A report by Chainalysis analyzes the status of money laundering, methods, statistics, and information related to cryptocurrency money laundering activities in 2023.
Overview of Cryptocurrency Money Laundering in 2023
The process of money laundering and illegal activities within the cryptocurrency space has become one of the key issues and challenges in global societies. Recent reports and analyses indicate an increase in such money laundering activities within the global economy. This article discusses the latest report published by the reputable site Chainalysis, which analyzes the status, methods, statistics, and information related to cryptocurrency money laundering activities in 2023, offering a direct comparison with data from previous years.
Table of Contents
Money laundering aims to conceal the criminal origin of funds so they can be easily accessed and spent. In the context of cryptocurrency-related crimes, this generally means transferring funds to services that can convert them into fiat money. However, most of these actions are undertaken to hide financial sources. Thus, this report focuses on cryptocurrency money laundering in two separate groups of services and entities within the blockchain ecosystem:
Intermediary Services and Wallets:
This group includes personal wallets, mixers, instant converters, various DeFi (Decentralized Finance) protocols, and other legal and illegal services. Cryptographic criminals typically use services in this category to store funds or conceal the criminal origin of their funds, often by hiding the chain link between the source wallet address and their current address.
It should be noted that in the cryptocurrency field, “mixers” refer to services that are used to maintain privacy and hide cryptocurrency transactions. These services mix or combine digital currencies from one transaction to another, making exchanges untraceable by individuals. While mixers are used to enhance privacy and prevent the tracking of cryptocurrencies, some individuals also use them for illegal activities like money laundering or other criminal acts.
Fiat Off-Ramping Services:
This category includes services that allow digital currencies to be converted into fiat money, with centralized exchanges being the most common. Generally, fiat off-ramping services refer to activities conducted without using fiat currencies like the dollar or euro. These services include converting national currencies into digital currencies, buying and selling cryptocurrencies, exchanging one cryptocurrency for another, sending and receiving digital currencies, conducting financial transactions with cryptocurrencies, and offering blockchain-based financial services. Cryptocurrency exchanges, exchange platforms, digital wallets, fintech companies, and other financial service providers provide these services. This group can also include peer-to-peer (P2P) exchanges, betting platforms, and cryptocurrency ATMs. Additionally, this process includes nested services that use centralized exchange infrastructure to make fiat off-ramping possible, such as many OTC (Over-the-Counter) trade desks.
It is important to note that all these services have different capabilities and options for combating money laundering. For example, centralized exchanges have far more control over this issue, as they can block funds from suspicious or illegal sources. In contrast, DeFi protocols generally lack this option because they operate independently and typically do not assume responsibility for users’ funds. However, the decentralized nature of DeFi protocols also means that blockchain analysts can generally track funds moving through DeFi protocols to their next destination. This situation does not hold true for centralized services. Moreover, illegal services that deliberately facilitate money laundering can only be stopped through law enforcement operations or other legal processes. Token issuers can also play a positive role in this area. For example, stablecoins like Tether (USDT) and USD Coin (USDC) have features that allow them to freeze assets held by addresses linked to criminal activities.
With this in mind, let’s review the key trends in cryptocurrency money laundering in 2023.
Cryptocurrency Money Laundering in 2023: Key Trends
In 2023, illegal addresses transferred the equivalent of $22.2 billion in cryptocurrency for payment services, reflecting a significant decrease compared to the $31.5 billion transferred in 2022. Part of this decline can be attributed to the overall reduction in cryptocurrency transaction volume, both legal and illegal. However, the decline in money laundering activities has been more pronounced, showing a 29.5% decrease compared to the 14.9% decrease in the total volume of transactions.
Overall, centralized exchanges have remained the primary destination for funds transferred from identified illegal addresses, maintaining a consistent pattern over the past five years. Over time, the role of illegal services has diminished, while the share of illegal funds flowing into DeFi protocols has increased. This trend can largely be attributed to the overall growth of DeFi during this period. However, it is also important to note that the inherent transparency of DeFi generally makes it a weak choice for concealing and complicating the tracking of fund transfers.
The year 2023, in terms of the breakdown of the types of services used for money laundering, was similar to 2022, but with a slight decrease in the share of illegal funds used for illegal services. Furthermore, the funds used for services like betting platforms and blockchain bridge protocols for transferring cryptocurrencies between different blockchain networks saw a slight increase.
However, a more detailed and nuanced look at the chart showing how money laundering activities in the cryptocurrency space have evolved reveals a significant increase in the volume of funds sent to cross-chain bridges from addresses linked to stolen funds—a trend we will explore further in detail later. There has also been a noticeable increase in funds sent from ransomware attacks to betting platforms and funds transferred to bridges from ransomware wallets.
Focus of Money Laundering on Fiat Off-Ramping Services
Fiat off-ramping services are a critical area in the process of money laundering, as criminals can easily convert their digital currencies into cash, marking the peak of the money laundering process. While thousands of off-ramping services are operating, most money laundering activities are concentrated on a few selected services. Of the illegal funds transferred to unauthorized services in 2023, 71.7% were directed to just five services, a slight increase from 68.7% in 2022.
In this section, we delve deeper into the concentration of money laundering activities at the destination addresses. These destination addresses refer to the addresses in centralized services related to individual users. These addresses can be considered similar to bank accounts. Therefore, examining money laundering activities at the destination address level provides a better understanding of the individuals or nested services directly responsible for the majority of cryptocurrency money laundering activities.
Looking at the issue from this perspective, we can see that, despite the increased concentration of money laundering activities at the service provision level in 2023, these activities exhibited less concentration at the destination address level.
This chart shows the total amount of illegal cryptocurrency received by each destination address in 2023, categorized by the amount received. Each gray bar represents the number of destination addresses in a specific category, while each blue bar represents the total amount of illegal cryptocurrency received by all destination addresses in that category. For example, in the first category, 2,235,329 destination addresses received between $5 and $100 in illegal cryptocurrency, totaling $69.4 million in illegal funds.
In 2023, 109 destination addresses in exchanges each received more than $10 million in illegal cryptocurrency, with a total of $3.4 billion in illegal funds, showing a significant increase. In 2022, only 40 destination addresses received over $10 million, totaling less than $2.0 billion.
In 2022, only 542 destination addresses received more than $1 million in illegal cryptocurrency, totaling $6.3 billion. Notably, this figure represents over half of the total illegal value received by centralized exchanges that year. In 2023, 1,425 destination addresses received more than $1 million in illegal cryptocurrency, totaling $6.7 billion, accounting for only 46% of the total illegal value received by exchanges that year.
However, it is important to note that the concentration of money laundering activities varies depending on the type of criminal activity. For example, sellers of child sexual abuse material (CSAM) and ransomware operators show a much higher concentration in this regard. Specifically, only seven destination addresses account for 51.0% of the total value received from CSAM sellers via exchanges, while for ransomware operators, only nine addresses account for 50.3% of the share.
On the other hand, scams related to darknet markets (websites or platforms engaging in illegal activities) show much less concentration. Criminal activities related to cryptocurrency that exhibit higher concentration may be more vulnerable to law enforcement intervention, as their money laundering activities rely on relatively fewer services that can be disrupted.
Cryptocurrency criminals generally conduct their money laundering activities across a wider variety of services or destination addresses to better hide their activities from law enforcement and regulatory teams responsible for compliance and legal enforcement. Expanding money laundering activities across more addresses may also be a strategy to reduce the impact of blocking a single destination address for suspicious activity. Consequently, combating cryptocurrency crimes by targeting laundering infrastructure will require greater precision and understanding of activities across the blockchain, as these activities are now more dispersed than before.
A significant portion of cryptocurrency money laundering activities involves the straightforward actions of individuals who directly transfer their assets to cryptocurrency exchanges. In other words, these individuals do not employ complex methods or concealment strategies; they simply send their funds directly to exchanges to either convert them into other cryptocurrencies or use the exchanges for trade and exchange.
This can be observed in the Chainalysis Reactor chart, which relates to the iSpoof phone number fraud service, which is no longer active. This service succeeded in defrauding over £100 million before being shut down by law enforcement. In this money laundering activity, millions of Bitcoin (BTC) were directly sent to a group of deposit addresses in a centralized exchange.
However, cryptocurrency criminals involved in more complex blockchain money laundering activities, such as North Korean cybercriminals linked to hacker groups like the Lazarus Group, use a broader range of services and protocols.
We will now take a look at two important methods used by these cybercriminals to conduct their money laundering strategies, using Lazarus Group as an example:
- Use of a New Mixer After the Seizure of the “Sinbad” Mixer and OFAC (Office of Foreign Assets Control) Sanctions: This refers to a new mixer service used to hide cryptocurrency transactions by mixing and combining transactions.
- “Chain Hopping via Cross-Chain Bridges”: This refers to using blockchain bridges between different blockchain networks. When cryptocurrencies are transferred from one blockchain network to another, this process is known as chain hopping. Blockchain bridges allow cryptocurrencies and assets to be transferred quickly and with minimal cost between blockchain networks.
We will now examine both methods in detail.
YoMix: A New Mixer Taking Over Sinbad’s Role
According to a report provided by Chainalysis, 2023 saw a decrease in the funds sent to mixers from illegal addresses, dropping from $1.0 billion in 2022 to $504.3 million in 2023.
This shift is attributed to sanctions and the shutdown of the Sinbad Mixer in November 2023 due to law enforcement and regulatory actions. However, cybercriminal groups, such as the Lazarus Group, adapted by turning to their own mixers. As noted in the previous year’s cryptocurrency crime report by Chainalysis, Sinbad became a preferred mixer for North Korean hackers in 2022, immediately after the Tornado Cash mixer was sanctioned. Since Sinbad’s shutdown, the Bitcoin-based YoMix mixer has taken over as an alternative service. The chart below shows the wallet addresses associated with the activities of North Korean hackers who now receive funds through YoMix and have previously used Sinbad.
Overall, YoMix saw significant growth in 2023, with incoming transactions increasing more than fivefold throughout the year.
According to Chainalysis data, nearly one-third of all YoMix’s inputs came from wallets associated with cryptocurrency hacks. The growth of YoMix and its adoption by the Lazarus Group is a prime example of how cybercriminals can adapt and find alternative obfuscation services when previous popular services are shut down.
Use of Cross-Chain Bridges
Cross-chain bridges allow users to transfer funds from one blockchain to another. In general, anyone can access these smart contracts, and since all activities occur on the blockchain, blockchain analysts can trace funds moved through these bridges. No centralized entity takes responsibility for funds transferred via bridges.
As previously discussed, the use of blockchain bridges for money laundering purposes by cybercriminals grew significantly in 2023, especially among cryptocurrency thieves.
In total, blockchain bridges received $743.8 million in cryptocurrency from illegal addresses in 2023. This is a significant increase compared to 2022, where only $312.2 million was transferred via bridges.
North Korean hackers were among those who made the most use of blockchain bridges for their money laundering activities. An example of such activity is shown in the chart below.
According to the chart, funds related to the Harmony hack that occurred in 2022 were transferred in May 2023 to a popular blockchain bridge. The transfer moved from the Bitcoin blockchain to the Avalanche blockchain. The funds were then exchanged for a stablecoin and subsequently moved from Avalanche to the Tron blockchain using a different protocol.
Cybercriminals Continuously Adapt
The changes in money laundering strategies seen in cryptocurrency criminals like the Lazarus Group serve as a vital reminder that the most sophisticated perpetrators of illegal activities always adapt their money laundering strategies to the prevailing conditions, making use of new types of cryptocurrency services. Law enforcement and regulatory teams responsible for compliance and legal enforcement can improve their effectiveness by studying these new money laundering methods and understanding the blockchain patterns associated with them.
