The crypto industry’s $36.6 billion in ‘dirty money’
Even as the crypto industry gains mainstream acceptance, at least $36.6 billion tied to illicit activity has flowed into crypto exchanges over the past two years.
Nov 24, 2025
NEW YORK - US President Donald Trump has started his own cryptocurrency business and vowed to make the US the world’s “crypto capital”.
Crypto companies have declared themselves safe and secure.
And a procession of major industries, from Wall Street banks to online retailers, have experimented with digital coins.
But even as the crypto industry gains mainstream acceptance, at least US$28 billion (S$36.6 billion) tied to illicit activity has flowed into crypto exchanges over the past two years, according to an examination by the International Consortium of Investigative Journalists (ICIJ), The New York Times and 36 other news organisations around the world.
The money came from hackers, thieves and extortionists.
It was traced to cyber criminals in North Korea and scammers whose schemes stretched from Minnesota to Myanmar.
Over and over, the analysis showed, these groups have moved money onto the world’s largest exchanges, which are online marketplaces where people can convert US dollars or euros into Bitcoin, Ether and other digital coins.
Among the recipients of this “dirty money” was Binance, the world’s biggest crypto exchange, which participated in a US$2 billion business deal with Mr Trump’s crypto firm in May.
The money also flowed into at least eight other prominent exchanges, including OKX, a global platform with a growing footprint in the US, according to the analysis.
“Law enforcement can’t cope with the overwhelming amount of illicit activity in the space,” said Ms Julia Hardy, a co-founder of zeroShadow, a crypto investigations firm. “It can’t go on like this.”
The early days of digital currencies were dominated by thieves and drug dealers, who were attracted by the speed and anonymity of crypto, which make it a useful vehicle for money laundering.
Bitcoin, the most popular virtual currency, underpinned dark web markets where merchants sold narcotics and other outlawed substances, leading to overdose deaths and criminal charges.
Since then, the crypto industry has grown exponentially and become professionalised, with billions of dollars a day in legitimate transactions.
The largest exchanges have pledged to crack down on criminals who use crypto to move funds.
Binance pleaded guilty to money laundering violations in 2023 and agreed to pay a US$4.3 billion penalty to the US government after processing transactions for terrorist groups including Hamas and al-Qaeda.
In 2024, it declared that the crypto industry was “an extremely unwelcoming place to bad actors”.
At the same time, Mr Trump has made crypto a cornerstone of his family business and ended a regulatory clampdown on the industry.
Shortly before the 2024 election, he and his sons founded
World Liberty Financial, a crypto start-up that is poised to generate tens of millions of dollars a year from the business deal involving Binance.
In October, Mr Trump
granted a pardon to Mr Zhao Changpeng, Binance’s founder, who had served a four-month term in prison after the company’s plea agreement.
The Trump administration has also weakened law enforcement’s ability to prosecute crypto crime.
In April, the Justice Department dismantled a crypto enforcement team, explaining that prosecutors should target terrorists and drug traffickers who use crypto, while eschewing cases against “the platforms that these enterprises utilise to conduct their illegal activities”.
The analysis by the Times and its colleagues provides only a partial window into illicit funds on exchanges, because many criminal accounts have not been publicly identified.
But it is one of the first systematic efforts to trace this money on specific platforms, which are rarely singled out by the analytics firms that collect the most comprehensive data.
Whether the exchanges have broken the law is a nuanced question.
Companies that process dirty money may still be fulfilling their legal responsibilities – by hiring compliance staff to root out fraud, for example.
But in the US, crypto firms have been prosecuted under the Bank Secrecy Act for failing to create robust internal systems to prevent money laundering.
The analysis relied partly on aggregate data that was assembled by Chainalysis, an analytics firm, and that did not identify specific exchanges.
The Times and the ICIJ also used public records and consulted with forensic experts to identify crypto accounts tied to criminals.
Crypto transactions are recorded on a public ledger, allowing the movement of funds to be traced to individual exchanges.
The findings included:
– Since Binance’s guilty plea, the exchange has received more than US$400 million in deposits from Huione Group, a Cambodian operation that the Treasury Department has flagged for criminal activity. An additional US$900 million flowed into Binance deposit accounts in 2025 from a platform that North Korean hackers were using to launder stolen funds.
– OKX received more than US$220 million in deposits from Huione in the five months after OKX struck a US$504 million settlement with the US government in February for violating a money transmission law.
– Crypto exchanges worldwide received at least US$4 billion linked to scams in 2024, according to data from Chainalysis. The Times and the journalist consortium interviewed two dozen victims of crypto scams whose stolen funds ended up on Binance, OKX and other large exchanges including Bybit and HTX.
– More than US$500 million flowed into Binance, OKX and Bybit in 2024 from “crypto-to-cash desks”, which allow people to trade digital coins for actual bills. Many of these businesses operate from offices or storefronts, serving various types of customers – and offering a convenient avenue for criminals who want to convert digital currencies into cash.
Ms Heloiza Canassa, a Binance spokeswoman, said that “security and compliance stand as utmost pillars” of the company’s operations and that it had responded to more than 240,000 law enforcement requests since its founding in 2017, including 65,000 in 2024.
Ms Linda Lacewell, OKX’s chief legal officer, said the company worked with law enforcement “to help stop fraud and other illicit activity” and invested heavily in compliance, transaction monitoring and fraud detection tools.
HTX representatives did not respond to requests for comment, and a Bybit spokesperson said the company enforced “a strict zero-tolerance policy towards financial crime”.
A White House spokesperson declined to comment, while a representative for World Liberty said the firm viewed Binance as a marketplace for its coins and not as a business partner.
What happens after dirty money reaches an exchange can be difficult to determine; at that point, the money trail is hidden from view.
Exchanges may catch illegal activity fast enough to freeze the funds or turn them over to law enforcement.
But dirty money that goes undetected can benefit an exchange by generating trading fees, typically a small percentage of the transaction.
“If they kick criminal actors off the platform, then that’s a big revenue source that they lose,” said Professor John Griffin, a crypto expert at the University of Texas, Austin. “They have an incentive to allow this activity to continue.”
The Binance connection
Huione Group has an extensive reach in Cambodia.
A financial conglomerate, it offers banking, payment and insurance services.
Customers use its QR codes to buy groceries and pay restaurant bills.
Those offerings conceal a more sinister enterprise.
For years, Huione has also run a vast digital marketplace that one expert has described as “Amazon for criminals”, where online merchants sell stolen personal data, tech support for scammers and money-laundering services.
The company has moved money for North Korean hackers and scam networks throughout South-east Asia, according to law enforcement.
In May, the Treasury Department moved to ban Huione from the US banking system, calling it a “critical node” for cyberheists and investment scams targeting Americans.
Throughout, Huione has maintained financial ties with Binance and OKX.
In a Chinese-language financial report in 2024, Huione published several of its crypto wallet addresses, long strings of letters and numbers that identify accounts on the public ledger of digital currency transactions.
An analysis of those wallets found that more than US$400 million flowed from Huione onto Binance’s platform from July 2024 to July 2025.
Over five months in 2025, OKX received more than US$220 million in deposits from the Huione wallets.
The flows continued even after the Treasury Department’s announcement on May 1.
The wallets deposited at least US$77 million into Binance over the next 2½ months and US$161 million into OKX, according to the journalist consortium’s analysis.
Binance and OKX previously had a record of flouting financial rules, leading to their criminal settlements with the US government. Both have promised to clean up their acts.
Ms Lacewell of OKX said that even before May, the company had applied “enhanced transaction monitoring” to one of the wallet addresses identified in Huione’s report.
The company “paused all interactions between OKX wallets and Huione” in October, she said.
Binance’s Ms Canassa said in a statement that the exchange could not block or reverse incoming transactions. But once suspicious deposits land on the platform, Binance reacts appropriately, she said.
“The true measures of compliance for a crypto exchange are the steps it takes to identify and react to suspicious deposits,” she said. “It is in these areas that Binance is an industry leader.”
Still, the Huione deposits continued for months. And those deposits were far from the only suspicious funds to flow into Binance after its US settlement.
In February, a North Korean hacking syndicate called the Lazarus Group stole US$1.5 billion of crypto from the Bybit exchange, which is based in Dubai, United Arab Emirates. It was the largest hack in crypto history.
Within days, the North Koreans routed the stolen funds to a crypto service that lets people swap one digital currency for another. They were converting Ether into Bitcoin, the most valuable cryptocurrency.
All of the Ether would eventually have to end up somewhere.
Over the same period when the North Koreans made the swaps, five Binance deposit accounts received an unusual spike of US$900 million in Ether from the same swapping service, according to ChainArgos, a crypto tracking firm.
The funds that entered Binance may not have belonged to the North Koreans anymore. But in effect, the exchange was on the other end of a series of transactions in which the thieves laundered hundreds of millions of dollars in crypto, said Mr Jonathan Reiter, chief executive of ChainArgos.
Given the timing, the stolen ether was “the only conceivable source for these outflows”, Mr Reiter said, and should have been flagged as dirty money.
“Binance should have caught these,” he said. “Even a bad – maybe even defective – screening tool would spot that.”
Ms Canassa did not directly address the flow of Ether.
Binance “maintains a comprehensive, multilayered compliance programme and security framework”, she said.
Smoke and mirrors
In 2024, a father in Minnesota stumbled into an investment opportunity.
He started trading crypto at the direction of a family-run financial firm with offices in Seattle and Los Angeles.
Then his money vanished. He had lost US$1.5 million to a scammer.
“My family and I were left financially shattered and emotionally broken,” he wrote to the Federal Bureau of Investigation (FBI) in March. He asked not to be identified to protect his privacy.
No one has recovered the stolen money.
But more than US$500,000 ended up in major exchanges, including Binance, according to an analysis by a crypto data firm the victim hired.
These schemes have become one of the crypto industry’s biggest scourges, draining the accounts of elderly investors, lonely singles and even the president of a Kansas bank.
Crypto investment fraud cost victims US$5.8 billion in 2024, according to the FBI.
Some of the most common scams are
known as “pig butchering”, a rough translation of a Chinese expression that refers to the fattening of an animal for slaughter.
Many fraudsters feign romantic interest, flirting with their targets for days or weeks before encouraging them to invest in fraudulent schemes.
Crypto exchanges can be useful in this process. They are convenient “off-ramps” – a way to convert ill-gotten crypto into cash.
Often the perpetrators are impossible to identify. But in the Minnesota case, Binance provided a rare window into its internal systems.
Before opening an account for a customer, crypto exchanges are supposed to request detailed personal information, a process called “know your customer”, or KYC, which is designed to prevent fraud.
In response to a subpoena from police in Minnesota, Binance shared files revealing information on two accounts that local investigators had linked to the pig-butchering case.
The first customer had moved more than US$7 million over a few months in 2023 and 2024.
A photo in the file showed a woman standing in front of a corrugated metal wall and listed a home address in a Chinese village.
A second Binance file listed the name of a 24-year-old woman with a home address in rural Myanmar.
Over nine months ending in mid-2024, the customer moved more than US$2 million, over 1,000 times the average annual salary in Myanmar.
Ms Erin West, a former prosecutor who runs a non-profit dedicated to stopping scams, said the women appeared to be “money mules” whose personal data may have been harvested by scammers to create fake accounts on Binance.
“There’s nothing that appears legitimate about this in any way,” said Ms West, who reviewed the files for the Times and the ICIJ. “We see this all the time.”
Binance declined to comment on the case.
Law enforcement often stands little chance of tracking down thieves thousands of kilometres away.
Ms Carrissa Weber, 58, a resident of the Canadian province of Alberta, lost more than US$25,000 in 2025 to a scammer who posed as a start-up manager and encouraged her to invest in crypto.
It was her life savings.
Ms Weber reached out to Canadian police but has not recovered the funds.
“My case is sitting in a filing cabinet, and no one’s doing anything with it,” she said.
An analysis of Ms Weber’s transaction records showed that the money she lost had ended up in a handful of crypto wallets.
All of them channeled funds into OKX. Two deposit accounts that received that money had been under scrutiny by the exchange since in 2024 for exhibiting “suspicious characteristics”, said Ms Lacewell of OKX.
OKX did not freeze the accounts until October, six months after Ms Weber was scammed.
Crypto for cash
At the back of a deli in Kyiv, Ukraine, past shelves lined with snacks and sodas, an electronic buzzer offered access to a door labelled “Currency Exchange”.
Inside the back room was a business dedicated to converting crypto into cash.
A cash-counting machine was perched on a desk, next to an old-school plastic calculator and a cardboard box filled with rubber bands for binding stacks of bills.
These crypto-to-cash storefronts, dotted throughout Asia and Eastern Europe, are a new frontier in global money laundering, crypto and law enforcement experts said.
Anyone can walk into these businesses and, often without presenting any personal information, exchange large quantities of cryptocurrency for US dollars, euros or another traditional currency.
In 2024, crypto-to-cash desks in Hong Kong processed more than US$2.5 billion in transactions, according to Crystal Intelligence, a crypto analytics firm.
“These can enable an almost endless volume of financial crime,” said Mr Richard Sanders, a crypto tracer who has studied the cash desks.
Many crypto-to-cash businesses rely on major exchanges.
Binance, OKX and Bybit received a total of US$531 million from the currency desks in 2024, according to data from Crystal.
While not everyone using these services is a criminal, the anonymous nature of the transactions lends itself to money laundering and other types of illicit finance.
“A lot of the ones that we’ve come across don’t require any identity documents,” said Mr Nick Smart, Crystal’s chief intelligence officer. “You can put almost as much as you want in any of them.”
One afternoon in July, a reporter sent US$1,200 in cryptocurrency to the cash desk in the Kyiv deli, after arranging the transaction on the Telegram chat app.
Within minutes, a man in the back room handed over a stack of bills wrapped in a thick rubber band.
He did not offer a receipt, and the Telegram chat was promptly deleted.
The desk did not respond to a request for comment.
Over several weeks in 2025, the ICIJ gathered crypto wallet addresses used by more than a dozen of these storefronts in Ukraine, Poland, Canada and the United Arab Emirates.
Most of them received funds from the major exchanges, according to transaction records.
That suggests that customers looking to convert digital currencies into cash withdrew funds from their accounts before sending the money to the desks for conversion.
On the 41st floor of a glass office tower in Dubai, the reporter observed a customer at one cash operation change US$6,000 in crypto for a wad of Emirati bills. An analysis of the service’s crypto address showed that it had received more than US$2 million over two weeks in September.
The total included US$303,000 sent from Binance. NYTIMES
