Loading story…
New research from Chainalysis reports that Chinese-language money laundering networks (CMLNs) have become a dominant component of the illicit crypto economy, processing an estimated 20% of known illicit cryptocurrency funds over the past five years. Chainalysis estimates CMLNs laundered $16.1 billion in 2025 (about $44 million/day) across 1,799+ active wallets, and that total on-chain laundering activity grew from roughly $10 billion in 2020 to $82+ billion in 2025. The report describes multiple service types and behaviors used to evade detection, including “Black U” and gambling services that fragment transactions, and OTC-style services that consolidate smaller transfers for integration.
Chainalysis and reporting on the findings note that guarantee/escrow marketplace platforms (e.g., Huione and Xinbi) act as aggregation points where laundering vendors advertise and connect with customers, often via Telegram channels, but enforcement actions have had limited lasting impact because vendors migrate to new platforms. The ecosystem supports laundering tied to cyber-enabled crime, including funds stolen via hacks, exploit attacks, scams, and “pig butchering” fraud; Chainalysis assesses CMLNs launder 10%+ of proceeds from pig butchering scams and also provide swapping/off-ramping services used by transnational criminal groups, including actors in Southeast Asia and North Korean-linked operations.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Chainalysis publicly details six service typologies used by Chinese-language laundering networks, their on-chain structuring and aggregation patterns, and the role of guarantee platforms such as Huione and Xinbi in supporting vendors. The report also argues that enforcement focused only on platforms causes vendor migration and that targeting operators and vendor networks is more effective.
Chainalysis estimates that more than $82 billion in cryptocurrency was laundered on-chain in 2025, up sharply from 2020 levels. The firm says Chinese-language networks accounted for about 20% of known illicit crypto funds over the past five years.
According to Chainalysis, Chinese-language money laundering networks laundered about $16.1 billion in 2025, averaging roughly $44 million per day across more than 1,799 active wallets.
Chainalysis estimates the broader illicit on-chain crypto money laundering ecosystem handled roughly $10 billion in 2020, providing a baseline for later growth.
Chainalysis says Chinese-language money laundering networks began emerging around the start of the COVID-19 pandemic, building a Telegram-centric ecosystem for crypto-enabled laundering services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcechainalysis.com
Open sourcetherecord.media
Open sourcechainalysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Illicit actors continue to hold and move significant amounts of cryptocurrency, with on-chain balances linked to criminal activity now exceeding $75 billion. According to blockchain analytics, nearly $15 billion is directly held by entities identified as illicit, with stolen funds representing the largest share of these holdings. Downstream wallets, which have received more than 10% of their inflows from illicit sources, collectively hold over $60 billion, indicating that the reach of criminal proceeds extends far beyond the original perpetrators. Darknet market administrators and vendors alone control over $40 billion in on-chain value, highlighting the scale of underground digital economies. Bitcoin remains the dominant cryptocurrency among illicit balances, accounting for 75% of the total, though stablecoins and ether have seen substantial growth in criminal usage. The concentration of these funds is typically high, with a small number of wallets holding the majority of assets. Illicit actors are adapting their laundering techniques, increasingly using more cashout addresses for shorter periods to evade detection. Direct transfers from illicit entities to exchanges have dropped significantly, from about 40% of quarterly value in 2021–2022 to just 15% in Q2 2025, reflecting changes in both enforcement and criminal tactics. Law enforcement agencies, particularly in the United States, are responding by establishing strategic reserves and stockpiles of seized digital assets, and have already confiscated over $12.6 billion in illicit funds with the help of blockchain analytics firms. The timing of enforcement actions varies, with market-based illicit services tending to operate longer before being disrupted. Once illicit entities stop receiving funds, the speed at which they empty their wallets depends on the type of cryptocurrency held. Meanwhile, specific high-profile incidents continue to occur, such as the $21 million theft from SBI Crypto, a subsidiary of Japan's SBI Group. In this case, hackers stole a variety of cryptocurrencies, including bitcoin, ethereum, litecoin, dogecoin, and bitcoin cash, and laundered the proceeds through Tornado Cash, a mixing service favored by cybercriminals. Investigators noted that the tactics and laundering patterns in the SBI Crypto heist closely resembled those used by North Korean hacking groups, suggesting a possible link to Pyongyang's ongoing campaign to finance illicit activities through digital asset theft. The SBI Crypto incident is part of a broader trend, with North Korean threat actors reportedly stealing a record $2 billion in cryptocurrency so far this year. These developments underscore the persistent threat posed by sophisticated cybercriminals and nation-state actors in the cryptocurrency ecosystem, as well as the evolving strategies of both criminals and law enforcement in the battle over digital assets. The growing landscape of seizable crypto assets presents both a challenge and an opportunity for authorities seeking to disrupt illicit financial flows. As criminals refine their methods, the need for advanced analytics and coordinated international enforcement becomes increasingly critical. The ongoing arms race between cybercriminals and law enforcement is likely to shape the future of digital asset security and regulation.
Jun 29, 2026Organized crime groups in the U.S. have increased money mule network activity by 168% in the first half of 2025, leveraging stablecoins to launder funds. Stablecoins now account for 63% of illicit on-chain transactions, with $649 billion in fraudulent funds moved through these channels. Traditional anti-fraud and AML systems are struggling to keep pace with these evolving tactics.
Jun 29, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026