Loading story…
Organized crime groups in the U.S. have increased money mule network activity by 168% in the first half of 2025, leveraging stablecoins to launder funds. Stablecoins now account for 63% of illicit on-chain transactions, with $649 billion in fraudulent funds moved through these channels. Traditional anti-fraud and AML systems are struggling to keep pace with these evolving tactics.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly turning to stablecoins, particularly those pegged to the U.S. dollar, as their preferred medium for illicit transactions. This shift is driven by the predictability and convenience that stablecoins offer compared to more volatile cryptocurrencies like Bitcoin. According to Jacqueline Burns Koven, head of cyberthreat intelligence at Chainalysis, stablecoins now account for 63% of all illicit crypto transactions, marking a significant change from previous years when Bitcoin dominated the criminal landscape due to its liquidity. The surge in stablecoin usage is not limited to illegal activities; legitimate uses such as remittances, cross-border payments, and value storage have also contributed to a 77% year-over-year growth in 2024. However, the same features that make stablecoins attractive for legal purposes—liquidity, accessibility, and price stability—also appeal to cybercriminals seeking to scale theft and fraud operations. Law enforcement agencies are adapting their investigative techniques in response to this trend, moving from traditional post-fact subpoenas to real-time blockchain tracking to keep pace with the speed and cross-chain capabilities of stablecoin transactions. The design of stablecoins, which are typically backed by reserves or stabilization mechanisms, ensures that their value remains close to $1, providing criminals with confidence that their illicit gains will not be eroded by market volatility. This predictability is particularly valuable for large-scale operations, where even minor fluctuations in value could result in significant losses. The increased use of stablecoins in cybercrime has prompted greater collaboration between law enforcement, the private sector, and blockchain analytics firms. Investigators are leveraging advanced chain analysis tools to trace the flow of stablecoins across multiple platforms and identify patterns indicative of criminal activity. The transition to stablecoins has also highlighted the need for enhanced regulatory frameworks and compliance measures within the cryptocurrency ecosystem. Financial institutions and exchanges are under pressure to implement robust anti-money laundering (AML) and know-your-customer (KYC) protocols to detect and prevent the movement of illicit funds. The evolving threat landscape underscores the importance of continuous monitoring and intelligence sharing among stakeholders. As stablecoins become more entrenched in both legitimate and criminal financial systems, the challenges for law enforcement and cybersecurity professionals will continue to grow. The ability to track and interdict illicit stablecoin transactions in real time is now a critical component of modern cybercrime investigations. This development represents a fundamental shift in the tactics and tools used by both criminals and those tasked with stopping them. The rise of stablecoins as the currency of choice for online criminals is reshaping the dynamics of cyber-enabled financial crime and necessitating a coordinated, technology-driven response.
Jul 12, 2026
New research from **Chainalysis** reports that Chinese-language money laundering networks (CMLNs) have become a dominant component of the illicit crypto economy, processing an estimated **20% of known illicit cryptocurrency funds** over the past five years. Chainalysis estimates CMLNs laundered **$16.1 billion in 2025** (about **$44 million/day**) across **1,799+ active wallets**, and that total on-chain laundering activity grew from roughly **$10 billion in 2020** to **$82+ billion in 2025**. The report describes multiple service types and behaviors used to evade detection, including **“Black U”** and gambling services that fragment transactions, and **OTC-style** services that consolidate smaller transfers for integration. Chainalysis and reporting on the findings note that **guarantee/escrow marketplace platforms** (e.g., **Huione** and **Xinbi**) act as aggregation points where laundering vendors advertise and connect with customers, often via **Telegram** channels, but enforcement actions have had limited lasting impact because vendors migrate to new platforms. The ecosystem supports laundering tied to cyber-enabled crime, including funds stolen via **hacks, exploit attacks, scams**, and “pig butchering” fraud; Chainalysis assesses CMLNs launder **10%+** of proceeds from pig butchering scams and also provide swapping/off-ramping services used by transnational criminal groups, including actors in Southeast Asia and **North Korean**-linked operations.
Jun 29, 2026
Illicit cryptocurrency activity reached unprecedented levels in 2025, with at least $154 billion in crypto flowing to addresses linked to criminal activity, according to Chainalysis. This surge was primarily driven by a dramatic increase in transactions involving sanctioned entities, which saw a 694% year-over-year rise. Nation-states have become increasingly involved, leveraging both established criminal infrastructure and developing their own on-chain systems to evade sanctions at scale. The professionalization of the illicit crypto ecosystem now enables transnational criminal networks and governments to launder funds and procure goods and services more efficiently, raising the stakes for both consumer protection and national security. Concurrently, global fraud has evolved into a strategic tool for both organized crime and hostile states, integrating advanced technical tactics such as bot farms, malware, and cryptocurrencies. Governments and private sector organizations are responding by forming international task forces to address the industrialization of fraud, which now rivals the GDP of major economies. North Korea and other pariah states are specifically cited for weaponizing cyber-enabled fraud networks to circumvent sanctions and generate revenue, further blurring the lines between traditional financial crime and cyberwarfare. The convergence of nation-state actors and criminal syndicates in the crypto space underscores the urgent need for coordinated global action to counter these threats.
Jun 29, 2026