July 2026 | Issue 74

Cryptocurrency Money Laundering

Introduction

Cryptocurrency money laundering continues to evolve as criminals leverage technologies, stablecoins, non-fungible tokens (NFTs), gaming ecosystems, and anonymity-enhancing services to conceal illicit financial activity. While these approaches offer insight through the lens of unlawful, sophisticated money laundering methods can complicate tracing efforts and reduce visibility for financial institutions and diligent consumers curious of the origins of their cryptocurrency.

Financial institutions, compliance teams/investigators, and individual investors understand the risk that the cryptocurrency landscape offers. The use of cryptocurrency presents challenges such as identifying suspicious activity, strengthening anti-money laundering (AML) controls, and adhering to evolving regulatory standards.

Use of Mixers and Tumblers

Cryptocurrency mixers, also known as tumblers, are services designed to complicate the source and destination of digital asset transactions. These services combine cryptocurrency from numerous users and reallocate the funds through intricate transaction pathways, making blockchain tracing significantly more difficult.

Criminal organizations often use mixers after theft or fraud through ransomware attacks, fraud schemes, or cybercrime, where the proceeds of these crimes are received in cryptocurrency.  They are further used for other illegal activity such as darknet marketplaces or sanctions evasion where cryptocurrency is utilized to disguise the identity of those involved in the unlawful activity. Certain techniques include layering transactions, chain hopping, the use of Decentralized Exchanges (DEXs), peel chains, and privacy coin conversions.

Mixers reduce clarity and create challenges for transaction monitoring systems, beneficial ownership identification, sanctions screening, Suspicious Activity Report (SAR) investigations, and blockchain forensic tracing. Financial institutions should pay particular attention to transactions involving wallets previously associated with sanctioned mixer services or high-risk jurisdictions.  This additional level of examination of the suspect wallets for other indices of fraud, beyond the mere use of a mixer, is important for compliance leaders following the recent U.S. Department of Treasury’s report to Congress in 2026, formally acknowledging that mixers can serve a legitimate purpose. This report from Treasury identifies legitimate uses to include:

While mixers may have some potential legitimate uses, regulation to minimize abuse has not yet been established, and the mixer use must still be eyed with a good amount of suspicion.  Currently, “hold laws” are being proposed to temporarily freeze suspicious assets rather than banning the technology outright which may help find a temporary compromise allowing compliance professionals and investigators the ability to stop rapid fund movement for investigative purposes.

Stablecoin Adaptation and Vulnerabilities in Cross-Border Transfers

Stablecoins are digital assets pegged to fiat currencies such as the U.S. dollar. Their speed, liquidity, and low transaction costs make them attractive for legitimate cross-border commerce – but also vulnerable to misuse by illicit actors.

Why Criminals Prefer Stablecoins

Stablecoins provide near-instant international settlement. This allows for reduced volatility compared to traditional cryptocurrencies, better accessibility through decentralized platforms, lower transaction fees than conventional wire transfers, and increased liquidity across exchanges and blockchain networks. These characteristics enable criminal networks to move value across jurisdictions quickly while minimizing scrutiny.

Cross-Border Vulnerabilities

Illicit actors may exploit stablecoins through cross-border vulnerabilities. These can include transfers involving irregulated foreign exchanges or using wallets tied to shell companies. Criminals could also exploit decentralized finance (DeFi) protocols lacking strong AML controls. An example of this happening was the Arcadia Finance incident. In July 2023, an attacker targeted a vulnerability in the smart contracts of Arcadia Finance, siphoning approximately $455,000 worth of stablecoins. The hacker swapped 75% of the stolen assets into Ethereum and immediately funneled the funds to Tornado Cash, a decentralized, non-custodial cryptocurrency mixer on Ethereum blockchain, to break the audit trail. The rapid movement of funds through multiple blockchain systems could also raise some concerns regarding misuse of stablecoins. Institutions operating internationally should monitor unusually rapid stablecoin transfers involving high-risk geographies or inconsistent customer profiles.

Risks in Non-Fungible Token (NFT) as Money Laundering Vehicles

NFTs have emerged as another potential mechanism for money laundering illicit proceeds. NFTs are unique blockchain-based digital assets that can represent art, collectibles, virtual property, or other items. Criminal actors may exploit NFTs through buying and selling NFTs between accounts controlled by the same individual to artificially inflate value. Overvaluation is the purchasing of low-value NFTs at inflated prices to disguise illicit transfers. Using platforms with weak identity verification requirements and moving NFTs across multiple wallets and marketplaces before liquidation are additional ways criminals can exploit NFTs.

Financial institutions should be alert to large NFT purchases inconsistent with customer profiles, rapid resale activity with dramatic price fluctuations, transactions involving newly created wallets, repeated transfers between related accounts, and use of privacy-enhancing technologies alongside NFT purchases.

Gaming Tokens and Virtual Economies

The online gaming world includes tradable virtual currencies and digital assets. Criminal organizations may exploit these environments because transactions often occur outside traditional banking oversight. Purchasing gaming tokens with illicit funds, transferring tokens between player accounts, selling gaming assets through third-party marketplaces, using virtual economies to obscure ownership trails, and converting gaming currencies back into fiat or cryptocurrency are all methods that can be used in the online gaming ecosystem.

Gaming platforms with peer-to-peer transfer capabilities may present money laundering risks if customer verification procedures are weak. Stablecoins and NFTs can also be combined to facilitate cross-border movement of illicit funds. A criminal organization may purchase stablecoins using illicit proceeds or use those stablecoins to buy NFTs. They can transfer NFTs across borders through anonymous wallets and sell them in another jurisdiction. This process creates multiple transactional layers that complicate investigations and obscure beneficial ownership.

Challenges for financial institutions arise as new environments in the online world. These economies create difficulties such as source-of-funds verification, jurisdictional coordination, customer due diligence, and real-time transaction monitoring. As digital asset ecosystems continue evolving, institutions must adapt monitoring frameworks to address interconnected cryptocurrency risks.

What Financial Institutions Can Do to Counter Cryptocurrency Money Laundering

Financial institutions can reduce exposure to cryptocurrency-related financial crime through a layered compliance approach. Strengthening Customer Due Diligence (CDD) verifying customer identities thoroughly, assessing customer exposure to digital assets and conduct enhanced due diligence on high-risk customers. It can also identify beneficial ownership structures and review source-of-wealth information. Other approaches institutions can take are implementing blockchain analytics tools. It can help them by detecting exposure to mixers and sanctioned wallets and identify suspicious transaction patterns. Monitoring high-risk blockchain addresses can find and trace cross-chain movements while also flagging anomalous wallet behavior. Enhancing transaction monitoring can show real-time cryptocurrency transaction screening and rapid movement of funds, provide stablecoin risk assessments, and identify unusual wallet activity involving high-risk jurisdictions.

Some individual training and awareness that employees of the institution can take are the newest list of cryptocurrency money laundering typologies, NFT and gaming token risks, stablecoin vulnerabilities, emerging sanctions concerns, and reporting obligations and escalation procedures. Institutions and their employees should maintain strong communication with financial intelligence units, regulatory agencies, blockchain analytics providers, law enforcement organizations, and industry information-sharing groups.

Conclusion

Cryptocurrency money laundering remains a significant and evolving challenge for financial institutions and regulators worldwide. The increasing use of mixers, stablecoins, NFTs, gaming tokens, and decentralized finance platforms has created new opportunities for illicit actors to obscure financial activity and move funds across borders.

To address these risks effectively, institutions must combine strong AML compliance programs, advance blockchain analytics, enhance customer due diligence, and continue employee education. Proactive monitoring and collaboration with regulators and law enforcement agencies will remain critical as cryptocurrency ecosystems continue to expand. By understanding emerging money laundering typologies and implementing robust risk mitigation measures, financial institutions can strengthen financial integrity, protect customers, and reduce exposure to digital asset-related financial crime.

Sources:

• GENIUS-Act-Illicit-Finance-Innovation-Congressional-Report-March-2026.pdf
• Mixers and Tumblers: Regulatory Overview and Use in Illicit Activities
• Banks in the Age of Stablecoins: Some Possible Implications for Deposits, Credit, and Financial Intermediation
• Investopedia - NFT Investment: Pros and Cons of Non-Fungible Tokens Explained
• FinCEN Issues Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity
• Arcadia Finance Exploit - Coin Swapping: Money Laundering Tactics on Crypto Exchanges

Red Flag Indicators

The indicators below may be indicative of Cryptocurrency Laundering.

Customer Behavior Red Flags

• Sudden increases in cryptocurrency activity
• Transactions inconsistent with stated business purpose
• Reluctance to provide wallet ownership information
• Use of multiple wallets without clear explanation
• Frequent transfers to offshore exchanges

Transactional Red Flags

• Exposure to known mixers or tumblers
• Repeated small-value transfers structured to avoid detection
• Rapid conversion between cryptocurrencies
• High-volume NFT trading without economic rationale
• Large stablecoin transfers involving high-risk jurisdictions
• Wallets linked to darknet marketplaces
• Use of anonymizing technologies such as DEXs and privacy coin conversions

🔎 The Lookback

Cornerstone is proud to introduce “The Lookback,” a new recurring feature highlighting real-world investigative outcomes that reflect the impact of the typologies, red flags, and reporting guidance shared through previous issues. This series underscores a simple but powerful message: financial intelligence matters – and it delivers results.

A recent HSI-led case demonstrates that impact in action. In June 2026, investigators secured a conviction in a $52 million healthcare fraud, narcotics distribution, and kickback scheme, dismantling a sophisticated criminal enterprise operating under the appearance of legitimate medical services. Readers can review the official case details here: Newsroom – Healthcare Fraud Conviction (June 10, 2026).

This enforcement action closely mirrors the themes highlighted in Cornerstone April 2024 (Issue #51), which emphasized the critical role of Bank Secrecy Act (BSA) reporting and Suspicious Activity Reports (SARs) in identifying hidden illicit activity within otherwise routine financial transactions. That article underscored how reporting requirements create a vital financial trail – one that enables investigators to detect patterns, connect accounts, and ultimately uncover large-scale criminal networks. [HSI Cornerstone Issue #51]

In this case, illicit proceeds generated through fraudulent healthcare billing and narcotics activity were commingled with legitimate business revenue, creating transaction patterns that could be identified through careful monitoring and reporting. As Cornerstone has consistently stressed, what may initially appear to be isolated anomalies—unusual billing practices, inconsistent cash flows, or irregular account behavior—can, when reported and analyzed collectively, reveal major criminal enterprises.

The success of this investigation reflects the strength of the partnership between HSI and the financial sector. Timely, accurate, and actionable reporting by financial institutions remains a cornerstone of law enforcement success, turning insight into action and reinforcing the integrity of the U.S. financial system.

Stay tuned for future editions of The Lookback as we continue connecting Cornerstone insights to real-world outcomes, demonstrating how informed vigilance drives operational success.

Bank Reporting Legal Provisions

Banks and other financial institutions are permitted—and in some cases required—by law to report suspected crimes, including frauds such as romance scams or business email compromise, to law enforcement without violating customer privacy protections. The key provisions that allow this are found in both the Right to Financial Privacy Act (RFPA) and the Bank Secrecy Act (BSA).

1. Right to Financial Privacy Act (RFPA)

• The RFPA (12 U.S.C. § 3401 et seq.) generally restricts government access to the financial records of individuals without customer consent or a legal process.
• Exception for Voluntary Disclosures: Under 12 U.S.C. § 3403(c), the RFPA does not prohibit financial institutions from notifying law enforcement authorities of information that may be relevant to a possible violation of any statute or regulation. This means banks can voluntarily report suspected criminal activity to law enforcement without violating the RFPA.

2. Bank Secrecy Act (BSA)

• The BSA (31 U.S.C. § 5311 et seq.) and its implementing regulations (31 CFR Chapter X) require financial institutions to assist U.S. government agencies in detecting and preventing money laundering and other financial crimes.
• Suspicious Activity Reports (SARs): Under 31 U.S.C. § 5318(g) and 31 CFR § 1020.320, banks are required to file a SAR with the Financial Crimes Enforcement Network (FinCEN) when they detect known or suspected violations of law or suspicious transactions relevant to a possible violation of law or regulation.
• Safe Harbor: The BSA provides a safe harbor (31 U.S.C. § 5318(g)(3)) for financial institutions and their employees who file SARs or otherwise report suspicious activity to law enforcement, protecting them from liability for such disclosures.

3. Practical Application

• Romance scams, business email compromise, and other frauds: If a bank detects or suspects such activity, it is both permitted and, in many cases, required to report it to law enforcement and/or file a SAR with FinCEN.
• Immediate Threats: If a crime is in progress and there is an immediate threat (e.g., ongoing wire fraud), banks can contact law enforcement directly, in addition to filing a SAR.

Summary Table

Law/Provision              What It Allows                                      Citation

RFPA                            Voluntary disclosure of suspected      12 U.S.C. § 3403(c)

                                     crimes to law enforcement    

BSA                              Mandatory SAR filing for suspicious    31 U.S.C. § 5318(g);

                                     activity; safe harbor for reporting         31 CFR § 1020.320     

In summary: Both the RFPA and BSA allow and/or require banks to report suspected crimes, including ongoing scams or fraud, to law enforcement without violating customer privacy rules.

HSI encourages the public to report suspected suspicious activity through its Tip Line. You may remain anonymous.

We’d love to hear your thoughts! Please share your feedback to
cornerstone@hsi.dhs.gov.

HSI’s mission is to protect the United States by investigating global crimes that impact our local communities. We have over 10,000 employees stationed in over 235 U.S. cities and more than 50 countries worldwide. This gives us an unparalleled ability to prevent crime before it reaches our communities