Money laundering

Table of contents

What is money laundering?

Money laundering is the process of making illegally obtained funds appear to have come from legitimate sources — typically by moving money through a sequence of transactions that obscure its criminal origin.

Cryptocurrency has become a preferred vehicle for money laundering because blockchain transactions are pseudonymous (not anonymous), borderless, and can be processed without a central intermediary. These same properties also create a permanent, auditable record — which is why blockchain intelligence has become the primary tool for law enforcement and compliance teams tracking illicit flows.

According to data from TRM's 2026 Crypto Crime Report, in 2025, over USD 60 billion of value left illicit wallets and landed at different services.

What does money laundering mean?

Money laundering means making money that came from illegal activity — drug trafficking, fraud, ransomware, theft — look like it came from a legitimate source. The "laundering" metaphor describes what the process does: it takes dirty money and washes it clean by running it through transactions that obscure its criminal origin.

In its simplest form, money laundering works in three steps: first, the criminal moves illicit funds into the financial system (placement); second, they layer transactions to break the link between the funds and the crime (layering); third, they extract the funds as apparently legitimate income (integration). In cryptocurrency, each of these steps has new tools — and each leaves a traceable record on-chain.

‍

What are the stages of crypto-enabled money laundering?

Money laundering in cryptocurrency often follows the traditional three-stage process:

‍

Stage	What happens	Crypto-specific methods	AML detection signals
1. Placement	Illicit funds first enter the financial system — in crypto, this means converting cash or crime proceeds into digital assets	Peer-to-peer (P2P) exchanges, Bitcoin ATMs (BTMs), unhosted wallets, crypto purchases via cash	Large cash purchases at BTMs; P2P trades with no verified counterparty; sudden large deposits to unhosted wallets from unknown sources
2. Layering	Funds are moved through complex transactions to break the chain between the criminal source and the eventual destination	Mixers and tumblers, chain-hopping across blockchains, conversion to privacy coins (Monero, Zcash), DeFi protocol cycling, cross-exchange transfers	Mixer/tumbler address interactions; rapid multi-chain movements; Monero conversion events; structuring (many small transactions below reporting thresholds)
3. Integration	"Cleaned" funds re-enter the legitimate economy, appearing to come from legal sources	Converting crypto back to fiat at compliant exchanges, purchasing high-value goods (real estate, art, luxury items) with crypto, creating fake business revenue streams	Sudden large withdrawals to bank accounts after complex on-chain history; high-value asset purchases by wallets with suspicious transaction history

‍

How blockchain analytics detects crypto money laundering

Unlike traditional financial crime, cryptocurrency money laundering leaves a permanent on-chain record. Every transaction is written to a public ledger and cannot be deleted — which means even sophisticated laundering schemes can be reconstructed through blockchain analytics.

TRM Labs' blockchain intelligence platform identifies money laundering using three core techniques:

1. Transaction graph analysis

‍Every wallet address and transaction is mapped as a node in a graph. When funds move through a mixer, cross multiple chains, or appear in dozens of intermediate wallets, the full transaction path remains visible. Investigators trace the funds from origin to destination even across hundreds of hops.

2. Cluster attribution

‍Wallets controlled by the same entity often co-spend funds in ways that reveal ownership. By identifying clusters of wallets that behave as a single actor, TRM Labs can link a pseudonymous wallet to a known exchange, sanctioned entity, or criminal marketplace — even when no KYC data exists at the wallet level.

3. Risk scoring

‍Each address and transaction is scored based on its exposure to high-risk counterparties: darknet markets, sanctioned entities, mixers, ransomware actors, and fraud schemes. Compliance teams use these scores to automatically flag transactions that require enhanced due diligence before processing.

‍

What are some common methods used to launder money with cryptocurrency?

Several strategies are commonly used for laundering money with cryptocurrency:

‍

Method	How it works	Detection difficulty	Key AML red flags
Darknet marketplace (DNM) transactions	Illicit goods sold for crypto on DNMs; proceeds moved through exchanges or mixers to clean the trail	High	Wallet addresses linked to known DNM clusters; unusual peer-to-peer volumes
Mixer / tumbler services	Transaction mixing pools multiple users' crypto together, obscuring the link between input and output wallets	Very high	Use of known mixer addresses (e.g. Tornado Cash); large equal-output transactions
Chain-hopping	Converting funds across multiple blockchains (e.g. Bitcoin → Monero → Ethereum) to fragment the audit trail	High	Rapid cross-chain swaps with no apparent commercial purpose
Privacy coins	Cryptocurrencies like Monero (XMR) and Zcash (ZEC) use cryptographic techniques to hide sender, receiver, and amount	Very high	Conversion to Monero at any point in a transaction chain
Fake ICOs / token issuance	Fraudulent token offerings raise funds from unsuspecting investors; proceeds treated as "investment income"	Medium	No product development activity; tokens with no exchange liquidity after raise
NFT wash trading	NFTs sold at inflated prices between controlled wallets to manufacture artificial transaction history	Medium	Same wallet clusters appearing as both buyer and seller; outlier sale prices vs. comparable NFTs
DeFi protocol layering	Funds cycled through DeFi protocols (liquidity pools, flash loans) across multiple smart contracts to obscure origin	Very high	Rapid multi-protocol interactions; funds entering / exiting protocols with no apparent yield strategy

‍

What is the role of law enforcement in combating crypto-enabled money laundering?

Law enforcement agencies are at the forefront of addressing crypto-enabled money laundering. Their efforts include:

Using blockchain intelligence tools: Blockchain intelligence tools like TRM Labs are used to trace cryptocurrency transactions. While blockchain is pseudonymous, patterns and wallet addresses can sometimes be linked to real-world identities.
Collaborative investigations: Agencies like the FBI, Europol, and Interpol often collaborate on cross-border investigations, given the global nature of cryptocurrencies.
Seizure and recovery: Authorities have successfully seized billions of dollars in illicit cryptocurrency, demonstrating their ability to combat these crimes.

‍

What is the role of crypto businesses in combating crypto-enabled money laundering?

Crypto businesses are the front line of AML compliance. Under FATF's Travel Rule and most national AML frameworks, virtual asset service providers (VASPs) must implement Know Your Customer (KYC) identity verification before onboarding users, screen transactions against sanctions lists and risk typologies in real time, file Suspicious Activity Reports (SARs) with financial regulators, and share transaction originator/beneficiary data with counterparty VASPs on transfers above threshold amounts.

TRM Labs provides the blockchain intelligence infrastructure many VASPs rely on to fulfill these obligations — including real-time transaction monitoring, wallet risk scoring, and cross-chain entity attribution.

‍

What is the role of regulators in combating crypto-enabled money laundering?

Regulatory bodies establish frameworks to reduce the risk of crypto-enabled money laundering. Key measures include:

Anti-money laundering (AML) laws: These laws require financial institutions, including crypto businesses, to implement measures that prevent and report laundering activities.
Licensing and oversight: Governments mandate licensing for cryptocurrency exchanges and enforce compliance with financial regulations.
International standards: Organizations like the Financial Action Task Force (FATF) set global standards for combating money laundering, including guidelines for cryptocurrencies.

‍

What are some of the key challenges in combating crypto-enabled money laundering?

Despite law enforcement, compliance, and regulatory teams making great strides against crypto-enabled money laundering, several key challenges still remain, including:

Anonymity tools: Technologies like mixers and privacy coins make tracking transactions more difficult⁠.
Decentralized nature: The lack of centralized control in blockchain networks limits oversight capabilities⁠.
Cross-border complexity: The global nature of cryptocurrency requires unprecedented levels of international cooperation, complicating jurisdictional enforcement⁠.
Resource constraints: Law enforcement agencies sometimes lack sufficient personnel with the technical expertise and tools needed to investigate cases effectively⁠ — making it increasingly important for agencies to invest in tools and training for crypto investigation teams.
Evolving tactics: Criminals are continuously developing new methods to obscure fund movements, particularly through DeFi and other emerging technologies⁠.
Multi-chain complexity: Money laundering operations often span multiple blockchains, making investigations more complex and requiring sophisticated tracing tools⁠.

These challenges are particularly significant as illicit actors expand beyond traditional crypto crimes into more sophisticated schemes including market manipulation, proliferation financing, and terrorist financing⁠.

‍

What are some recent high-profile anti-money laundering wins by law enforcement agencies and crypto businesses?

On August 1, 2024, IRS-Criminal Investigation, the US Department of Justice, and the Federal Bureau of Investigation — in coordination with the German Federal Criminal Police Office (BKA) and the Attorney General’s Office in Frankfurt — seized the domain for online crypto wallet Cryptonator for failing to have appropriate anti-money laundering controls in place and facilitating illicit activity.
The DOJ and FBI Phoenix seized USD 112 million linked to "pig butchering" and other crypto-related investment scams, successfully tracing and seizing proceeds at exchanges.
In Argentina, the Specialized Fiscal Unit in Cybercrime Investigations (UFEIC) successfully dismantled the C14 criminal group, identifying and seizing crypto assets in what was a landmark achievement for Argentine law enforcement.

‍

Key terms in crypto AML

‍Anti-money laundering (AML): The regulatory and compliance framework requiring financial institutions and VASPs to detect, prevent, and report money laundering activity. Core components include KYC, transaction monitoring, and suspicious activity reporting.‍
Know Your Customer (KYC): The identity verification process VASPs must complete before onboarding users — including collecting government ID, verifying address, and screening against sanctions lists.‍
Virtual asset service provider (VASP): Any business that exchanges, transfers, or safeguards cryptocurrency on behalf of customers. Under FATF standards, VASPs carry the same AML obligations as traditional financial institutions.‍
Travel Rule: A FATF requirement that VASPs share originator and beneficiary information on transactions above a threshold (typically USD 1,000 equivalent as global baseline) — the crypto equivalent of correspondent banking wire disclosures.‍
Suspicious Activity Report (SAR): A required report filed by financial institutions and VASPs with regulators when a transaction shows signs of potential money laundering or other financial crime.‍
Blockchain analytics: The practice of using transaction graph analysis, cluster attribution, and risk scoring to trace cryptocurrency flows and identify illicit activity. TRM Labs is a leading provider of blockchain analytics for compliance and law enforcement.