliance, and support law enforcement in combating financial crime. Contact us today to learn more or request a demo.