AML/CFT Risks in Crypto: How Financial Crime Works and How to Detect It
According to AMLBot's Crypto Crime Report 2025â2026, based on the analysis of 2,500+ real post-incident investigations, 65% of crypto crime cases were driven by Social Engineering rather than Technical Exploits. Investment Scams accounted for 25% of all cases by volume, followed by Phishing (18%) and Device Compromise (13%).
The data confirms that modern crypto crime has entered a sustained operational phase â losses are driven less by isolated vulnerabilities and more by persistent exploitation of trust, access, and process gaps.
At the macro level, the picture is equally stark. Industry-wide estimates place illicit on-chain activity for 2024 at over $40 billion, with revised figures expected to exceed $51 billion once delayed attribution is complete. By mid-2025, over $2.17 billion had already been stolen from crypto platforms â surpassing the total for all of 2024. Stablecoins now account for the majority of all illicit transaction volume, and state-linked actors have become dominant drivers of on-chain financial crime.
These are not abstract compliance risks. They are operational realities that crypto businesses encounter in their transaction flows every day â through exposure to addresses linked to fraud, sanctions evasion, ransomware, or terrorism financing. The question for any business processing virtual asset transactions is not whether illicit funds will interact with its platform, but how quickly it can identify that interaction when it occurs.
This article examines how financial crime schemes operate in practice on-chain, why certain structural features of crypto make the ecosystem attractive for illicit use, and how businesses detect and respond to AML/CFT risks using transaction monitoring, blockchain analytics, and risk scoring systems.
Why Crypto Is Attractive for Financial Crime
Crypto does not cause financial crime. But several structural characteristics of blockchain-based value transfer create conditions that criminals exploit â often more efficiently than through traditional financial channels.
- Pseudonymity. Blockchain transactions are recorded publicly, but they are associated with wallet addresses â not verified identities. Without KYC at the point of account creation, an address can be created and used without linking to any natural person. This decoupling of identity from transaction activity is the foundational feature that enables money laundering on-chain.
- Speed and Finality. Crypto transfers settle in seconds to minutes, depending on the blockchain. Unlike traditional wire transfers, which pass through intermediary banks with compliance checkpoints, on-chain transfers move directly from sender to recipient. This speed allows illicit actors to move funds through multiple wallets or chains before compliance teams can react.
- Global Reach without Borders. A wallet on Ethereum, TRON, or Solana can receive funds from any jurisdiction, at any time, without the sender needing to pass through a correspondent banking network. This borderless nature means that illicit funds can leave one jurisdiction and arrive in another in a single transaction, bypassing the geographic controls that traditional financial systems rely on.
- Regulatory Fragmentation. As of the FATF's 2025 Targeted Update, 75% of assessed jurisdictions remain only partially compliant or non-compliant with Recommendation 15. This means that large portions of the global crypto ecosystem operate in jurisdictions with weak or non-existent AML supervision â creating regulatory arbitrage opportunities for illicit actors who can route funds through under-regulated services.
(Source: FATF, Targeted Update on Implementation of the FATF Standards on VA and VASPs, June 2025)
None of these characteristics are inherently criminal. Pseudonymity also protects user privacy. Speed benefits legitimate commerce. Global reach enables financial inclusion. But when combined with weak compliance infrastructure, these features create an environment where illicit funds can move with minimal friction.
How Money Laundering Works in Crypto
Money laundering through cryptocurrency follows the same three-stage model that applies to traditional financial crime â placement, layering, and integration â but the specific techniques used at each stage exploit the unique properties of blockchain infrastructure.
Placement
Placement is the stage at which illicit funds first enter the financial system. In the crypto context, this typically means converting criminally derived fiat currency into virtual assets, or receiving virtual assets directly as the proceeds of crime (as in the case of ransomware payments, darknet market proceeds, or theft).
Common Placement Methods Include:
- Purchasing Crypto through low-KYC or no-KYC Exchanges â particularly peer-to-peer (P2P) platforms and exchanges operating in jurisdictions without effective AML enforcement. These services allow users to purchase virtual assets with cash, bank transfers, or other payment methods without robust identity verification.
- Crypto ATMs with Weak Compliance Controls â physical kiosks that convert cash to crypto, which have been identified in multiple enforcement actions as entry points for illicit funds.
- Direct Receipt of Criminal Proceeds â ransomware operators, darknet vendors, and theft perpetrators receive virtual assets directly as payment for illicit goods or services, bypassing the fiat-to-crypto conversion step entirely.
- Structured Deposits â splitting large amounts into multiple smaller transactions across different wallets or exchanges to avoid triggering monitoring thresholds (a technique known as "structuring" or "smurfing").
At the placement stage, funds are at their most identifiable. The link between the criminal activity and the on-chain transaction is at its shortest. This is where effective onboarding controls â including KYC, source-of-funds verification, and initial risk assessment â provide the highest detection value.
Layering
Layering is the process of obscuring the connection between illicit funds and their origin. In the crypto context, this is where the most technically sophisticated techniques are deployed. The objective is to create enough transactional complexity that tracing the funds back to their source becomes operationally difficult â or prohibitively expensive â for compliance teams and investigators.
Common Layering Techniques on-chain Include:
- Rapid Multi-Wallet Transfers ("Peel Chains"). Funds are sent through a sequence of wallets, with each transaction "peeling off" a portion of the total before forwarding the remainder. This creates a chain of dozens or hundreds of addresses, complicating manual tracing.
- Mixing and Tumbling Services. Crypto mixers pool funds from multiple users and redistribute them, breaking the deterministic link between input and output addresses. Services like Tornado Cash (sanctioned by OFAC in August 2022) use cryptographic techniques (zero-knowledge proofs) to sever on-chain traceability.
- Cross-Chain Bridging. Funds are moved from one blockchain to another using bridge protocols â for example, from Ethereum to TRON, or from a Layer 1 chain to a Layer 2 network. Each bridge transfer breaks transaction continuity, as the asset is burned on the source chain and minted on the destination chain under a different transaction hash.
- Token Swaps Through Decentralized Exchanges. Converting between different virtual asset types (e.g., ETH to USDT to DAI) through DEX liquidity pools creates additional layers of transactional complexity without passing through a centralized, KYC-compliant intermediary.
- Use of Privacy-Enhancing Protocols. Beyond traditional mixers, protocols like Railgun and zkBOB use zero-knowledge proofs to shield transaction details while allowing users to interact with DeFi services. These tools serve legitimate privacy functions but are also used in laundering workflows.
The FATF's 2025 Targeted Update specifically noted the continued growth in stablecoin use by illicit actors and the increasing professionalization of laundering infrastructure, including networks providing "Laundering-as-a-Service" operations with dedicated customer support and quality assurance mechanisms.
Integration
Integration is the final stage, where laundered funds re-enter the legitimate economy in a form that appears clean. In the crypto context, integration typically involves:
- Off-Ramping Through Compliant Exchanges. After sufficient layering, funds are deposited into a centralized exchange with KYC controls and converted to fiat currency â often through accounts created with synthetic or stolen identities.
- Purchasing High-Value Goods or Services. Virtual assets are used to buy real estate, luxury goods, or other assets that store value and can later be resold for clean fiat. OTC desks and P2P marketplaces are commonly used as intermediaries.
- Investment in Legitimate Businesses. Laundered funds are channeled into startups, token projects, or DeFi liquidity pools, generating returns that carry no visible connection to the original criminal activity.
- Stablecoin Conversion and Settlement. Funds that have been layered across multiple chains and token types are consolidated into stablecoins (typically USDT on TRON) and used for cross-border payments or held as stable-value reserves.
At the integration stage, the effectiveness of detection depends almost entirely on the quality of upstream monitoring. If placement and layering were not flagged, integration transactions will appear indistinguishable from legitimate activity.
Terrorist Financing in Crypto: How It Differs from Money Laundering
While money laundering and terrorist financing (CFT) share common infrastructure on-chain, they differ in a fundamental way: money laundering conceals the origin of funds, while terrorist financing conceals the purpose.
In money laundering, the funds themselves are the proceeds of crime â generated by drug trafficking, fraud, ransomware, theft, or other predicate offenses. The objective is to make dirty money appear clean.
In terrorist financing, the funds may be entirely legitimate in origin. Charitable donations, business revenue, or personal savings can become instruments of terrorist financing the moment they are directed toward a designated individual, organization, or activity. The regulatory framework (CFT) is concerned not with where the money came from, but with where it is going and what it will be used for. In the crypto context, this distinction has practical consequences:
- Smaller Transaction Amounts. Terrorist financing transactions are often individually small â well below typical monitoring thresholds â but form part of a coordinated network of transfers.
- Crowdfunding and Donation Patterns. Illicit financing campaigns have used social media and messaging platforms to solicit crypto donations, directing contributors to wallet addresses that aggregate funds before forwarding them to operational actors.
- Geographic Indicators. Transactions involving addresses associated with conflict zones, FATF-identified high-risk jurisdictions, or sanctioned entities may indicate terrorist financing risk even when individual transaction amounts are low.
The FATF's 2025 Targeted Update highlighted the continued use of virtual assets by terrorist groups at unprecedented scales, including by Hezbollah, Hamas, and the Houthis, with Iranian proxy networks facilitating over $2 billion in on-chain activity for money laundering, illicit oil sales, and arms procurement. Detecting terrorist financing requires monitoring systems capable of identifying low-value, high-frequency patterns, mapping network connections between addresses, and cross-referencing against sanctions lists and geographic risk indicators â capabilities that go beyond simple threshold-based monitoring.
Common Crypto Crime Schemes
Beyond the three-stage laundering model, crypto financial crime encompasses a range of operational schemes that exploit specific features of blockchain infrastructure. Below are the most prevalent.
Scam and Fraud Networks
Crypto-related fraud remains the largest single category of illicit on-chain activity by volume. The FATF's 2025 update noted that industry estimates place approximately $51 billion in illicit on-chain activity relating to fraud and scams for 2024, with a significant growth in the professionalization of scam operations â including "scam-as-a-service" infrastructure and AI-powered social engineering.
(Source: FATF, Targeted Update on Implementation of the FATF Standards on VA and VASPs, June 2025, p.20)
Common Fraud Schemes in Crypto Include:
- Investment Scams ("Pig Butchering"). Long-term social engineering schemes in which victims are cultivated through romantic or professional relationships and gradually induced to invest in fraudulent crypto platforms. Industry data indicates a 40% year-over-year increase in these schemes in 2024.
- Phishing and Approval Exploits. Attacks that trick users into signing malicious smart contract approvals, granting the attacker permission to drain wallet balances. These attacks accounted for a significant portion of individual theft losses in 2024â2025.
- Rug Pulls and Exit Scams. Token projects that raise funds through liquidity provision or public sales, then abruptly withdraw all assets and abandon the project.
- Address Poisoning. Sending small transactions from addresses that visually resemble a victim's known contacts, hoping the victim will copy the wrong address for a subsequent high-value transfer.
Mixers and Obfuscation Tools
Crypto mixers â including both centralized mixing services and decentralized protocols like Tornado Cash â remain a primary tool for obscuring the origin of illicit funds. Mixers operate by pooling inputs from multiple users and redistributing them, breaking the deterministic link between sender and receiver addresses.
Despite OFAC's designation of Tornado Cash in August 2022, the protocol's smart contracts continue to operate autonomously on-chain. AMLBot's public Dune Analytics dashboard tracking stablecoin turnover through privacy protocols shows that significant volumes continue to flow through Tornado Cash, Railgun, zkBOB, and Hinkal â serving both legitimate privacy use cases and illicit laundering workflows.
(Source: AMLBot, Stablecoin Turnover in On-Chain Privacy Tools: Dune Dashboard, February 2026)
From a compliance perspective, any interaction with a mixer â even indirect exposure through intermediary wallets â raises the risk profile of a transaction. Blockchain analytics tools flag mixer interactions as high-risk indicators, and regulators expect VASPs to apply enhanced due diligence when such exposure is identified.
Cross-Chain Laundering
Cross-chain laundering exploits the fragmentation of blockchain ecosystems to break transaction traceability. When funds move from one chain to another through a bridge protocol, the on-chain link between the source transaction and the destination transaction is broken. The asset is burned on the source chain and minted on the destination chain under a new transaction hash â effectively starting a fresh trail.
2025 mid-year analysis confirmed that threat actors targeting crypto services made significant use of bridges for chain-hopping laundering. The technique is particularly effective because most compliance tools and internal monitoring systems are chain-specific: a monitoring system that covers Ethereum may not track the same funds after they bridge to TRON or a Layer 2 network.
Effective detection of cross-chain laundering requires analytics capabilities that span multiple blockchains and can reconstruct transaction flows across bridge transfers.
Use of Stablecoins in Illicit Flows
Stablecoins â particularly USDT on the TRON network â have become the dominant instrument for illicit crypto transaction volume. Data shows that stablecoins accounted for 63% of all illicit transaction volume in 2024, rising to 84% in 2025. The reasons are practical: stablecoins offer dollar-pegged stability, high liquidity, fast settlement, and broad acceptance across exchanges and OTC desks.
The Stablecoin Risk Landscape has Additional Dimensions:
- Sanctioned Entity Preference. Sanctioned individuals and entities often prefer stablecoins because they provide dollar-equivalent value without requiring access to the U.S. banking system. The FATF's 2025 update noted continued increases in stablecoin use by DPRK actors, terrorist financiers, and drug trafficking networks.
- Issuer Freeze Capabilities. Both Tether and Circle maintain the ability to freeze wallet addresses â a compliance mechanism that also introduces operational risk. AMLBot's research has identified a significant time lag between the initiation of a freeze and its on-chain enforcement, during which over $78 million in USDT was moved across TRON and Ethereum.
- TRON Network Concentration. A disproportionate share of illicit stablecoin activity occurs on the TRON blockchain, where lower transaction costs and higher throughput facilitate high-volume, low-friction fund movement.
(Source: AMLBot, Tether Freeze Gap Analysis, May 2025; AMLBot, Stablecoin Freezes 2023â2025: USDT vs USDC Analysis, January 2026)
Where AML Systems Fail in Crypto
Understanding how financial crime schemes work is only half the equation. The other half is understanding where detection systems fail â and why illicit funds pass through platforms undetected despite the availability of monitoring tools.
The Most Common Failure Points Include:
- Manual or Absent Transaction Monitoring. Many smaller VASPs still rely on manual review of individual transactions or have no automated monitoring in place. Manual processes cannot keep pace with the volume and speed of on-chain transactions. Alert backlogs, inconsistent review standards, and missed patterns are among the most common deficiencies identified in supervisory examinations.
- Single-Chain Monitoring Scope. Compliance systems that only monitor a single blockchain miss cross-chain laundering flows entirely. When funds bridge from Ethereum to TRON, a monitoring system scoped only to Ethereum will show the funds as having been withdrawn â not laundered.
- Static Rule-Based Systems. Monitoring systems that rely exclusively on fixed thresholds (e.g., flagging transactions above $10,000) are easily circumvented through structuring. Effective monitoring requires behavioral analysis â identifying patterns across multiple transactions over time, not just individual transfers.
- Fragmented Data and Siloed Compliance Functions. When KYC data, transaction monitoring alerts, and blockchain analytics are managed in separate systems without integration, compliance teams lack the unified view necessary to connect identity information with on-chain behavior. A wallet address flagged by an analytics tool is only actionable if it can be linked to a customer record.
- Delayed Sanctions List Updates. Sanctions designations are issued continuously. A screening system that checks against lists updated weekly or monthly may miss transactions involving newly designated addresses. Real-time or near-real-time sanctions data integration is a minimum effective standard.
These are not theoretical gaps. They are the specific deficiencies that regulators cite in enforcement actions and supervisory findings. Addressing them requires not only the right tools but the right operational integration between those tools and the compliance team's investigative workflow.
How Crypto Businesses Detect AML/CFT Risks
Effective detection of financial crime in crypto relies on three interconnected capabilities: transaction monitoring, blockchain analytics and tracing, and risk scoring with alert management.
Transaction Monitoring
Transaction monitoring is the operational backbone of any crypto AML program. It involves continuous, automated analysis of incoming and outgoing transactions to identify behavior consistent with known laundering typologies, fraud patterns, or sanctions exposure.
In the crypto context, effective transaction monitoring goes beyond fiat-equivalent threshold monitoring. It must incorporate:
- Counterparty Risk Assessment. Evaluating the risk profile of wallet addresses interacting with the platform â including exposure to known illicit services, mixers, sanctioned addresses, and high-risk jurisdictions.
- Behavioral Pattern Detection. Identifying sequences of transactions that match known money laundering typologies â such as rapid fund movement, structuring below reporting thresholds, dormant wallet reactivation, or cyclic transfer patterns.
- Real-Time Alert Generation. Producing actionable alerts as transactions occur, not in batch processes hours or days later. The speed of on-chain settlement means that a delayed alert may arrive after funds have already been withdrawn or bridged to another chain.
Blockchain Analytics and Tracing
Blockchain analytics tools allow compliance teams and investigators to trace the origin and destination of funds across multiple transactions, wallets, and â in advanced implementations â across multiple blockchains.
Core Capabilities of Blockchain Analytics Include:
- Wallet Clustering. Identifying groups of wallet addresses that are controlled by the same entity, based on transaction patterns, shared inputs, or other heuristic indicators.
- Fund Flow Visualization. Mapping the movement of funds through a chain of transactions, identifying intermediary wallets, mixer interactions, exchange deposits, and ultimate destinations.
- Attribution. Linking wallet addresses to known entities â including exchanges, services, sanctioned actors, darknet markets, and scam operations â using proprietary intelligence databases.
- Cross-Chain Tracing. Reconstructing transaction flows that span multiple blockchains, following funds through bridge protocols and wrapped token conversions to maintain investigative continuity.
Risk Scoring and Alerts
Risk scoring translates raw blockchain data into actionable compliance decisions. Every wallet address, transaction, and customer interaction is assigned a risk score based on a combination of factors:
- Direct Exposure. Whether the address has directly interacted with a known illicit entity, sanctioned address, or high-risk service (e.g., mixer, unregulated exchange, darknet market).
- Indirect Exposure. Whether the address has received funds that originated from â or passed through â a high-risk source within a defined number of transaction hops.
- Behavioral Indicators. Whether the address exhibits patterns consistent with known laundering techniques â such as peel chains, rapid consolidation and dispersal, or interaction with freshly created wallets.
- Geographic and Jurisdictional Risk. Whether the address or its counterparties are associated with high-risk jurisdictions identified by the FATF or subject to sanctions programs.
Effective risk scoring systems produce tiered alerts â differentiating between Low, Medium, High, and Critical Risk â and feed into documented investigation workflows that produce audit-ready records for regulatory examination.
Conclusion
Crypto financial crime is not random. It follows identifiable patterns, exploits specific structural features of blockchain infrastructure, and uses a defined set of techniques â from mixers and cross-chain bridges to stablecoin consolidation and scam-as-a-service platforms. These schemes are increasingly professionalized, operationally sophisticated, and backed by state-level resources.
Detection is not optional. For VASPs and other crypto businesses, the ability to identify, flag, and investigate suspicious activity is a regulatory obligation â and a business necessity. The schemes described in this article repeat across jurisdictions, across chains, and across time. The businesses that survive and maintain banking relationships, licenses, and customer trust are those that invest in the monitoring, analytics, and investigative infrastructure necessary to see these patterns in real time.
-AMLBot Team
FAQ
What does AML/CFT Mean in Crypto?
AML/CFT in crypto refers to detecting and preventing money laundering and terrorist financing using blockchain transactions. It focuses on identifying suspicious patterns rather than just enforcing regulations.
How does Money Laundering Happen in Crypto?
It happens in three stages: funds enter the system (placement), are moved across wallets and chains to hide origin (layering), and are later reused as clean funds (integration).
What is Layering in Crypto?
Layering is the process of moving funds through multiple wallets, exchanges, or blockchains to obscure their origin and make tracing more difficult.
How is Terrorist Financing Different from Money Laundering in Crypto?
Money laundering hides the source of funds, while terrorist financing focuses on how funds are used. Even legitimate funds can become illicit if used for prohibited activities.
Why is Crypto used for Financial Crime?
Crypto enables fast, global transfers with pseudonymous identities and limited friction, making it attractive for moving and hiding funds.
What are Common Crypto Financial Crime Schemes?
Common schemes include scams, mixer usage, cross-chain laundering, address obfuscation, and structured transaction flows designed to hide origin.
Can Crypto Transactions be Traced?
Yes. Most transactions are publicly recorded and can be analyzed using blockchain analytics, although obfuscation techniques can increase complexity.
How do Companies Detect AML/CFT Risks in Crypto?
They use transaction monitoring, blockchain analytics, and risk scoring systems to identify suspicious behavior and trace fund flows.
What Makes a Transaction Suspicious in Crypto?
Unusual transaction patterns, links to high-risk entities, rapid fund movement across wallets, and interaction with mixers or sanctioned addresses.
Are Mixers and Cross-Chain Tools Always Illegal?
No, but they are high-risk because they are frequently used to hide transaction origins and are closely monitored by compliance systems.