Most criminal money still needs a bank at some point. Crypto shortens how long it needs one. An alert on “pig butchering” from FinCEN, the U.S. Treasury's financial intelligence unit, describes the pattern: a victim cashes out savings, sometimes breaking a certificate of deposit or borrowing against a home, and wires the money to a virtual asset service provider (VASP) such as a crypto exchange [1]. Minutes later the value can sit in a wallet controlled by someone on another continent, ready to be split and moved around the clock, with no correspondent bank asking questions.
That path is the crypto rail: the blockchains, tokens, wallets, and services that carry illicit value out of the regulated financial system at one end and back into it at the other. Its middle is permissionless and opaque. Anyone can create an address, and no one approves a transfer. Its ends are not really the end. Money enters through a victim's bank, an exchange, a kiosk, or a cash business, and leaves the same way. At those ends, stablecoin issuers can freeze tokens (burn tokens), exchanges hold identity records, and regulators can also cut a service off from the dollar system. The edges are where the rail can be stopped, and where most cases are made. That middle part though, that's problematic for investigators. It's also an intentional design for privacy advocates.
The rail also leaves a record sometimes. A public blockchain writes every transfer to a ledger anyone can read, and blockchain tracing has been admitted as evidence in a criminal trial [2]. But a ledger shows addresses and amounts, not people or intent. That attribution is important. To turn it into evidence, an investigator has to keep what the chain shows apart from what an analyst infers, and both apart from what a vendor's label claims [3]. The sections below follow the rail from its parts to its users, then to the edges and the methods that hold up to legal scrutiny.
What the rail is made of
A blockchain is a shared ledger of transactions, secured by cryptographic keys and a consensus process rather than by a single operator [4]. Five distinct things travel on it together, and investigations go wrong when they are confused.
The asset is the unit of value: bitcoin, ether, a stablecoin, or another token.
The network is the ledger where the transfer happens.
The wallet is the software or service that manages signing keys.
The custodian, such as an exchange, may hold the keys while a customer holds only a contractual balance.
The controller is the person or organization directing the money.
One person can fill several of these roles, but an address alone never proves it.
Each network records value differently, and that changes what a trace can show.
| Network | How it records value | What it means for a trace |
|---|---|---|
| Bitcoin | Transactions spend earlier outputs and create new ones; change can return to the sender [5]. | The total going in is not necessarily the amount paid. Treating all inputs as one owner is a heuristic with exceptions [6]. |
| Ethereum and similar | Account balances; tokens move through smart contract calls [7]. | A transaction can show zero ether while moving a large token balance. Read the token events and receipts. |
| Tron | Account-based network widely used for USDT, Tether's dollar stablecoin [8]. | Fast and cheap, which is why it carries so much stablecoin volume. The issuer can still freeze USDT. |
| Bridges | Assets are locked or burned on one chain and released on another [9]. | Links across chains are often inference by amount and time [10]. |
| Monero | Ring signatures and hidden amounts [11]. | On-chain tracing is limited; evidence comes from the edges. |
| Exchanges | Internal ledgers off-chain. | Transfers between customers of one exchange may never appear on-chain. Only exchange records show them. |
Three distinctions hold true on every network. Together these 3 are the “nots of crypto attribution.” An address is not an identity. A transfer is not proof of criminal purpose. And a traced balance is not a recoverable one: it may already be spent, pooled with other people's funds, or out of any court's jurisdictional or logistical reach. Reports that keep these apart hold up under challenge; reports that blur them do not.
The dollar on the rail
Illicit crypto now runs mostly on dollar stablecoins, tokens designed to hold a steady value against the U.S. dollar. Chainalysis found that stablecoins accounted for 84 percent of all illicit crypto-transaction volume in 2025, and said criminals favor them for easy cross-border transfer and low volatility [12]. The Financial Action Task Force (FATF), the global standard-setter against money laundering, drew on the same figure in its March 2026 report on stablecoins and unhosted wallets [13]. Its July 2026 update called for closing regulatory gaps as virtual asset risks grow more complex [14][15].
Coincidentally, the figure 84 percent turns up twice more, measuring different things. Researchers studying pig-butchering networks found that 84 percent of the transaction volume at addresses the criminals touched was in Tether [16][17]. A Senate minority staff review found that 84 percent of the wallets in an Iran-focused sanctions probe traded exclusively or almost exclusively in USDT [18]. The first is a share of all illicit volume, the second a share of one crime type, the third a share of wallets in a sample. They point the same direction, stablecoins are a common method that criminals turn to when they need to exfiltrate funds.
The appeal is practical. As a Georgetown study notes, TRM Labs has reported that a significant share of illicit activity runs through Tether minted on the Tron blockchain, which offers fast confirmation and low fees [8]. Much of the trading happens away from exchanges altogether. The same study quotes a 2021 Circle estimate that over-the-counter (OTC) crypto markets, where brokers arrange trades directly between parties, see two to three times the daily volume of regulated exchanges, often with little or no customer-checking [8]. The Bank for International Settlements judged in 2025 that stablecoins perform poorly against its tests for serving as the mainstay of the monetary system. They fare poorly on singleness (whether every unit is accepted at par) and elasticity (whether supply can expand with demand for payments), and their circulation without issuer oversight raises concerns about use for financial crime [19].
Stablecoins also give the edges their strongest control. Centralized issuers (especially those with proprietary blockchains) can block addresses and freeze tokens. Circle's USDC terms, for example, provide for blocked addresses [20]. Tether froze $225 million in USDT in November 2023 after investigations by Tether, OKX, and the Justice Department [21], and $344 million in April 2026 in coordination with U.S. law enforcement, saying it had by then supported more than 2,300 cases worldwide [22]. The T3 Financial Crime Unit, formed by Tether, Tron, and TRM Labs, reports more than $450 million in frozen assets [23]. Under the GENIUS Act, permitted issuers must now keep the technical ability to freeze and burn tokens and must comply with lawful orders [24][25].
A freeze is a capability, and not a property of every token. It does not reach every asset with a similar name, every wrapped version (a token that stands in for the original on another chain), or every downstream smart contract, and native bitcoin has no issuer that can reverse a payment. An important distinction is that a freeze is not a forfeiture. In June 2025 the Justice Department filed a civil forfeiture complaint against more than $225.3 million in cryptocurrency tied to investment scams, citing over 400 suspected victims and thanking Tether for its help [26]. It is a different action from Tether's November 2023 freeze of $225 million [21]: that freeze followed investigations by Tether, OKX, and the Justice Department, while the 2025 complaint came out of a Secret Service and FBI case filed in Washington, D.C., and the Justice Department's release does not mention the earlier freeze. The gap between an informal freeze and court authority is now in litigation. A suit filed in the Southern District of New York in August 2026 alleges that Tether froze funds on an informal request from Homeland Security Investigations about four months before a seizure warrant issued [27].
Criminal operators have noticed. Huione Group launched its own stablecoin, USDH, marketed on its lack of regulatory oversight and the absence of asset freezing. Tether had frozen one of Huione Pay's accounts in July 2024 [28].
Who uses the rail
Scam compounds and investment fraud
In the FBI's figures, investment fraud is the largest single source of crypto-related losses: Americans reported $7.2 billion in crypto investment-fraud losses in 2025 [32]. Chainalysis estimates that about $17 billion was stolen in crypto scams and fraud in 2025 [37], with impersonation scams up 1,400 percent year on year and the average scam payment rising from $782 to $2,764. Scams with on-chain links to AI vendors took in $3.2 million per operation, against $719,000 for those without [37].
Many of these scams run from compounds in Southeast Asia. In October 2025 the Justice Department indicted Chen Zhi, chairman of Cambodia's Prince Group, for operating forced-labor scam compounds, and filed a civil forfeiture complaint against about 127,271 bitcoin (!), then worth about $15 billion, which it called the largest forfeiture action in its history [38]. Prosecutors described “spraying” and “funneling,” techniques in which large volumes of crypto were repeatedly split across scores of addresses, along with purchases that included yachts, private jets, and a Picasso [38]. The Treasury's Office of Foreign Assets Control (OFAC) designated 146 individuals and entities tied to the group [39]. In January 2026, The Hacker News reported that Chen Zhi had been arrested and extradited to China [40].
The compounds are an industry, not a single group. The UN Office on Drugs and Crime (UNODC) estimates scam losses of $88.3 billion to $114.1 billion across East and Southeast Asia, Australia, and New Zealand in 2025, through all payment channels [33]. Myanmar's junta said it found nearly 2,200 workers and seized 30 Starlink receivers in a raid on the KK Park scam site [41]. The Justice Department's Scam Center Strike Force reports more than $701 million in cryptocurrency identified and restrained [42]. The model predates crypto: OFAC sanctioned the Zhao Wei network in 2018 for drug trafficking, human trafficking, and money laundering run through the Kings Romans Casino in Laos [43].
Kiosks and older victims
Crypto ATMs move cash onto the rail at the victim's end. FinCEN's August 2025 notice said older adults bore over two-thirds of reported kiosk-related losses in 2024, and that the DEA reports drug organizations using kiosks to launder proceeds [44]. The FBI counted $389 million in kiosk losses in 2025 and $4.4 billion in crypto-related losses by people over 60 [32]. AARP reports that adults 60 and older accounted for 76 percent of reported losses where the victim's age was known, and that Indiana became the first state to enact a statewide ban [45].
The District of Columbia has sued the operator Athena Bitcoin, alleging it failed to disclose excessive fees and to protect consumers from scams [46]. Victims are then targeted again: the FBI warns of fraudulent “recovery” services that approach people who have already lost money [47].
North Korea
North Korean hackers are the rail's largest single thief. They stole about $2.02 billion in 2025, 59 percent of all crypto stolen, even as they carried out fewer breaches [34]. The FBI attributed the roughly $1.5 billion Bybit theft of February 2025 to North Korean “TraderTraitor” actors and said the funds were being converted and spread across thousands of addresses on multiple blockchains [48]. Within a week, more than half the stolen ether had moved onto bitcoin, at least $240 million of it through THORChain, a cross-chain swap protocol [49]. About $200 million went through eXch, a swap service German authorities shut down in 2025 [50]. Chainalysis describes a three-wave, 45-day laundering pattern that leans on Chinese-language services and cross-chain bridges [34]. The effort also targets the exchanges from the inside: Binance says North Korean operatives try to get hired there every day, sometimes using AI-generated video on calls [34].
Sanctioned states
Sanctions evasion drove much of 2025's growth [12][29], and Russia is the largest case. After the exchange Garantex was disrupted in March 2025, its business moved to Grinex, and customers regained their balances through A7A5, a ruble-backed token issued by the Kyrgyz firm Old Vector. Treasury sanctioned the network in August 2025 [51]. TRM traces A7A5 to A7, a settlement platform owned by the sanctioned oligarch Ilan Shor and the sanctioned Promsvyazbank, and notes that Kyrgyzstan had issued 126 virtual asset licenses by October 2024 [52]. FinCEN's 1 October 2026 alert on the A7 shadow banking network (FIN-2026-Alert007) reported that more than 180 entities processed at least $179.1 billion in A7A5 transactions between February 2025 and June 2026 [30].
Russia had legalized crypto for international trade in 2024 [53]. A year earlier, Ukrainian authorities shut down a Russia-linked network of underground exchanges that moved rubles out of Russia through crypto [54]. In December 2024 the UK National Crime Agency's Operation Destabilise exposed two Russian-speaking networks, Smart and TGR, that swapped cash for crypto for criminal clients, and OFAC sanctioned their leaders the same day [55][56].
Iran relies on domestic exchanges. Nobitex, its largest, claims more than 7 million users, has been linked to Iran's Islamic Revolutionary Guard Corps (IRGC), and was hacked for over $90 million by a pro-Israel group in June 2025 [57]. Chainalysis says Iranian proxy networks moved over $2 billion on-chain in 2025 [12]. Venezuela has reportedly received oil payments in USDT since 2024 [58].
Cartels and Chinese money laundering networks
Chinese-language money laundering networks now sit in the middle of many flows. FinCEN's 2025 advisory explains the demand: Chinese citizens may convert only about $50,000 a year into foreign currency, so the networks sell them the dollars that drug cartels need to move [59]. Chainalysis estimates the networks processed $16.1 billion in 2025, about $44 million a day across more than 1,799 active wallets, and around 20 percent of illicit crypto funds over five years [31]. They sell specialized services: “running points” that give access to exchange accounts, “motorcades” of money mules for layering, OTC desks, and “Black U” vendors that buy stolen crypto at a discount of 10 to 20 percent [31][60]. In May 2026 prosecutors charged two Chinese nationals with laundering for the Sinaloa Cartel and the Jalisco New Generation Cartel (CJNG) [61]. In June 2026 Wenshen Xu pleaded guilty to drug trafficking, money laundering, and material support to CJNG, a designated terrorist organization [62].
Darknet markets still matter, and they increasingly trade in Monero. Abacus Market generated nearly $100 million in bitcoin sales before a likely exit scam in 2025, in which the operators shut down and kept users' funds; because Monero typically makes up two-thirds to three-quarters of such volume, TRM puts its real sales at $300 million to $400 million [63]. Operation RapTor, announced in May 2025, led to 270 arrests across four continents and seizures that included more than $200 million in currency and digital assets [64].
Ransomware and terrorist finance
Ransom payments cross the same rail. FinCEN's ransomware advisory sets out red flags for institutions that process them [65], and the NCA says Smart's leader, Ekaterina Zhdanova, laundered over $2.3 million in suspected Ryuk ransom payments in 2021 [55]. Terrorist finance appears in these sources at a much smaller scale. In January 2024 Treasury designated Hamas-linked exchanges and facilitators for moving funds, including crypto transfers, from the IRGC-Qods Force to Hamas and Palestinian Islamic Jihad [66]. In September 2026 the Justice Department described a Hamas-linked group chat that pointed donors to a rotating set of crypto addresses, and FBI seizures of about $560,000 [67], a small sum next to the scam and sanctions cases above.
How money moves along it
Figure 2
The crypto rail touches regulated institutions at both ends of the laundering chain
- 1ProceedsFraud, theft, drugs, sanctions tradeControl pointthe victim's bank, through scam interdiction and suspicious activity reports (SARs)
- 2On-rampBank to exchange, kiosk, or cash deskControl pointknow-your-customer (KYC) checks, the Travel Rule (sender and recipient details that must accompany a transfer), kiosk limits
- 3LayeringSplit, swap, bridge, mixControl pointBlockchain analytics, issuer freezes
- 4ConversionInto stablecoins, OTC brokers, guarantee marketsControl pointOFAC, Section 311, platform takedowns
- 5Off-rampExchange, OTC desk, or cash courier to fiatControl pointKYC, 314(b) sharing between institutions, forfeiture
The classic three stages of laundering, placement, layering, and integration, fit crypto cases only loosely. Scam money often enters as crypto because the victim bought it, and a professional network may settle both sides of a trade at once, with nothing that looks like a stage. Four questions work better: where value entered, how it moved, where it changed form, and where it left. The answers usually name a regulated institution at each end.
Chain hopping. Elliptic calls chain hopping, moving funds rapidly from one blockchain to another, the defining laundering method of 2025. It found that cross-chain crime grew from $7 billion to $22 billion in two years, and that 20 percent of complex investigations now span more than ten blockchains [68]. Bridges can be traced, but matching funds across chains by amount and time is inference, and it needs corroboration [10].
Mixers. Mixers pool many users' coins to obscure who paid whom. Samourai Wallet's founders were sentenced in November 2025 to five and four years; prosecutors said its Whirlpool and Ricochet services moved more than $237 million in criminal proceeds [69]. In August 2025 a jury convicted Tornado Cash co-founder Roman Storm of conspiring to operate an unlicensed money transmitting business; prosecutors said the business moved more than $1 billion in criminal proceeds [70]. The jury did not reach verdicts on the laundering and sanctions counts, and the retrial is now set for April 2027 [71].
A jury convicted Roman Sterlingov of laundering conspiracy and running an unlicensed money transmitting business through Bitcoin Fog, a mixer prosecutors said moved about $400 million [2].
Privacy coins. Monero uses ring signatures, which hide the real signer among decoys, and conceals transaction amounts [11]. The EU's new anti-money laundering rules ban anonymous crypto accounts and privacy coins starting in 2027 [72].
Guarantee marketplaces. Telegram-based “guarantee” markets act as escrow for criminal services, holding payment until both sides deliver, as detailed in FinCEN's 3 September 2026 alert on digital asset investment scam centers (FIN-2026-Alert005) [73]. Haowang, formerly Huione Guarantee, shut down in May 2025 after Telegram removed its channels, having processed about $27 billion [74]. Its rival Xinbi reached $17.9 billion in tracked volume by February 2026 [75] and $24.2 billion in TRM Labs' March 2026 profile before OFAC designated it as a transnational criminal organization on 9 September 2026 after more than $24 billion in cumulative volume [76]. Tudou halted Telegram transactions in January 2026 after processing over $12 billion [40]. FinCEN found that Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including $37 million from North Korean heists [77], and on 14 October 2025 issued its final rule severing the group from the U.S. financial system [78]. Reporting by the International Consortium of Investigative Journalists (ICIJ) traced over $408 million in Tether from Huione Group to Binance accounts [79].
Cash desks. ICIJ's Coin Laundry investigation found crypto-to-cash storefronts from Dubai to Toronto. One desk's address received more than $2 million in the two weeks it was active, and its operator said the business changed wallet addresses every 10 to 15 days. Some desks pay customers a premium to take cash, which anti-money laundering experts treat as a red flag [80].
The edges, where the rail can be cut
In the cases cited in this article, each cut came at an edge: an exchange, an issuer, a kiosk operator, a messaging platform, or a bank. Each holds different records and answers to a different kind of legal process. This puzzle has many pieces.
| Edge | What it holds | How it is reached |
|---|---|---|
| Victim's bank | Wires, account history, its own SARs | Legal process; 314(b) sharing between institutions [81] |
| Exchange or custodian | Identity records, logins, deposit addresses, internal transfers | Subpoena or production order; Travel Rule data on transfers [82][83] |
| Stablecoin issuer | Freeze and burn capability, blocked addresses | Request backed by a lawful order [24][20] |
| Kiosk operator | Identity checks, transaction logs | Legal process; state limits and bans [44][45] |
| Messaging platform | Account data, not always message content | Legal process; takedowns [74][84] |
| Analytics vendor | Clusters and labels | Disclosure and validation in court [3] |
The largest penalties have fallen on exchanges. Binance pleaded guilty in November 2023 and agreed to pay more than $4.3 billion across its U.S. settlements. Its plea agreement with the Justice Department requires an independent compliance monitor for three years [85], and FinCEN's consent order imposes a separate five-year monitorship [86]. Even after that plea, pig-butchering researchers found Binance the most popular cash-out venue for the networks they studied, American Banker reported in February 2024 [16]. OKX pleaded guilty to operating an unlicensed money transmitting business and agreed to pay about $504 million [87]. FinCEN fined the peer-to-peer platform Paxful $3.5 million for facilitating suspicious activity [88].
Platforms can be pressured too. Haowang closed within days of Telegram removing its channels [74], and Tudou halted Telegram transactions in 2026 [40]. As sources of evidence, though, platforms have limits. Not every Telegram chat is end-to-end encrypted, but a platform cannot produce what it does not hold, and a channel administrator, an advertiser, and the dealer may be three different people. The NCA treats online platforms as enablers that lower the barriers to offending, not as a substitute for investigating the offense [84].
The strongest regulatory cut is removal from the dollar system. Section 311 findings of “primary money laundering concern,” such as the one against Huione [77][78], bar U.S. correspondent access, the bank accounts through which foreign institutions reach the dollar. The FEND Off Fentanyl Act added a power to designate transactions of sanctioned persons as a primary money laundering concern [89].
From ledger to evidence
Blockchain analysis rests on clustering: grouping addresses that appear to share an owner. The 2013 “Fistful of Bitcoins” study showed that addresses spent together in one transaction can be grouped and linked to services [6], work that later won a test-of-time award [90]. Courts have accepted the method. In United States v. Sterlingov, the court admitted Chainalysis Reactor evidence and related expert testimony; the government cited a cooperating defendant's review of clustered addresses showing 99.9146 percent accuracy [2].
Independent testing is less tidy. The Ghost Clusters study, presented at USENIX Security in 2025, used ground-truth data for three illicit services and found that Chainalysis gives a reliable lower bound. Measured as coverage, it attributed between 24.54 and 94.85 percent of each service's known addresses, with very few false positives (under 0.5 percent) [3]. The two figures measure different things: one is a review of one case's clusters, the other the share of a service's true addresses a tool finds. Both support the same practice. Treat vendor labels as leads to corroborate, and disclose the tool, version, and method.
Most analytical errors come from treating inference as observation. Grouping inputs as one owner fails when several people build a transaction together. Exchange deposit addresses pool many customers. Address-poisoning attacks plant look-alike addresses in a victim's history. Matching across bridges by amount and time can link the wrong transfers [10]. Each conclusion in a report should say which of three things it is: an observation read directly from the ledger, an inference drawn by heuristic, or an attribution to a person or service, with its source.
The evidence package then has to survive the rules. Authentication, business records, certified electronic records, expert testimony, and summaries each have their own route under the Federal Rules of Evidence, and a certified export does not validate every inference drawn from it [91]. Records held by exchanges are generally reachable. In Harper v. Werfel the First Circuit applied the third-party doctrine, finding that a customer has no legitimate expectation of privacy in information handed to an exchange, so an IRS John Doe summons, which seeks records on unnamed account holders, was valid for Coinbase records [92].
The law at the edges
United States
FinCEN treats a business that accepts and transmits convertible virtual currency as a money transmitter. A developer or seller of software may be exempt, unless it also accepts and transmits value as a business [93]. Money transmitters must register [94], and running an unlicensed one is a federal crime [95]. Laundering is charged under 18 U.S.C. § 1956 [96], and § 1957 reaches transactions over $10,000 in criminally derived property [97]. Civil forfeiture lets the government pursue the property itself rather than its owner [98]. OFAC expects virtual currency businesses to run risk-based sanctions programs [99].
Policy has shifted. An April 2025 memo from Deputy Attorney General Todd Blanche, described as “ending regulation by prosecution,” narrowed digital asset enforcement toward people who victimize investors or use digital assets in crimes such as terrorism, narcotics, hacking, and cartel activity. It also flagged that some courts limit victims to the dollar value of their crypto at the time of the fraud, without later appreciation [100]. Treasury lifted the Tornado Cash sanctions in March 2025 after the Van Loon litigation [101][102], yet Storm's conviction followed in August [70]. Delisting a protocol did not remove criminal liability for operating it.
Stablecoins now have their own statute: the GENIUS Act, enacted on 18 July 2025 [25]. In April 2026 FinCEN and OFAC proposed anti-money laundering (AML) and sanctions program rules for permitted issuers [103], and the final rule is due to take effect by 18 January 2027 [104]. The final rule from the Office of the Comptroller of the Currency (OCC), the national bank regulator, takes effect the same day [105]. The broader CLARITY Act on crypto market structure failed a 49 to 50 Senate vote on 15 September 2026 [106].
This is a minefield and anyone who has questions about it should consult an attorney.
United Kingdom
The Proceeds of Crime Act gives prosecutors civil recovery and crypto forfeiture powers alongside confiscation [107], and the Economic Crime and Corporate Transparency Act added cryptoasset confiscation provisions [108]. The Qian case shows the scale. Zhimin Qian was sentenced in November 2025 to 11 years and eight months after pleading guilty to possessing illegally obtained cryptocurrency and laundering it [109], in a case built around the seizure of 61,000 bitcoin [110]. UK crypto firms have had to apply the Travel Rule since 1 September 2023 [82].
European Union and the FATF
The European Banking Authority's (EBA) guidelines on the Travel Rule for crypto transfers apply from 30 December 2024 [83]. The EU's anti-money laundering rules ban anonymous crypto accounts and privacy coins starting in 2027, and the new Anti-Money Laundering Authority (AMLA) begins selecting 40 firms for direct supervision on 1 July 2027 [72].
Globally the gap is enforcement, not law. The FATF's 2026 update found that most jurisdictions now have Travel Rule laws [14][15]. Many have not used them: of 91 jurisdictions with such laws in force, 55, or 60 percent, had not issued a single finding, directive, or enforcement action under them, and only 34 percent were rated largely compliant with the virtual asset standard [111]. The FATF's 2020 red flag indicators remain the common reference for what suspicious crypto activity looks like [112].
Open questions
Freezes without courts. Issuer freezes are fast, and units such as T3 move faster than formal process [23]. The Tether suit over a four-month gap before a warrant tests how far informal requests can go [27].
Privacy and surveillance. Privacy Pools, proposed by Vitalik Buterin and co-authors, would let honest users prove their funds are not from a set of illicit deposits without giving up all privacy [113]. Courts so far have treated exchange records as reachable [92], and the Tornado Cash cases separated questions about code from questions about conduct [101][70].
Vendor reliance. Tracing tools are proprietary, and independent tests show coverage varies by service and over time [3]. Defense challenges will keep coming.
Stablecoins as money. The BIS found that stablecoins perform poorly against its tests for serving as the mainstay of the monetary system [19]. Policy built around them, and around issuers as gatekeepers, assumes they will keep growing.
A working method
Red flags that recur across the sources:
| Signal | Why it matters |
|---|---|
| A customer breaks a CD or takes a home equity loan to buy crypto | Classic sign of investment fraud in progress [1] |
| An older customer makes repeated kiosk deposits on someone's instructions | Kiosk losses fall mostly on older adults [44] |
| Exposure to Huione or Telegram guarantee markets | FinCEN has cut Huione off from the U.S. system [78][77] |
| A cash desk offers a premium for taking cash | The operator has cash to shed outside banks [80] |
| Funds hop chains or bridges right after deposit | Elliptic calls chain hopping the defining laundering method of 2025 [68] |
| Deposits via third-party exchange accounts | Running points rent exchange access to laundering networks [31] |
| Ransom-related payment patterns | FinCEN's ransomware advisory lists them [65] |
| Transaction, anonymity, and profile anomalies | The FATF's virtual asset red flag indicators [112] |
When money is lost, speed matters more than completeness. A practical sequence:
- Have the victim report at once to their bank and to IC3, the FBI's Internet Crime Complaint Center, and warn them about recovery scams [47].
- Capture identifiers: transaction hashes, addresses, network, token contract, timestamps, and amounts. Confirm the token contract is genuine.
- Trace to the first regulated hop, whether an exchange, an issuer, or an OTC desk, and stop there before going wider.
- Send preservation and freeze requests to the exchange and, for stablecoins, the issuer, with lawful process where available [21][23].
- Share with other institutions under Section 314(b) where eligible. The safe harbor is conditional and covers sharing to identify and report possible money laundering or terrorist financing [81].
- Label each finding as observation, inference, or attribution, with the tool and version used [3].
- Request account, login, device, and withdrawal records with the right legal process [92].
- Build the evidence package for the forum: exports, certifications, expert disclosure [91].
- Pursue forfeiture where the funds are still held, and plan for returning money to victims [98][26].
What to watch through 2027
- 18 January 2027. GENIUS Act rules take effect, including the OCC's final rule and the FinCEN and OFAC program requirements for issuers [105][104].
- April 2027. Roman Storm's retrial on the laundering and sanctions counts [71].
- 1 July 2027. AMLA begins selecting firms for direct EU supervision, in the year the privacy-coin and anonymous-account bans arrive [72].
- Pending. The Tether freeze suit in the Southern District of New York [27], and the Senate minority inquiry into USDT and Iran-linked wallets [18].
- Ongoing. Whether guarantee markets such as Xinbi rebuild off Telegram after OFAC's September 2026 designation [75][76], and whether FATF members turn Travel Rule laws into supervision [111].