Crypto Money Laundering: How It Works and How It Is Traced

Money laundering is making stolen or illegal money look clean, so it can be spent without anyone asking where it came from. Crypto changes the tools, not the goal. Every transfer sits on a public ledger, so launderers spend their effort breaking the trail between the crime and the cash-out.

The amounts are large. Illicit crypto addresses received at least $154 billion in 2025, Chainalysis estimated, up from a revised $57.2 billion in 2024, The Block reported. Chainalysis calls both figures lower bounds.

The three stages

Laundering is usually described in three stages. In crypto they look like this.

Stage	What it means	In crypto
Placement	Getting dirty money into the system	Stolen coins arrive in a wallet the criminal controls, or cash buys crypto at a lax exchange or ATM
Layering	Hiding where the money came from	Splitting funds across many fresh wallets, mixing, swapping tokens, hopping between chains
Integration	Bringing it back as clean money	Selling at an exchange or over the counter, or spending through a service that pays out to a bank

The tools launderers use

• Mixers. A mixer pools coins from many users and pays them out to new addresses, which breaks the link between sender and receiver. Tornado Cash on Ethereum works this way, in fixed sizes such as 100 ETH.
• Fresh wallets. Making a new address costs nothing. Thieves split funds across dozens or hundreds of them to tire out whoever is following.
• Token swaps. Decentralized exchanges let anyone swap one token for another without an account. A thief holding a token its issuer can freeze, such as USDC, has a reason to swap it fast.
• Bridges. Moving coins to another chain makes the trail harder to follow, since each chain needs its own data.
• Exchanges with weak checks. Some exchanges and over-the-counter desks do not verify customers well. That is where integration often happens.

A measured example: the Ronin bridge hack

In March 2022, attackers drained the Ronin bridge, which served the game Axie Infinity, of 173,600 ETH and 25.5 million USDC. The FBI attributed the theft to North Korea's Lazarus Group in April 2022. We followed the ETH with the Bitquery MCP server. Each step shows the question we gave the AI and the tool it called. We ran every query on 15 October 2026. All times are UTC.

Role	Address
Exploiter wallet	0x098B716B8Aaf21512996dC57EB0615e2383E2f96
Ronin bridge	0x1a2a1c938ce3ec39b6d47113c7955baa9dd454f2
Tornado Cash router	0xd90e2f925da726b50c4ed8d0fb90ad053324f31b

We asked: "What labels does the exploiter wallet carry?" The AI used address_labels.

Label	Source
Sanctioned, Lazarus Group	US Treasury (OFAC) list
Sanctioned, Lazarus Group	Japan's Ministry of Finance list
Blocked by the issuer	USDC and USDT

We asked: "When did the stolen ETH arrive, and where did the wallet send it?" The AI used eth_flows_between, which lists every counterparty of a wallet.

What the ledger shows	Figure
ETH received from the Ronin bridge	173,600, on 23 March 2022 at 13:29
First large payouts	1,250 ETH each to five wallets, on 28 and 29 March
ETH paid to the 23 wallets that got 1,000 ETH or more	182,162, by 4 May
Largest single payout	33,568 ETH, on 24 April

The payouts total more than the 173,600 ETH stolen because the wallet also took in about 8,600 ETH from two other addresses on the day of the theft. Bitquery's labels mark the seven largest of those wallets as sanctioned Lazarus Group wallets too.

We asked: "Follow the 33,568 ETH payout. Where did it go?" The AI used eth_flow_edges, then eth_flows_between against Tornado Cash's labelled addresses.

What the ledger shows	Figure
Wallets it was split into	8 large ones, between 5 and 10 May 2022
ETH those 8 wallets sent to Tornado Cash	33,400
Number of deposits	334, each exactly 100 ETH
Share of the branch that went into the mixer	99.5%

This is layering in its plainest form. One wallet took the money, spread it across new wallets, and each new wallet fed it into a mixer in equal 100 ETH pieces over five days. What came out of Tornado Cash went to new addresses with no visible link to the theft. The US Treasury sanctioned Tornado Cash in August 2022, citing this kind of use, and lifted those sanctions in March 2025.

How laundering gets caught

A mixer breaks the direct link, but laundering still leaves patterns.

• Amounts and timing. Equal deposits into a mixer, followed by equal withdrawals soon after, can be matched by size and time.
• Shared owners. On Bitcoin, addresses spent together in one payment usually belong to one wallet. On Ethereum, wallets funded by the same source often share an owner.
• Labels. Exchanges, mixers, bridges and sanctioned wallets are labelled by analysts and by public lists. A trace that reaches a labelled exchange reaches a company that knows its customer.
• The cash-out. Integration needs a service that pays out real money. Regulated services must check customers and report suspicious activity, so that is where many cases break open.

The rules behind that last point come from the Financial Action Task Force. Its standards ask countries to license crypto services, make them check customers, and pass sender and receiver details along with transfers, a requirement known as the travel rule.

Trace it yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing and labels sit on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

What labels does 0x098B716B8Aaf21512996dC57EB0615e2383E2f96
carry? Is it sanctioned?

Where did that wallet send its ETH in 2022? List each
counterparty with amounts.

How much ETH did these wallets send to Tornado Cash, and in what
sizes?

For a Bitcoin trace, see where the Twitter hack Bitcoin went. For hands-on help with a case, see Bitquery's crypto investigation service.

Frequently asked questions

How is crypto money laundered?

In three stages. Stolen or illegal coins are placed in wallets the criminal controls, layered through new wallets, mixers, swaps and bridges to hide their origin, and then integrated by cashing out through an exchange or other service.

Can crypto money laundering be traced?

Often, at least partly. Every transfer is public, and patterns such as equal mixer deposits, shared funding sources and labelled exchange addresses help investigators follow the money. The hardest step is linking a wallet to a person, which usually needs a regulated service's customer records.

What is a crypto mixer?

A service that pools coins from many users and pays them out to new addresses, so that the link between sender and receiver is lost on the ledger. Tornado Cash is the best-known example on Ethereum.

How much crypto is laundered each year?

There is no exact figure. Chainalysis estimated that illicit crypto addresses received at least $154 billion in 2025. That counts all illicit activity, not only laundering, and the firm says the figure will rise as more addresses are identified.

Related reading

• How to trace Bitcoin transactions and addresses
• How the Upbit hackers split 342,000 stolen ETH
• Stolen Bitcoin: how to trace it and when you can get it back

First published in August 2020. Rewritten on 15 October 2026, merging in our 2024 post on laundering and analytics by Divyasshree and Anish Majumdar: the Ronin trace was run again with the Bitquery MCP server, Coinpath and the 2020 regulation section were removed, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server and the investigation service named above. Attribution of the Ronin theft rests on the FBI's public statement; the post describes what the ledger records.