Stolen Crypto: How Bitcoin Is Laundered in 2026

Aggregate Illicit Volume

Chainalysis documented $154 billion received by illicit cryptocurrency addresses in 2025, compared to approximately $59 billion in 2024 — an increase of 162%. [6] This figure was driven overwhelmingly by a 694% surge in value flowing through sanctioned entities, primarily Russian entities evading financial sanctions. [6][7] The four dominant crime categories in order of volume were: sanctions evasion ($104 billion), scams and fraud ($17 billion), stolen funds ($3.4 billion), and ransomware payments ($820 million). [1]

Stolen funds and ransomware, while smaller in absolute volume than sanctions evasion, are the categories most relevant to laundering analysis because they involve the immediate conversion and obfuscation of criminally obtained assets — triggering the full placement-layering-integration pipeline within days of the theft.

Stolen Funds

Cryptocurrency theft totaled $3.4 billion in 2025, up marginally from $3.38 billion in 2024. [8] However, the distribution was strikingly concentrated: the Bybit exchange compromise in February 2025 — confirmed by the FBI as the work of North Korea's Lazarus Group — accounted for $1.5 billion, or 44% of the annual total. [2][9] North Korea-affiliated actors stole $2.02 billion in total in 2025, representing nearly 60% of all cryptocurrency theft globally. [10] A notable trend was concentration in fewer, larger incidents consistent with the increasing sophistication of state-sponsored actors who spend months on reconnaissance before executing a single high-yield attack. [8]

Ransomware

Ransomware presents a countervailing trend: while on-chain payments declined approximately 8% to $820 million in 2025, ransomware incidents claimed by data leak sites grew 50% year-over-year to an all-time high. [11] This divergence reflects improved organizational backup practices and a methodological shift by operators toward lower-volume, higher-frequency targeting of mid-market firms. The top ransomware families operated through RaaS affiliate networks with cryptocurrency payments demanded in Bitcoin, Monero, or stablecoins depending on the operator's detection-evasion preferences. Operation Endgame in May 2025 seized core ransomware loader infrastructure, materially degrading several major families' monetization pipelines. [11]

Stage 1: Placement — Immediate Distancing

In the cryptocurrency context, placement means moving stolen assets out of the original compromised wallet into a form that complicates immediate attribution. For exchange hacks, this happens within minutes: attackers move funds from the exchange's hot wallet to series of freshly generated attacker-controlled wallets using scripts prepared in advance. [13] The Bybit attack processed approximately $160 million through illicit channels within the first 48 hours of the $1.5 billion theft. [9][13]

The primary placement tools in 2025 were: direct transfers to disposable "burner" wallets; DeFi protocol token swaps using DEX aggregators; and immediate conversion from exchange-specific tokens into broadly liquid assets like USDT, ETH, or BTC. [13] Notably, stablecoins now dominate the illicit crypto ecosystem in aggregate, accounting for 84% of all illicit transaction volume in 2025 — making stablecoin-denominated placement the modal case. [6]

Stage 2: Layering — Breaking the Trail

Layering is where 2025-2026 laundering has most dramatically evolved. The goal is to break the on-chain link between stolen funds and their destination by introducing sufficient complexity — across chains, assets, and time — that forensic tracing becomes economically prohibitive.

The dominant layering technique in 2025 was chain-hopping via cross-chain bridges. [3][14] A typical multi-stage laundering sequence begins with converting stolen ETH into Wrapped Bitcoin (WBTC) on a DEX, then bridging to the Bitcoin network, then swapping Bitcoin for Monero through an instant swap service, then re-converting Monero back to USDT on Tron — each step occurring on a different blockchain using a different service, none requiring KYC verification. [3][14][15] Elliptic's State of Cross-Chain Crime 2025 report found that 99% of 255 major hacks analyzed used multistage laundering, and that cross-chain bridge usage for laundering had increased fivefold since 2022, reaching $21.8 billion in cumulative laundered value. [3]

Peeling chains remain a secondary but common technique: repeatedly sending a small amount to a destination address while routing the remainder to a fresh address, creating a long sequence of disposable wallets that must each be individually attributed. [16] Blockchain analytics platforms now automatically detect peeling chain patterns, but the detection remains computationally intensive for very long chains.

Stage 3: Integration — Converting to Spendable Value

Integration — converting laundered crypto into spendable fiat — remains the most operationally difficult stage and the one where law enforcement has historically had the most success. The two primary integration vectors are OTC broker networks (examined in Finding 5) and crypto-to-fiat exchanges. For North Korea's Lazarus Group, the integration pathway is highly systematized: laundered USDT reaches networks of OTC brokers predominantly in China and Southeast Asia, who deposit equivalent fiat into DPRK-controlled bank accounts via Chinese UnionPay cards. [13][17] This final crypto-to-fiat step is the stage most resistant to blockchain analytics because it occurs off-chain, leaving no on-chain trace of the fiat deposit.

Layer 1: Cross-Chain Bridges

Cross-chain bridges are the foundational laundering tool of the current era, having supplanted mixers as the primary obfuscation mechanism in terms of volume. [3] Most bridges operate as permissionless smart contracts with no sanctions screening capability, processing assets in seconds across incompatible blockchain architectures. The most commonly exploited in 2025 include THORChain — a decentralized cross-chain liquidity protocol that supports Bitcoin-native swaps — Stargate Finance, and the Across Protocol. THORChain in particular became a documented Lazarus Group transit point for Bybit hack proceeds, processing hundreds of millions in stolen ETH before community governance debates attempted (unsuccessfully) to restrict certain transaction patterns. [9] The forensic challenge posed by bridges is distinctive: most blockchain analytics tools were built for single-chain tracing, and cross-chain state reconstruction requires integrating data from fundamentally different ledger designs. KYC-Chain's 2025 cross-chain AML solution documented tracing across 50+ blockchains as now a necessary compliance capability. [18]

Layer 4: No-KYC Instant Swap Services — The Critical Link

The no-KYC instant swap ecosystem is the most important and least-regulated layer of the 2026 laundering stack. These platforms — operating through bespoke websites, Telegram bots, and Tor onion sites — allow any user to swap one cryptocurrency for another in seconds, without creating an account or providing identity documentation. Elliptic identified at least $3.6 billion in illicit and high-risk funds processed through such services. [15]

The specific value of these services is the Bitcoin-to-Monero swap. Once Bitcoin is converted to Monero through a no-KYC instant swap, the on-chain trail for the original Bitcoin effectively ends: Monero's ring signatures, stealth addresses, and Ring Confidential Transactions make all transaction amounts and senders cryptographically private by default — not as an optional feature, but as a mandatory protocol property. [22] The April 2025 theft of 3,520 BTC ($330 million) illustrates the technique at scale: the attacker transferred the stolen Bitcoin in small increments across six or more instant exchanges before converting into Monero, causing XMR's price to spike 50% — an operational security failure caused by insufficient liquidity for the conversion size, but a forensically effective obfuscation nonetheless. [23][24]

The larger no-KYC swap infrastructure includes eXch (which processed Bybit-linked funds), ChangeNow, and StealthEx, discoverable through directories like KYCnot.me. Garantex, the Russian crypto exchange sanctioned in 2022, was seized by joint U.S.-EU action in 2025 — but five or more replacement services emerged within weeks, demonstrating the ecosystem's operational resilience. [21]

Layer 6: Lightning Network and Layer 2 Privacy

The Lightning Network presents a distinct forensic challenge that is qualitatively different from other layers. Off-chain payments within open Lightning channels are not broadcast to the Bitcoin blockchain and leave no direct on-chain record. Channel opening and closing transactions are visible, but routing of payments through multi-hop channels — encrypted using the SPHINX onion protocol — cannot be reconstructed by blockchain analytics tools without access to channel gossip data. [25] The EU Innovation Hub for Internal Security formally flagged Lightning and other Layer 2 solutions as potential money laundering vectors, and the IRS contracted private researchers to develop Lightning tracing capabilities. [25] Currently, 35% of illicit transactions are estimated to slip through traditional analytics tools in the Layer 2 context. [25]

North Korea's Lazarus Group — The State-Sponsored Benchmark

The Lazarus Group, designated by the U.S. Government under the aliases TraderTraitor and APT38, is by any measurable standard the most prolific cryptocurrency theft and laundering operation in the world. The group has stolen approximately $6.75 billion in cryptocurrency across its documented operational history, with $2.02 billion taken in 2025 alone. [10][17]

The Bybit attack — confirmed by the FBI in February 2025 — represents the apex of state-sponsored crypto theft methodology. Rather than exploiting a vulnerability in Bybit directly, attackers compromised the development environment of Safe{Wallet}, a third-party multi-signature wallet provider used by Bybit. A single developer's laptop was compromised; malware modified the transaction signing interface in real time, displaying a normal internal transfer on screen while secretly routing the signed transaction to attacker-controlled wallets. [9][13] This supply chain attack — targeting a trusted intermediary rather than the primary target — represents a methodological evolution beyond direct exchange exploitation.

The subsequent laundering followed a structured multi-wave workflow spanning approximately 45 days. Wave 1 (Days 0–5): ETH dispersed through DeFi protocols, DEXes, and cross-chain bridges. Wave 2 (Days 6–10): funds routed through instant swap services and bridged to Bitcoin. Wave 3 (Days 20–45): assets routed to OTC brokers for fiat conversion through Chinese financial networks. [13][17] The April 2026 KelpDAO hack ($290M, preliminary Lazarus indicators) showed the same supply-chain methodology adapted to a DeFi protocol context: attackers exploited a vulnerability enabling synthetic collateral minting, then drained lending pools before initiating the same 45-day laundering workflow. [27]

The group has also developed a parallel intelligence collection operation: impersonating recruiters for Web3 and AI firms on LinkedIn, running fake technical interview processes that deploy credential-harvesting malware — using those credentials to penetrate exchange internal systems without a conventional network intrusion. [17]

Ransomware Operators

Ransomware operators represent a different model: monetizing access to encrypted victim data through Bitcoin or Monero payments, then laundering proceeds through cryptocurrency infrastructure. The RaaS model distributes laundering capabilities across affiliates with varying technical sophistication. Total ransomware payments fell to $820 million in 2025 despite a 50% increase in claimed incidents. [11] Ransomware proceeds are typically laundered through instant swap services (converting BTC to XMR), no-KYC exchanges, and OTC brokers with a preference for Russian-language services in jurisdictions outside OFAC reach. The typical holding period before laundering is 2–6 months, as operators wait for law enforcement attention to diminish. [11]

Independent Hackers

Independent actors are the most forensically visible category because they typically lack the operational security discipline of organized groups. The April 2025 $330M BTC theft — attributed by ZachXBT to an independent actor — illustrates both the capability and the operational security failures of non-state hackers. The attacker demonstrated awareness of and access to the current tooling stack, executing a large-scale Bitcoin-to-Monero conversion through instant swap services. However, the conversion scale was so large relative to Monero's daily liquidity that it caused a 50% XMR price spike, attracting immediate on-chain investigator attention — a mistake a more disciplined organization would have avoided through time-distributed laundering. [23][24]

Scale and Structure

Chinese-language money laundering networks (CMLNs) processed $16.1 billion in illicit cryptocurrency in 2025 — approximately $44 million per day across 1,799 or more active wallets identified by Chainalysis. [4][28] This represents roughly 20% of all documented illicit crypto laundering volume globally over the past five years, making CMLNs the single largest segment of the off-chain integration infrastructure. [28]

These networks operate openly on messaging platforms, primarily Telegram, using guarantee services — escrow-like platforms that mediate anonymous OTC transactions. Huione Guarantee, based in Cambodia, was designated by FinCEN as a primary money laundering concern in 2025, with the agency documenting that Huione facilitated at least $4 billion in illicit fund laundering between 2021 and January 2025. [4][29] Despite enforcement, vendors formerly using Huione migrated to alternative platforms within weeks, with operations continuing essentially uninterrupted — demonstrating the structural resilience of the CMLN ecosystem. [29]

Operational Model and Tron as Settlement Layer

The operational model functions as follows. Laundered stablecoin proceeds — typically Tether (USDT) on the Tron blockchain, chosen for near-zero transaction fees and high liquidity — arrive at OTC broker wallets from the crypto-side of the laundering pipeline. [4] The OTC broker, verified through the guarantee platform, accepts the USDT and deposits equivalent fiat into a designated bank account via Chinese domestic banking or UnionPay card transactions. [13][17] The demand side is often legitimate: Chinese businesses needing USDT for cross-border trade provide commercial cover for the illicit supply side.

This model is resistant to blockchain analytics because the critical fiat conversion occurs entirely off-chain. Investigators can trace USDT to an OTC broker wallet but cannot see the fiat transfer on the other side — requiring subpoena of Chinese financial institutions through an MLAT mechanism that does not currently cover crypto-related financial crimes at adequate speed or scope. [4][28] Tron-based USDT has become the de facto settlement currency of the illicit OTC economy because Tron transactions finalize in approximately 3 seconds at under $0.001 per transaction — the most cost-efficient stablecoin settlement option available. [6]

The Technique

Traditional smurfing — breaking large transactions into amounts below regulatory reporting thresholds — has been a known money laundering typology for decades. Agentic smurfing adds automation, scale, and multi-chain coordination that would be operationally impossible for human operatives. GNET documented this pattern in terrorist financing contexts in January 2026, naming the technique after its combination of AI agency with the classical smurfing approach. [5]

AI agents autonomously generate disposable wallet addresses using SDK toolkits that create unique addresses without centralized control, defeating address-based blacklisting. [5] Funds are then fragmented into micro-transfers in the $50 to $500 range — deliberately below the FATF Travel Rule threshold ($1,000) and FinCEN's cash transaction reporting threshold ($10,000). A $100,000 stolen fund pool can thus be dispersed into 2,000 or more separate transfers across multiple days, chains, and asset types, each wallet used once and abandoned. The economic logic is compelling: the analyst-time cost of manually tracing 2,000 micro-transactions across multiple blockchains easily exceeds the value of the assets being traced — inverting the traditional economics of blockchain investigation in which small transactions were self-defeating due to obfuscation costs. [5]

GNET documented this pattern in the context of ISKP and Hamas-affiliated financing, whose estimated monthly cryptocurrency revenues of $25,000 to $100,000 were being laundered through autonomous agent-driven micro-transaction networks by January 2026. [5] The same pattern has subsequently been identified in non-political criminal contexts, suggesting diffusion beyond extremist financing use cases.

Detection Challenges and the AI Arms Race

Current AML detection systems were largely designed to flag transactions above reporting thresholds — a threshold-based model that agentic smurfing specifically exploits. Behavioral clustering — detecting the pattern of many small transfers from related wallets — is technically possible but computationally expensive at the transaction volumes generated by autonomous agents, which can generate tens of thousands of micro-transactions within 24 hours. [5][30]

Lucinity and AnChain.ai have published research on deploying agentic AI for AML defense — using AI agents that continuously monitor the transaction graph for smurfing patterns at scale. [30] This represents an emerging "AI versus AI" dynamic in which offensive autonomous laundering agents are countered by defensive AI agents operating on blockchain intelligence platforms. The balance of advantage in this dynamic is contested as of April 2026.

The Blockchain Analytics Industry

The blockchain analytics industry — dominated by Chainalysis, Elliptic, and TRM Labs — represents the primary technical countermeasure to cryptocurrency laundering. These platforms combine on-chain transaction data with off-chain intelligence to build clustered wallet attribution models that assign probabilistic identities to wallet addresses. [31]

Chainalysis Reactor processes wallet relationships across its proprietary cluster database to identify when funds from known illicit sources flow through new wallets — flagging risky funds even after multiple layers of laundering. TRM Labs covers over 100 blockchains and 200 million assets with real-time risk scoring and cross-chain tracing. Elliptic processes 300 million compliance screenings per quarter, offering "Holistic Screening" that traces asset provenance across multiple blockchains within milliseconds. [31] Major exchanges including Binance, Coinbase, and Kraken license these platforms and automatically freeze accounts receiving funds from flagged addresses — creating a meaningful barrier at the point where laundered crypto attempts to re-enter the KYC-compliant exchange ecosystem.

Law Enforcement Successes and Structural Limits

Law enforcement has demonstrated that blockchain tracing can support successful intervention, particularly when stolen funds reach KYC-compliant exchanges. The 2022 recovery of approximately $3.6 billion in Bitcoin from the Bitfinex hack — the largest single asset seizure in DOJ history at the time — showed that patient, multi-year tracing can yield results. [32]

However, the structural asymmetry of blockchain investigation limits the practical seizure rate to well under 1% of illicit cryptocurrency. North Korean DPRK actors have successfully laundered and converted to fiat the majority of their $6.75 billion in lifetime theft despite being the most intensively tracked criminal cryptocurrency actors in the world. [17] The enforcement challenge is specifically concentrated at the integration stage: the technical capability to trace funds on-chain is advancing rapidly, but the legal and diplomatic capability to intervene at fiat conversion — which occurs in jurisdictions often hostile to U.S. law enforcement requests — is not advancing at comparable speed. [4][28]

The Structural Shift: From Mixers to the Bridge-Swap-OTC Stack

The defining structural shift in cryptocurrency laundering between 2022 and 2026 is the replacement of mixers — centralized or semi-centralized services that commingle funds — with a decentralized, modular stack built around bridges, DEXes, instant swaps, and OTC brokers. This shift was partly driven by enforcement pressure on mixers (Tornado Cash sanctions, Chipmixer seizure, Sinbad sanctions), but more fundamentally by the maturation of DeFi infrastructure that provides equivalent or superior obfuscation in a permissionless, decentralized form that is significantly harder to sanction or seize. The architecture of the problem has changed from "identify and shut down the mixing service" to "address an open-source, decentralized protocol ecosystem." The mixer model required a centralized operator who could be arrested. The bridge-swap-OTC model distributes the equivalent function across smart contracts, peer-to-peer networks, and informal OTC brokers in foreign jurisdictions — each component resilient to disruption of any single element, as demonstrated by Garantex's replacement within weeks of its 2025 seizure. [21]

Stablecoin Dominance Reshapes the Problem

The dominance of stablecoins in illicit transaction volume — 84% of the total in 2025 — reflects both the growth of stablecoins in legitimate crypto activity and their specific utility in the integration stage. [6] Tron-based USDT's combination of speed, cost, and liquidity has effectively made it the "reserve currency" of the illicit OTC economy. This creates a specific policy lever: engagement with stablecoin issuers on proactive blockchain-level freezing capabilities and transparency standards could meaningfully disrupt the settlement layer of the laundering stack — a lever that does not exist for decentralized bridges or privacy coins.

The Geopolitical Dimension

Cryptocurrency laundering is increasingly entangled with geopolitical conflicts in ways that complicate enforcement. North Korean cryptocurrency theft directly funds weapons development under active UN sanctions, making it a national security rather than purely financial crime matter. [10][17] Russian entities' 694% surge in crypto-based sanctions evasion reflects deliberate state-level use of crypto infrastructure to circumvent financial warfare. [6][7] The Chinese OTC broker networks providing fiat integration to criminal actors globally operate in a legal and diplomatic environment where U.S. law enforcement leverage is limited and declining. The intersection of cryptocurrency crime with great-power geopolitics means that technical solutions — however sophisticated — face a ceiling defined by diplomatic reality.

For Security Practitioners at VASPs and Exchanges

The most immediate defensive gap is the interval between compromise and laundering — which, as Bybit demonstrated, can be minutes. Exchanges should implement real-time, automated freeze capabilities for large outbound transfers exceeding statistical norms, with human review triggered before final execution. The supply chain attack vector requires extending security review and continuous monitoring to the full software supply chain, including third-party wallet and custody software providers.

Cross-chain tracing capability is now a baseline compliance requirement. Reliance on single-chain analytics tools that cannot follow funds across bridges creates forensic blind spots actively exploited by sophisticated actors. Investment in multi-chain analytics platforms with cross-chain bridge coverage should be treated as compliance necessity rather than optional upgrade.

For Policymakers and Regulators

The no-KYC instant swap ecosystem represents the clearest regulatory gap in the current framework — a category of service providing the functional equivalent of a mixer without exchange licensing. Extending Travel Rule and KYC obligations to instant swap services, including through pressure on app stores and hosting providers, would meaningfully disrupt the layering stage. Engagement with stablecoin issuers on proactive freezing protocols for identified illicit addresses should be systematized and accelerated. The Chinese OTC broker network problem requires a diplomatic track: bilateral engagement with China's financial intelligence unit on shared identification of USDT-to-fiat OTC flows linked to documented illicit cryptocurrency would require political will but could materially impact the integration stage.

For Blockchain Intelligence Analysts

Monitoring for agentic smurfing requires behavioral graph analysis at the micro-transaction level, not threshold-based alerting. Analytical platforms should be tested against synthetic agentic smurfing datasets to assess detection rates before such campaigns are encountered in production. The "many small transactions from related wallets on multiple chains within 24 hours" signature is detectable with current tooling but requires explicit model development and ongoing retraining as AI-driven laundering techniques evolve.