Since 2016, criminals have laundered $33 billion worth of illicitly-acquired cryptocurrency. The network of over-the-counter, peer-to-peer, and high-risk exchanges that facilitate this laundering—whether intentionally or unwittingly—is substantial and growing.
In this article, we analyze the main players in the ecosystem. But first, some definitions:
What is Crypto Money Laundering?
When a criminal accumulates of ill-gotten crypto, the first thing they have to ask themself is, “How can convert this without getting caught?” In almost every form of cryptocurrency crime, money laundering plays a central role.
In most cases, this entails either a) sending funds to a high-risk or unregulated crypto-to-fiat exchange, or b) using fraudulent or stolen identity documents to do the same at a regulated exchange. Token swapping is also increasingly common as a means to exchange less liquid cryptocurrencies into easily exchangeable ones.
Mapping the cryptocurrency laundering ecosystem
Thanks to the inherent transparency of blockchains, we can look at the cryptocurrency laundering ecosystem from a high level, drawing insights that are impossible to identify from analyses of traditional finance. Let’s start by examining the most common destinations of illicit funds over time.
While exchanges have always been a popular off-ramp for illicit cryptocurrency, they’ve taken in a steadily growing share since the beginning of 2019. Over the course of the entire year, we traced $2.8 billion in Bitcoin that moved from criminal entities to exchanges. Just over 50% went to the top two: Binance and Huobi.
Binance and Huobi lead all exchanges in illicit Bitcoin received by a significant margin. That may come as a surprise given that Binance and Huobi are two of the largest exchanges operating, and are subject to KYC regulations. How can they be receiving so much Bitcoin from criminal sources? Let’s start by looking at the specific accounts receiving illicit funds at both exchanges.
Overall, just over 300,000 individual accounts at Binance and Huobi received Bitcoin from criminal sources in 2019. Who’s behind those accounts? Are any of them significant traders? Below, we’ve broken those accounts down into buckets based on the total value of all Bitcoin they’ve received in 2019, with illicit Bitcoin called out (please note that due to the nature of how we connect illicit funds to specific addresses, this chart considers only $1.1 billion of the total $1.4 billion worth of illicit Bitcoin received by Binance and Huobi).
How to read this graph:
- The green bars represent the number of unique accounts in each bucket. Again, the buckets are based on the total amount of Bitcoin the accounts have received individually, from both criminal and non-criminal sources. All accounts shown have received at least some criminal funds.
- The yellow and red stacked bars show the total amount of cryptocurrency received collectively by all the accounts in each bucket. That means, for example, that the 31 accounts in the highest-earning bucket on the right-hand side have collectively received just over $8 billion worth of Bitcoin in 2019, and that each of those 31 accounts individually has received between $100 million and $1 billion worth.
- The red segment of the bars represents the amount of illicit Bitcoin received by all accounts in each bucket.
- The yellow segment represents the non-criminal funds received by the accounts in each bucket.
We can see from this graph that a small segment of these accounts is extremely active. The 2,196 accounts in the three highest-receiving buckets received a total of nearly $27.8 billion worth of Bitcoin in 2019. The graph also makes it clear that Bitcoin from criminal sources represents just a small fraction of the total amount received by Binance and Huobi. Nonetheless, the illicit funds shown above comprise a significant total value — the 31 accounts in the top-earning bucket alone received a total of over $163 million worth of Bitcoin from criminal sources in 2019.
Let’s look at another version of this chart where we only include funds that have come from accounts we know are connected to illicit activity (i.e. those represented in red above).
A small segment of accounts took in most of the illicit Bitcoin sent to Binance and Huobi. The 810 accounts in the three highest-receiving buckets took in a total of over $819 million in Bitcoin from criminal sources, representing 75% of the total. Who are the whales driving this activity?
Our analysis suggests that many are OTC brokers.
OTC (Over The Counter) brokers facilitate trades between individual buyers and sellers who can’t or don’t want to transact on an open exchange. OTC brokers are typically associated with an exchange but operate independently. Traders often use OTC brokers if they want to liquidate a large amount of cryptocurrency for a set, negotiated price. OTC brokers are a crucial source of liquidity in the cryptocurrency market. While it’s impossible to know the exact size of the OTC market, we know that it’s huge. Cryptocurrency data provider Kaiko even estimates that OTCs could facilitate the majority of all cryptocurrency trade volume.
The problem, however, is that while most OTC brokers run a legitimate business, some of them specialize in providing money laundering services to criminals. OTC brokers typically have much lower KYC requirements than the exchanges they operate on. Many of them take advantage of this laxity and help criminals launder and cash out funds, usually first by exchanging Bitcoin and other cryptocurrencies into Tether as a stable intermediary currency before they presumably cash out into fiat.
From our analysis of transactions by various criminal groups, we put together a list of 100 major OTC brokers we believe provide money laundering services, based on the fact that they’ve received large amounts of cryptocurrency from illicit sources. This is not an exhaustive list of corrupt OTC brokers; rather it is a sample we assembled based on our experience investigating money laundering over time. We’ll call them the “Rogue 100.”
70 of the OTC brokers in the Rogue 100 are in the group of Huobi accounts receiving Bitcoin from illicit sources. 32 of them are in the group of 810 accounts receiving the most illicit Bitcoin, and 20 of them received $1 million or more worth of illicit Bitcoin in 2019. In total, these 70 OTC brokers received $194 million in Bitcoin from criminal entities over the course of 2019. Interestingly, none of those 70 Rogue 100 accounts operate on Binance, though it’s possible some of them also have accounts there or on other exchanges as well.
Keep in mind, the Rogue 100 only represents OTC brokers we’ve manually identified as money launderers over the course of our investigations on behalf of Chainalysis clients. We think it’s extremely likely that some percentage of the other highly-active Binance and Huobi accounts taking in illicit funds also belong to corrupt OTC brokers we’ve yet to identify.
The Rogue 100 are extremely active traders and have a huge impact on the cryptocurrency ecosystem. They’ve received steadily increasing amounts of cryptocurrency each month since late 2017, but their activity skyrocketed this year. They received more than $3 billion worth of Bitcoin over the course of 2019, and many of them played a substantial role in the PlusToken scam we’ve discussed previously. Overall, the funds the Rogue 100 receive can account for as much as 1% of all Bitcoin activity in a given month.
By analyzing their transactions in Chainalysis Reactor, we can see how two corrupt OTC brokers take in funds from criminal sources.
On the far left, we see funds start at a criminal entity, move through an intermediary wallet, and then move to two OTC brokers, both of whom are on our Rogue 100 list. The OTC brokers then move the funds to Huobi, most likely to be converted to cash.
We can also see in Reactor that corrupt OTC brokers frequently transact with one another. Below is an example looking at three OTC brokers from the Rogue 100.
These may simply be transactions being executed on behalf of legitimate OTC clients. However, we know from our on-the-ground intelligence that money launderers and other criminals often execute large transactions with one another in attempts to “fool” blockchain analysis software like Chainalysis by artificially lowering their exposure to criminal wallets — this could be an example of that.
While it’s difficult to estimate what percentage of all cryptocurrency is sent from criminal wallets to OTC brokers, our analysis shows that OTC brokers who carry out a significant percentage of all Bitcoin transactions are receiving illicit funds, and behaving in ways that suggest a desire to hide the nature of their transactions.
What can the cryptocurrency industry do about OTC brokers and money laundering?
The money laundering infrastructure driven by OTC brokers enables nearly every other type of crime we cover in our Crypto Crime Report. After all, if there were no way for bad actors to cash out cryptocurrency they’ve received through illegal means, there’d be far less incentive for them to commit crimes in the first place. That would mean not only fewer victims affected by crimes, but would also help improve cryptocurrency’s reputation as the industry seeks to work with regulators and traditional financial institutions and drive increased adoption.
Luckily, there are steps that law enforcement agencies, regulators, and cryptocurrency businesses can take to start stamping out money laundering. It all starts with transparency. Money laundering, especially in the fiat world, is typically thought of as a black box one can only open and begin to understand by getting a search warrant and poring over a suspect’s bank records. But with blockchain analysis tools like Chainalysis, we can analyze transactions recorded on the blockchain and get insight into how criminals are laundering funds much faster, as we show above. Law enforcement agents and regulators need to become experts in this technology in order to start fighting money laundering in cryptocurrency.
We also call on exchanges to carry out more extensive due diligence on OTC brokers and other nested services operating on their platform. Most large exchanges, including Huobi and Binance, are already collecting KYC information on customers, as they’re required to do by law in most jurisdictions. Our analysis shows that they need to extend that scrutiny to OTC desks consistently over time and ensure the OTC desks have effective KYC processes on their customers in order to do their part in the fight against money laundering.
This blog was an excerpt from the Chainalysis 2020 Crypto Crime Report. To read more, download the full report. For more updated information, download the 2022 report.
A note from Binance
We shared this analysis with Binance prior to publishing this blog. Their Chief Compliance Officer Samuel Lim responded with the note below:
“Binance is committed to cleaning up financial crime in crypto and improving the health of our industry. We will continue to improve on our proprietary KYC and AML technology, as well as the third-party tools and partners we work with, to further strengthen our compliance standards.
One of our core values at Binance is to protect our users, whether it’s improving platform security or halting suspicious transactions. We recognize our ongoing responsibility to ensure the integrity of our platform and safeguard it from bad actors, including any traders or brokers providing money-laundering services. As global capital flows into crypto, we are aware of the growing trend and movements of illicit funds, and we are working with like-minded partners such as Chainalysis to improve on existing systems and address these concerns.
In every jurisdiction that we operate in, Binance is compliant and adheres to local regulations and KYC requirements. We have built trust among regulators, financial institutions and the public through our developments and values, and we will continue to raise the bar in addressing AML compliance to the highest standard and across the largest asset coverage.”