Global Probe Finds Illicit Crypto Moving in Patterns Across Major Exchanges

A series of investigations conducted by the International Consortium of Investigative Journalists (ICIJ) has found that illicit actors moved large amounts of crypto through exchanges, brokers, and cash-out services, with recurring patterns persisting even as some platforms operated under U.S. penalties and court-appointed monitors.

Dubbed “The Coin Laundry” ICIJ’s reporting points to a widening technical gap between what blockchains record and what investigators or platforms can meaningfully process.

The consortium reports that transfers routed through anonymous wallets or “swappers” make tracing slower and more resource-intensive, complicating efforts by exchanges and law enforcement to follow transactions in real time.

Former compliance staff at major platforms echoed the issue, telling ICIJ and The Toronto Star they could “hardly keep pace with savvy criminals.”

One of the most detailed cases involves Huione Group, a Cambodian financial institution labeled a “primary money laundering concern” by the U.S. Treasury in May.

ICIJ found that Huione “continued largely unabated” with routing significant volumes of Tether’s stablecoin USDT into customer accounts at Binance and OKX, even after the designation.

US Treasury Moves to Cut Off Cambodia’s Huione Group From Financial System Over $4B Laundering Claims

Between July 2024 to July 2025, more than $408 million moved from Huione to Binance accounts, including roughly one million dollars per day in July 2025, a period when Binance remained under two court-appointed monitors following its 2023 plea deal for anti-money-laundering violations.

At least $226 million flowed from Huione into OKX customer accounts between February and July 2025 after OKX pleaded guilty in the U.S. to operating an unlicensed money transmitter.

OKX pushed back on the implications of the investigation, saying it “welcomes scrutiny” of how exchanges address illicit finance but rejects the idea that crypto platforms function as havens for laundering.

“Where credible risks are detected, we act quickly, including pausing interactions, blocking transfers, and supporting criminal investigations,” a spokesperson told Decrypt.

The flows cited in the ICIJ reports “represent a very small fraction” of overall activity on the exchange, the spokesperson added.

KuCoin, one of the exchanges named in ICIJ’s investigations on crypto-to-cash storefronts, shared a statement with Decrypt saying it “operates a rigorous and continuously evolving AML/CTF program,” aligned with global regulatory expectations.

Decrypt has reached out to Tether, Binance, Coinbase, Kraken, and Bybit for comment and will update this article should they respond.

The findings arrive as global regulators continue to impose penalties on exchanges while struggling with uneven enforcement and limited cross-border coordination.

Ari Redbord, a former Treasury Department official and U.S. attorney now working as global head of policy at blockchain intelligence firm TRM Labs, told Decrypt their research and data shows repeating behavioral patterns in how illicit funds move across services, often involving “certain intermediaries, OTC brokers, or cross-chain services.”

“These patterns often reflect common laundering typologies rather than fixed or standardized ‘routing templates,” Redbord explained. “In other words, illicit actors frequently exploit the same weak compliance points or high-risk service providers, which can make flows appear structurally similar even when they are not centrally coordinated.”

Redbord said TRM’s analysis supports the view that laundering activity is networked rather than isolated, noting that illicit actors and facilitators interact through “overlapping transactional relationships that cross jurisdictions and asset types.”

Criminal Crypto Use Is Becoming ‘Increasingly Sophisticated’, Says Europol

Some groups, such as pig-butchering operations, cartel-linked brokers, and North Korean actors, show more “sustained coordination,” he said, while most others form “opportunistic linkages” built around “shared infrastructure or mutual convenience.”

“The recurring patterns we see are best understood as emergent behavior within an adaptive ecosystem—not a coherent operational structure,” Redbord said.