Cryptocurrency Money Laundering in Cybercrime Prosecutions

The scale of the problem is almost funny, if you squint at it the right way. Chainalysis recorded $40.9 billion received by illicit addresses in 2024. Then they went back and revised the 2023 figure upward from $24.2 billion to $46.1 billion as more addresses were identified. Then the 2024 number climbed to $57.2 billion in the next reporting cycle. Every annual figure is a floor, not a ceiling. The scoreboard keeps changing after the game ends.

FBI IC3's 2024 data adds the victim-facing side of this: cryptocurrency-related losses were the dominant component of recorded cybercrime losses, with crypto-referencing complaints more than doubling year-on-year versus 2023. And both figures, the Chainalysis numbers and the IC3 numbers, are believed to significantly undercount what's actually happening.

That gap between what victims report and what investigators can trace is the structural problem. It's also why prosecutors cannot simply wait for complaints to come in. Most laundering activity is invisible until blockchain analysis surfaces it. The complaint arrives after the money is already three chains deep.

Understanding how prosecutions actually work, where they succeed, and where the mechanics fall apart, starts with understanding the tools: the actual plumbing, not abstract theory.

Bitcoin Is No Longer the Dominant Vehicle, and That Actually Matters for Investigators

This is the part that surprises people who haven't been watching closely. Bitcoin used to be the default mental image when someone said "crypto crime." That's no longer accurate.

Stablecoins now account for 63% of all illicit transaction volume in 2024. Stablecoins displaced Bitcoin as the dominant vehicle. The reason is almost boringly practical: stable value, low fees, broad exchange support. The same properties that make stablecoins attractive to a freelancer getting paid across borders make them attractive to someone moving criminal proceeds.

TRON-based Tether is the specific instrument of choice. TRM Labs found that the TRON network alone handled $26 billion in illicit flows in 2024. TRON transactions are cheap and fast. That's the whole pitch, for everyone.

Mixers, which used to be the obfuscation method of choice, are declining. Cross-chain bridges have largely replaced them. Bridges are faster, more efficient, and they create a harder-to-follow audit trail. The funds that still flow through mixers are predominantly stolen assets. Ransomware payments and darknet transactions make up smaller shares of mixer inflows.

Here's why this matters for prosecutors specifically. The blockchain tracing methodology that was built around Bitcoin uses something called the UTXO model. It's a particular way the Bitcoin network accounts for ownership of coins. TRON and Ethereum-based tokens run on an account-based model. These are meaningfully different architectures. The tooling had to catch up. Some of it remains behind.

Laundering Is Now a Product You Can Buy, and That Changes the Legal Theory

The industrialisation of money laundering is real, and it's documented.

Huione Guarantee is the clearest example. It was averaging substantial Tether per day to Binance customer accounts over an extended period. It kept going after the U.S. Treasury labelled it a primary money laundering concern. After OKX's February 2025 guilty plea, customer accounts at OKX still received hundreds of millions of dollars from Huione. Exchange-level enforcement actions, even criminal ones, do not automatically stop the flows through that exchange.

The Chinese-language money laundering networks Chainalysis identified in 2025 are another data point. Nearly 1,800 active wallets. $16.1 billion in crypto processed. Roughly 20% of global crypto money laundering, run through a loose network of Telegram-based OTC brokers and multilayered wallet structures.

The operational infrastructure for these networks is largely off-chain. It lives in Telegram chats and informal OTC relationships that leave no blockchain record. That's deliberate.

Pig-butchering laundering pipelines show the architecture in detail. Victim funds move from scam deposit addresses through peel chains (a long sequence of small hops that progressively moves value down a chain of addresses), structured transfers, and cross-chain swaps, before consolidating into USDT. Every hop is a deliberate friction point for investigators.

The legal significance of industrialisation is this: when laundering is a service sold to multiple criminal clients, prosecutors can pursue the service provider under conspiracy and RICO theories. They don't have to trace every individual predicate offense. That's a meaningful expansion of what's prosecutable, and it explains some of the charging decisions you're seeing.

What Blockchain Tracing Can Actually Prove in Court, and Where It Hits a Wall

The immutable public ledger is genuinely useful. Every transaction is recorded, timestamped, and addressable. Unlike traditional financial records, investigators don't need a subpoena to read the chain. It's public.

Cluster analysis is how investigators go from individual transactions to suspect entities. It attributes multiple addresses to a common wallet owner using co-spend patterns and other heuristics. It's powerful and probabilistic, and defence teams know it.

The $225.3 million Secret Service forfeiture action in 2025 shows tracing at scale. The reconstruction went: 93 scam deposit addresses, to 35 intermediary wallets, to 7 USDT wallet groups, to 144 accounts at OKX. The Last-In-First-Out (LIFO) accounting method was applied to establish which specific victim funds ended up where.

That LIFO versus FIFO question is a live legal debate. These are accounting conventions, and which one you apply to fungible digital assets can change whether specific funds are traceable to a specific crime. Defence teams contest this actively, and courts have not fully settled it.

The Bitcoin Fog conviction in 2024 established something important: mixers can be de-mixed. Blockchain analytics firms reconstructed fund flows despite deliberate obfuscation. The operator received a lengthy prison sentence. The tools work, even against adversarial obfuscation, more often than the criminal operators expected.

But here's the hard limit. Tracing establishes movement. A wallet address resolves to a string of characters, not a named individual. Converting a wallet address to a named defendant requires off-chain evidence. That's where exchange cooperation becomes the load-bearing pillar of the whole prosecution architecture.

The KYC Connection: How an Address Becomes a Name

Regulated exchanges hold KYC records that link deposit addresses to verified identities. A grand jury subpoena, or a mutual legal assistance request for overseas exchanges, converts on-chain tracing into a named suspect. This is the step that makes the case.

The Binance case is the landmark. Changpeng Zhao's 2023 guilty plea and the resulting multibillion-dollar settlement came directly from DOJ's ability to show that Binance had systematically failed to file suspicious activity reports and had allowed sanctioned entities to transact. The exchange's own compliance failures became the evidentiary record. The case was built on the exchange's documented failure to act like a compliant institution.

OKX's February 2025 guilty plea followed a similar pattern. Operating an illegal money transmitter. The court-mandated compliance consultant that came out of that plea did not prevent the continued Huione flows. That will likely feature in future proceedings.

Garantex shows the limits of this approach when an exchange operates outside U.S. jurisdiction. Charges were filed against its administrators. Roughly $26 million in funds were frozen. But the exchange had processed at least $96 billion since 2019. The recoverable share is small relative to total volume.

OFAC sanctions operate on a parallel track to criminal prosecution. Thirteen designations covering 86 cryptocurrency addresses in 2024 caused inflows to the designated exchanges to drop sharply in the three months following designation. Sanctions function as a chokepoint even when criminal prosecution isn't yet viable or achievable. They're not perfect, but the drop is not nothing.

The cooperation dynamic also cuts both ways. Exchanges that cooperate proactively can negotiate outcomes. Those that obstruct or operate offshore face criminal charges against executives personally. Changpeng Zhao faced personal criminal liability, not merely institutional consequences.

Forfeiture: The Other Track That Runs While the Criminal Case Is Still Being Built

Civil forfeiture requires only a preponderance of evidence that assets are proceeds of crime, a lower bar than proof beyond reasonable doubt. That lower threshold means prosecutors can move on assets before a criminal case is trial-ready.

The $225.3 million Secret Service action is the clearest current example. Filed as a civil forfeiture complaint, it allowed seizure of funds across those 144 OKX accounts without waiting for criminal indictments. The assets were seized. The question of individual criminal guilt came later.

The DOJ Scam Center Strike Force has collectively restrained hundreds of millions of dollars in cryptocurrency tied to money laundering from crypto scams. Forfeiture is the primary mechanism, largely because many perpetrators are overseas and beyond extradition reach. Extradition fails when the host country refuses to cooperate. Prosecutors can sometimes seize what the defendant left on a cooperating exchange.

Forfeiture also creates victim restitution pools. Seized assets can flow back to fraud victims in a way that criminal fines paid into the general government fund cannot directly replicate. For pig-butchering victims, this is the only realistic path to recovery.

The tension: when assets are in stablecoins held at cooperating exchanges, freezing is straightforward. When assets have been bridged to non-cooperative chains or converted into privacy coins, the window to seize closes fast. Speed matters as much as quality of tracing.

North Korea and the Lazarus Group cases show the hard ceiling. The Bybit hack involved hundreds of millions of dollars laundered within the first 48 hours. State-sponsored actors can move faster than civil process allows. Better tooling leaves that gap open.

What the Successful Prosecutions Have in Common

Bitcoin Fog (Roman Sterlingov, 2024 conviction) and the Blender.io/Sinbad.io indictment in 2024 show that mixer operators are consistently reachable. They hold infrastructure in identifiable jurisdictions. The mixing logs themselves can become evidence. If you run the infrastructure, you're findable.

Tornado Cash splits the record in a way that's instructive. Alexey Pertsev was convicted in the Netherlands in May 2024. Roman Storm was convicted in the Southern District of New York on August 6, 2025 on the unlicensed money transmitter count. But the jury deadlocked on the conspiracy to commit money laundering charge. Same conduct, different legal theories, different outcomes.

The Storm verdict illustrates the doctrinal problem with prosecuting smart-contract infrastructure. Jurors accepted that the software transmitted money without a licence. They could not agree that the developers intended to launder. Developer intent is the contested element. Writing code that can be used for money laundering carries different legal exposure from intending to launder. Courts are still working out exactly where that line is.

The March 2025 RICO indictment (alleging over $263 million) suggests prosecutors are reaching for enterprise-liability theory when individual transaction tracing is insufficient to isolate a single predicate offense. RICO lets you charge the entire network, including every node within it.

Exchange-level guilty pleas, Binance, BitMEX, OKX, resolve through settlement rather than trial. The institutional cases are won on compliance failure records. The compliance failure is the crime.

The pattern, when you look across all of these cases, is consistent. Prosecutions that combine on-chain tracing with clear off-chain identity evidence and a cooperating (or pleaded) exchange have the strongest track record. Cases that depend entirely on attributing intent to code remain contested and juries remain uncertain.

Where the Whole Machine Still Breaks Down

Jurisdictional fragmentation is the structural problem that resists clean solutions.

Garantex processed at least $96 billion operating from Russia. Sanctions and charges were filed. The exchange operated largely uninterrupted until infrastructure-level action by international partners produced results that unilateral U.S. criminal process could not.

State-sponsored actors operate entirely outside the exchange-cooperation model. Lazarus Group routes stolen funds through services like Huione-type guarantee platforms, cross-chain bridges, and OTC brokers that have no KYC obligation and no subpoena exposure. The prosecution model loses its load-bearing pillar because every exchange in the chain operates outside subpoena reach.

The retroactive revision problem in illicit flow data is also a practical investigative issue. When Chainalysis revises a prior year's figure upward by tens of billions of dollars, that means addresses identified after charges were filed cannot retroactively strengthen an indictment. Prosecutors are always working with incomplete maps. The map gets more complete over time, but the indictment was written at an earlier moment.

Stablecoin issuers have the technical ability to freeze assets at the contract level. Tether can freeze a TRON-based USDT wallet. But their cooperation is governed by their own policies, not by U.S. legal process. A forfeiture order against that wallet is only executable if Tether acts on it. That's a dependency that sits outside the normal enforcement chain.

The laundering-as-a-service model creates diffusion of liability at scale. When nearly 1,800 wallets are processing $16.1 billion across loosely affiliated networks, identifying which specific wallet operator is criminally liable requires a prosecutorial resource commitment that outpaces current staffing. You can see the flows. Assigning individual criminal responsibility across that many actors is a different problem.

The open question for everyone working in this space: as cross-chain bridges, privacy-preserving stablecoins, and decentralised OTC markets mature, the exchange-cooperation pillar becomes structurally weaker. It is currently the most reliable path from on-chain pattern to named defendant. Every proposed replacement mechanism remains unproven at scale.

The enforcement mechanics work. They work well enough to produce billion-dollar forfeitures, landmark guilty pleas, and real prison sentences. They work too slowly, and too narrowly, to outpace the growth of the problem. That gap is the honest summary of where things stand.