The word laundering is a metaphor: dirty money is washed until it looks clean. The meaning runs deeper than the metaphor suggests. Money laundering is a structured process, and in crypto, that process has accelerated to a pace that fundamentally changes how compliance teams must respond.
The sections below cover the legal and financial meaning of money laundering, how crypto has changed its mechanics, and two high-profile 2025 cases that illustrate what compliance systems are now expected to catch.
The Core Meaning of Money Laundering in Financial Law
Money laundering, in financial law, means concealing the origins of criminally obtained funds. The process transforms dirty money into assets that appear to have a legitimate source. That dirty money comes from proceeds of drug trafficking, fraud, theft, or corruption.
FinCEN defines money laundering as the process by which criminals disguise the original ownership and control of criminal proceeds by making those proceeds appear to have derived from a legitimate source. That definition carries legal weight. Under the U.S. Bank Secrecy Act and related statutes, facilitating money laundering, even unknowingly, can expose a financial institution to civil penalties and criminal prosecution.
Three stages define the process in every legal framework:
-
Placement: criminal funds enter the financial system
-
Layering: the trail is obscured through complex transaction chains
-
Integration: cleaned funds re-enter the economy as seemingly legitimate assets
Crypto has not changed the meaning of money laundering. It has changed how fast each stage completes. It has also changed how difficult each stage is to detect without purpose-built on-chain tools.
How Crypto Enables Money Laundering at New Speeds
In traditional finance, placement is the most vulnerable stage. Large cash deposits trigger reporting thresholds. Physical currency is hard to move across borders. These friction points give investigators time to act.
In crypto, that friction largely disappears. Consider how the two environments compare:
| Dimension | Traditional Money Laundering | Crypto Money Laundering |
|---|---|---|
| Placement speed | Hours to days | Seconds |
| Layering method | Shell companies, offshore banks, wire transfers | Multi-hop wallets, cross-chain bridges, mixers |
| Regulatory coverage | High in major jurisdictions | Uneven globally; varies by chain and exchange |
| Traceability | Limited (correspondent banking records) | High in theory; requires specialized blockchain tools |
| Cross-border movement | 1–5 business days | Under 60 seconds |
The traceability row is critical. Unlike cash, every on-chain transaction is permanently recorded on a public ledger. That means crypto money laundering leaves more evidence than traditional cash laundering. But accessing and interpreting that evidence requires tools that most institutions do not yet have.
The OFAC FAQ on virtual currency confirms that on-chain addresses can be listed on the Specially Designated Nationals (SDN) list. Any transaction with a listed address, even an indirect one, can constitute a sanctions violation.
Two High-Profile Cases: Bybit and ICE Exchanges
Two 2025 cases show what money laundering through crypto looks like at scale. They also show how it is eventually traced.
The Bybit Hack ($1.5 billion)
In February 2025, North Korea's Lazarus Group stole approximately $1.5 billion (400,000+ ETH) from Bybit in a supply chain attack. It was the largest crypto hack in history. The attackers compromised Safe{Wallet} developer infrastructure and laundered proceeds through decentralized exchanges and cross-chain bridges. BlockSec Bybit Incident Analysis
The Bybit case illustrates how layering works at nation-state scale. The attackers did not move funds in a single large transaction. They fragmented them across hundreds of addresses, routing through DeFi protocols designed to make tracing difficult. The supply chain vector (compromising Safe{Wallet} developer infrastructure rather than Bybit directly) also shows that the attack surface for money laundering extends beyond the exchange itself.
Instant Crypto Exchange (ICE) Laundering
A separate ACM SIGMETRICS 2025 paper by BlockSec found that instant crypto exchanges processed $12.47 million in illicit funds through 432 malicious addresses. These swaps execute rapidly and with minimal identity requirements, leaving little practical window for manual review. BlockSec Instant Exchange Laundering Analysis identifies the behavioral signatures that distinguish illicit swaps from legitimate activity.
Instant exchanges have become a preferred layering tool precisely because of their speed. These platforms allow users to swap cryptocurrencies without an account, and swaps complete far faster than any human-driven compliance review. The implication is that these platforms require automated, pre-transaction screening to catch illicit flows before they complete.
The U.S. Treasury's sanctions action against Sinbad.io established a precedent: mixing and exchange services that knowingly or negligently facilitate laundering can be shut down and their operators prosecuted, regardless of where they operate.
On-Chain Detection: Phalcon Compliance KYA and KYT
Catching the laundering patterns visible in the Bybit and ICE cases requires tools that screen addresses before a transaction clears and follow funds across every hop they take. Phalcon Compliance does this through two complementary layers: KYA (Know Your Address) for pre-transaction address screening, and KYT (Know Your Transaction) for cross-chain tracing.
KYA: Pre-Transaction Address Screening
Before a swap or withdrawal settles, Phalcon Compliance's KYA engine scores the counterparty address against live risk intelligence. That intelligence draws on sanctioned addresses, hacker-linked clusters, mixer exposure, exchange freeze records, and behavioral signatures of illicit activity. An address that processed ICE laundering funds, or that received a fragment of the Lazarus proceeds from the Bybit hack, carries a risk label the moment it appears in a transaction. Screening runs in milliseconds, fast enough to block or quarantine a swap before it completes instead of reporting the exposure after the funds have moved.
KYT: Cross-Chain Tracing and STR Generation
When funds have already moved, Phalcon Compliance's KYT reconstructs the full path across bridges, DEX swaps, and chain hops. For the Bybit case, that means following the ETH as Lazarus fragmented it across hundreds of addresses, swapped it through decentralized exchanges, and bridged it across networks. The same engine builds the evidentiary trail a compliance team needs to file a Suspicious Activity Report, attaching the traced addresses, transaction hashes, and risk labels in a format regulators can act on.
Closing the Loop
KYA stops funds before they settle; KYT traces them after they have moved. Together they map the same laundering cycle the Bybit and ICE studies exposed. KYA would have flagged the 432 ICE addresses before a single swap completed. KYT would have reconstructed the Bybit layering chain end to end. BlockSec Phalcon Compliance
What Compliance Teams Need to Know
The meaning of money laundering has not changed. What has changed is the speed, scale, and technical complexity of how it happens in crypto.
The Bybit case involved $1.5 billion, a nation-state attacker, and cross-chain bridge layering. The ICE exchange case involved 432 addresses processing $12.47 million through rapid, low-friction swaps. Both cases left on-chain traces. Both required purpose-built detection tools to identify.
For compliance teams, the minimum effective response today includes:
-
Pre-transaction address screening against live, real-time risk intelligence
-
Cross-chain tracing that can follow funds through bridges and DEX swaps
-
Behavioral pattern analysis that does not rely solely on static blocklists
-
Automated screening speed that matches or exceeds blockchain settlement time
Platforms that meet those four requirements are positioned to detect laundering before funds settle. Platforms that do not are exposed to the same risks, and the same enforcement actions, that regulators have been accelerating since 2024.
For how AML compliance works in practice for exchanges and VASPs, see AML Compliance for Crypto.
Frequently Asked Questions
Q: Can privacy coins like Monero or Zcash fully evade blockchain tracing?
Not entirely. Monero's ring signatures and stealth addresses significantly complicate tracing, but academic researchers have developed probabilistic de-anonymization techniques that have repeatedly broken its privacy guarantees.
Zcash's shielded transactions are mathematically strong, but most Zcash activity uses the transparent pool, so the shielded set remains small and the practical privacy is narrower than the cryptography promises.
This is partly why OFAC designated Tornado Cash rather than Monero as its primary mixer target. Monero has limited exchange liquidity, which reduces its usefulness for integration-stage laundering, while Ethereum-based mixers move far larger volumes of criminal proceeds.
Q: Are cross-chain bridges regulated under the same AML rules as centralized exchanges?
As of 2025, most cross-chain bridges operate without direct MSB registration. However, the 2023 U.S. Treasury DeFi Risk Assessment notes that bridge operators who custody funds in transit, or who control a deployment key, may meet the definition of a money services business under the BSA. FATF's updated guidance similarly holds that control over a transaction, not the technical architecture, determines whether AML obligations apply.
Q: Is using a cryptocurrency mixing service illegal?
Using a mixer is not automatically a criminal offense in every jurisdiction. However, in the U.S., using a mixer knowing the funds involved criminal proceeds can constitute money laundering under 18 U.S.C. § 1956. The 2024 conviction of Bitcoin Fog operator Roman Sterlingov established that operating a mixing service with knowledge of illicit use is prosecutable. OFAC's designation of Tornado Cash also means that any U.S. person interacting with the sanctioned smart contract after August 2022 faces sanctions exposure, regardless of the purpose.
→ Book a Phalcon Compliance demo and see how KYA and KYT catch laundering before settlement — Book a demo
