The Evolution and Stages of Cryptocurrency Money Laundering
Converting illegally obtained cryptocurrencies, such as Bitcoin, into fiat currency is a critical step for criminals to complete their illicit chain. This process, commonly known as money laundering, can be divided into three main stages: "placement," where illicit funds are introduced into the financial system; "layering," which involves a series of complex transactions to obscure the origin of the funds; and "integration," where the laundered funds are reintroduced into legitimate economic activities. As the cryptocurrency market evolves and regulation becomes more sophisticated, criminals' money laundering strategies are also continuously adapting.
In the past, directly transferring illicit funds to centralized exchanges for cash-out was a common practice. However, as of 2025, this simple model has largely become ineffective. Research shows that 99% of hacking incidents employ multi-stage, fragmented money laundering methods, using exchanges as one cash-out point rather than the sole exit. This evolution makes fund tracing significantly more difficult.
Researchers have described a typical "45-day money laundering playbook," revealing the complexity of fund flows:
- Days 0-5: Stolen tokens are quickly exchanged for other tokens via decentralized finance (DeFi) protocols and pushed into mixing services (such as Tornado Cash) to sever the link between the source and destination of funds.
- Days 6-10: Funds undergo "chain hopping" between different blockchains via cross-chain bridges, then flow through exchanges with limited Know Your Customer (KYC) checks.
- Days 20-45: Funds are cashed out in small batches (typically under $500,000) through no-KYC platforms, instant exchange services, and over-the-counter (OTC) networks, ultimately converting into fiat currency.
Key Money Laundering Tools and Methods
Cross-Chain Bridges and Chain Hopping
As of 2026, cross-chain bridges have replaced cryptocurrency mixers as the primary money laundering tool. Criminals use cross-chain bridges to transfer funds from one blockchain to another. This "chain hopping" behavior aims to obfuscate transaction tracing, making it difficult for law enforcement agencies to trace the original source of funds.
Mixers and Stripping Chains
Despite the rise of cross-chain bridges, mixers are still widely used. For example, Tornado Cash was still used in 41.57% of hacking-related money laundering activities in 2025. Mixers work by pooling large amounts of users' funds together and then randomly distributing them to different receiving addresses, thereby breaking on-chain links to funds. Additionally, "stripping chains" is a common layering technique that breaks funds into increasingly smaller amounts, sending them through hundreds or even thousands of transactions to new wallet addresses to conceal the source of funds and reduce the risk of triggering alerts. Historically, large mixing services like Cryptomixer and ChipMixer have been successfully shut down by law enforcement, with significant amounts of Bitcoin seized.
DeFi Platforms and No/Weak KYC Channels
Decentralized finance (DeFi) platforms are attractive targets for money laundering due to their lack of centralized regulation and relative anonymity. Criminals leverage DeFi protocols for rapid exchanges and liquidity provision, further blurring fund pathways. In the cash-out phase, no/weak KYC exchanges, peer-to-peer (P2P) platforms, and Chinese OTC networks are preferred. These platforms have lower user identity verification requirements, allowing criminals to convert cryptocurrencies into fiat in small, fragmented amounts.
Bitcoin ATMs and Professional Services
Bitcoin ATMs have also been exploited by criminals. Through "Smurfing" techniques, they divide funds into small amounts (typically under 1000 Euros) to circumvent ATM identity verification procedures. Furthermore, some criminals obtain professional cryptocurrency cash-out services through darknet markets (such as Hydra, once the largest darknet market) or directly outsource money laundering operations to professional money laundering operators to leverage their experience and resources.
Virtual Debit Cards and Payment Services
To further circumvent KYC verification, some services allow cryptocurrencies to be transferred to virtual debit cards, and even linked to mainstream payment systems like Apple Pay or Google Pay, enabling indirect spending of cryptocurrencies.
Challenges for Law Enforcement and Regulation
The scale of cryptocurrency money laundering is vast and growing. In 2025, an estimated $158 billion in illicit funds were laundered globally through cryptocurrencies, more than triple the amount in 2024. Faced with increasingly sophisticated money laundering strategies, global law enforcement agencies (such as Europol, the U.S. Department of Justice DOJ, the Federal Bureau of Investigation FBI, and the U.S. Internal Revenue Service IRS) are continuously tracking and combating cryptocurrency money laundering activities, closing mixing services and darknet markets through international cooperation. However, despite the transparency of blockchain, tracing laundered funds remains extremely challenging.
Cybersecurity and blockchain analytics firms (such as Elliptic, Chainalysis, Global Ledger, Merkle Science) provide specialized tools and knowledge to help law enforcement agencies and exchanges identify criminal activities. They note that money laundering strategies are becoming increasingly complex, while control measures often lag behind the threats. Cryptocurrency exchanges face strict Anti-Money Laundering (AML) and Know Your Customer (KYC) regulatory requirements, and non-compliance can result in substantial fines. Regulators are also continuously strengthening oversight of the cryptocurrency industry, developing stricter AML/CTF policies to address this evolving threat.
