New York Times: $28 billion in "dirty money" in the cryptocurrency industry
TechFlow Selected TechFlow Selected
New York Times: $28 billion in "dirty money" in the cryptocurrency industry
As Trump pushes hard for cryptocurrency and the crypto industry gradually enters the mainstream spotlight, funds from scammers and various criminal groups are flowing steadily into major cryptocurrency exchanges.
Navigating Web3 tides with focused insightsBy David Yaffe-Bellany, Spencer Woodman and Sam Ellefson
Translated by Luffy, Foresight News
President Trump has launched his own cryptocurrency venture and vowed to make the United States the global "crypto capital." Cryptocurrency companies claim their platforms are secure and reliable, while mainstream industries—from Wall Street banks to online retailers—are increasingly adopting crypto services.
However, a joint investigation by the International Consortium of Investigative Journalists (ICIJ), The New York Times, and 36 other news organizations worldwide reveals that despite growing mainstream acceptance, at least $28 billion in funds linked to criminal activity flowed into cryptocurrency exchanges over the past two years.
These funds originated from hackers, thieves, and extortionists, ranging from North Korean cybercriminal groups to fraud networks operating from Minnesota to Myanmar. Analysis shows these criminal groups repeatedly transferred money into major global cryptocurrency exchanges—online trading platforms that allow users to exchange dollars and euros for cryptocurrencies like Bitcoin and Ethereum.
Binance, the world’s largest cryptocurrency exchange, was among the recipients of this illicit "dirty money." In May, Binance entered a $2 billion business partnership with a crypto company affiliated with Trump. The investigation also found dirty money flowing into at least eight other prominent exchanges, including OKX, a global trading platform expanding its influence in the U.S. market.
"Law enforcement is simply outmatched when it comes to the volume of illegal activity happening in this space," said Julia Hardy, co-founder of cryptocurrency investigations firm zeroShadow. "This cannot continue."
In its early days, cryptocurrency became a haven for thieves and drug traffickers. Fast and anonymous transactions made it an ideal tool for money laundering. As the most iconic digital currency, Bitcoin once powered dark web markets where illicit vendors sold drugs and other contraband.
Since then, the crypto industry has grown exponentially and become more professionalized, processing billions of dollars in legitimate daily transactions. Leading exchanges have pledged to combat criminal use of their platforms. In 2023, Binance admitted guilt in money laundering-related charges for having processed transactions on behalf of terrorist organizations such as Hamas and Al-Qaeda, agreeing to pay $4.3 billion in penalties to the U.S. government. Last year, Binance declared the crypto industry “has no tolerance for bad actors.”
President Trump's sons Eric and Donald point to a promotional campaign featuring World Liberty Financial, the Trump family’s cryptocurrency venture
Meanwhile, Trump has elevated cryptocurrency ventures to a central part of his family business and ended regulatory crackdowns on the industry. Ahead of the 2024 election, he co-founded a crypto startup called World Liberty Financial with his sons. Thanks to its partnership with Binance, the company could generate tens of millions of dollars in annual revenue. Last month, Trump granted a presidential pardon to Binance founder Changpeng Zhao, who had been sentenced to four months in prison under the company’s plea agreement.
The Trump administration has also weakened law enforcement's ability to hold cryptocurrency criminals accountable. In April, the U.S. Department of Justice disbanded a specialized cryptocurrency crime task force, stating prosecutors should focus only on terrorists and drug traffickers using crypto—not the platforms enabling their crimes.
Because many criminal accounts remain undisclosed, the findings from The New York Times and partner outlets represent just a fraction of the problem. But this is the first systematic tracking effort focused on specific platforms.
Whether exchanges themselves are breaking the law depends on individual cases. Some may still fulfill legal obligations—even if they process dirty money—by employing compliance staff to detect fraud. However, in the U.S., crypto firms lacking robust internal anti-money-laundering systems can be sued for violating the Bank Secrecy Act.
This investigation partially relied on data from blockchain analytics firm Chainalysis (which did not identify specific exchanges involved). The New York Times and ICIJ also used public records and consulted forensic experts to identify cryptocurrency accounts tied to criminal activity. Since all crypto transactions are recorded on public ledgers, investigators were able to trace fund flows to particular exchanges.
Changpeng Zhao, founder of Binance
Main findings include:
-
After Binance pleaded guilty, Cambodia-based Huione Group transferred over $400 million into its accounts. The U.S. Treasury has designated Huione as a criminal entity. Additionally, this year, $900 million flowed into Binance from a platform used by North Korean hackers to launder money.
-
In February, OKX reached a $504 million settlement with the U.S. government for violating money transfer laws. Within five months of the deal, the platform received over $220 million from Huione Group.
-
Data from Chainalysis shows global cryptocurrency exchanges received at least $4 billion in scam-linked funds in 2024. The New York Times and ICIJ interviewed 24 victims of crypto scams, all of whom had their stolen funds end up in large exchanges such as Binance, OKX, Bybit, and HTX.
-
Last year, more than $500 million flowed from cryptocurrency-to-cash shops into Binance, OKX, and Bybit. These physical storefronts offer customers a way to exchange digital currencies for cash, serving both regular clients and providing criminals with an easy method to convert illicit crypto into tangible money.
Binance spokesperson Heloiza Canassa said, “Security and compliance are core pillars of our operations.” Since its founding in 2017, Binance has responded to over 240,000 law enforcement requests, including 65,000 last year alone.
OKX Chief Legal Officer Linda Lacewell said the company actively cooperates with authorities to combat fraud and other illegal activities, investing heavily in compliance management, transaction monitoring, and fraud detection tools.
HTX did not respond to requests for comment; a Bybit spokesperson said the company maintains a “strict zero-tolerance policy toward financial crime.” A White House spokesperson declined to comment; representatives of World Liberty Financial said they view Binance solely as a cryptocurrency trading platform, not a business partner.
Once dirty money enters an exchange, its trail often vanishes. Exchanges might freeze suspicious funds and hand them over to authorities—if they detect the illicit activity in time.
John Griffin, a cryptocurrency expert at the University of Texas at Austin, said: “If you remove criminals from your platform, you lose a significant source of revenue. So there’s actually an incentive to let these activities continue.”
The Underground Network Behind Exchange Transactions
Huione Group operates widely across Cambodia, functioning as a large financial conglomerate offering banking, payments, insurance, and more. Locals use its QR code system to pay for groceries and meals.
Behind these legitimate services lies a vast criminal network.
Law enforcement officials say Huione has long operated a massive illegal digital marketplace. Experts describe it as an “Amazon for criminals,” where vendors sell stolen personal information, technical support for scams, and money laundering services. The group has also provided financial transfer services for North Korean hackers and multiple Southeast Asian fraud rings.
In May, the U.S. Treasury banned Huione from accessing the American banking system, identifying it as a “central hub” for cyber theft and investment fraud targeting Americans.
Despite this, Huione continued financial dealings with Binance and OKX during the same period.
Last year, Huione publicly disclosed several cryptocurrency wallet addresses in a Chinese-language financial report. These long strings of letters and numbers serve as key identifiers for accounts on the public blockchain ledger. Investigation analysis shows that between July 2024 and July 2025, Huione transferred over $400 million into Binance. Within five months this year, OKX received over $220 million in deposits from wallets linked to Huione.
Even after the U.S. Treasury issued its ban on May 1, the transfers continued. The journalist consortium found that within two and a half months after the ban, Huione wallets sent at least $77 million to Binance and $161 million to OKX.
A Huione branch office in Phnom Penh, Cambodia. The U.S. government says Huione is a 'key node' in cyber theft and investment fraud
Both Binance and OKX have prior records of violating financial regulations, leading to criminal settlements with the U.S. government. Both platforms previously pledged to improve compliance.
Lacewell of OKX said the company had already initiated “enhanced transaction monitoring” on one of the wallet addresses mentioned in the Huione report before May and fully severed all business ties with Huione by October.
Canassa of Binance stated the exchange cannot intercept or reverse incoming transactions but will take appropriate action upon detecting suspicious deposits. She emphasized: “The real measure of an exchange’s compliance is how it identifies and responds to suspicious deposits—and in this regard, Binance leads the industry.”
Yet, the inflow of funds from Huione persisted for months. Moreover, after settling with the U.S. government, Binance received numerous other suspicious deposits beyond those from Huione.
In February, the North Korean hacking group Lazarus infiltrated Bybit’s Dubai exchange, stealing $1.5 billion worth of cryptocurrency—the largest hack in crypto history.
Within days, the hackers moved the stolen funds to a cryptocurrency conversion platform, exchanging Ethereum for Bitcoin, the world’s highest-market-cap cryptocurrency.
Cryptocurrency ATMs can be used to exchange cash for digital currency
Data from crypto-tracking firm ChainArgos shows that around the same time the hackers conducted the exchange, five Binance deposit accounts suddenly received $900 million in Ethereum from the conversion platform—an unusually large and suspicious inflow.
Jonathan Reiter, CEO of ChainArgos, said although the funds entering Binance may no longer technically belong to the North Korean hackers, the exchange effectively served as the final stage in the hackers’ money laundering chain, helping launder hundreds of millions in stolen crypto.
Reiter said the timeline makes clear that the outgoing Ethereum “could only reasonably have come from the stolen funds” and should have been flagged as tainted. “Binance should have noticed this anomaly. Even a poorly designed or broken screening tool should have caught this.”
Canassa did not directly address the influx of funds, merely reiterating that Binance “has built comprehensive, multi-layered compliance mechanisms and security systems.”
Elaborate Scams Uncovered
Last year, a father in Minnesota stumbled upon what seemed like an “investment opportunity.” Following instructions from a family-run financial firm based in Seattle and Los Angeles, he began trading cryptocurrency—only to lose everything. Eventually, scammers stole $1.5 million from him.
In a letter to the FBI this March, he wrote: “My family and I are not only in financial ruin, but we’ve suffered immense emotional distress.” He requested anonymity to protect his privacy.
The stolen funds have not been recovered. However, according to a cryptocurrency data firm hired by the victim, over $500,000 of the money ultimately flowed into major exchanges.
Such scams have become a persistent plague in the crypto industry, ensnaring elderly investors, single individuals, and even bank executives. According to FBI data, losses from cryptocurrency investment scams reached $5.8 billion last year.
One of the most common types is the so-called “pig butchering” scam, a term derived from Chinese, referring to fraudsters who first “fatten the pig” before slaughtering it. Scammers often pose as romantic partners, building emotional connections over days or weeks before luring victims into fake crypto investments.
Shan Hanes, president of Heartland Tri-State Bank in Elkhart, Kansas, was convicted of embezzlement last year after losing funds in a cryptocurrency scam
Cryptocurrency exchanges play a crucial role in these scams, serving as convenient channels for fraudsters to convert stolen digital assets into cash.
Perpetrators are often difficult to trace, but the Minnesota case offers a rare glimpse into Binance’s internal systems.
As required, cryptocurrency exchanges must conduct KYC (Know Your Customer) checks, collecting detailed personal information to prevent fraud.
In response to a subpoena from Minnesota police, Binance provided documents related to two accounts involved in the pig-butchering scam. Within just a few months between 2023 and 2024, the first account processed over $7 million. Photos in the file show a woman standing in front of a corrugated metal wall, with an address listed in a rural village in China.
The second account was registered under a 24-year-old woman from a rural area in Myanmar. By mid-2024, the account had processed over $2 million in nine months—more than 1,000 times the average annual income in Myanmar.
Erin West, head of a nonprofit focused on anti-fraud efforts and a former prosecutor, reviewed the documents and said the two women were likely “money mules,” whose identities may have been stolen by scammers to create fake accounts on Binance. “There is absolutely no legitimacy to these accounts,” she said. “We’ve seen this pattern far too often.” Binance declined to comment.
For law enforcement agencies thousands of miles away, perpetrators are often beyond reach.
Carrissa Weber, 58, from Alberta, Canada, lost her life savings of $25,000 this year to a scammer posing as a startup executive who persuaded her to invest in cryptocurrency. She reported the crime to Canadian authorities, but the stolen funds have not been recovered.
“My case just sits there, untouched,” she said helplessly.
Analysis of Weber’s transaction records shows her stolen funds flowed into multiple cryptocurrency wallets before ending up on OKX. Lacewell of OKX said the two accounts that received the funds had been flagged for “suspicious characteristics” last year and placed under monitoring—but weren’t frozen until October this year, six full months after Weber was defrauded.
Gray Channels for Converting Crypto to Cash
Deep inside a deli in Kyiv, Ukraine, past shelves stocked with snacks and soda, pressing an electronic doorbell opens a door marked “Currency Exchange.”
Inside is a brick-and-mortar shop specializing in cryptocurrency exchanges. On the table sits a bill counter, an old plastic calculator, and a cardboard box filled with rubber bands used to bundle stacks of cash.
Experts and law enforcement officials say such cryptocurrency-to-cash shops, scattered across Asia and Eastern Europe, have become new hubs for global money laundering.
Anyone walking into these shops can often exchange large amounts of cryptocurrency for fiat currencies like U.S. dollars or euros without showing identification. Data from crypto analytics firm Crystal Intelligence shows that Hong Kong’s crypto exchange kiosks processed over $2.5 billion in transactions last year.
Richard Sanders, a cryptocurrency tracking expert who has studied these shops extensively, said: “These outlets may provide unlimited opportunities for various forms of financial crime.”
Many crypto-to-cash shops rely on major exchanges to operate. Data from Crystal shows that last year, Binance, OKX, and Bybit collectively received $531 million from such exchange shops.
Nick Smart, chief intelligence officer at Crystal, said: “We’ve found many of these shops require no ID and impose virtually no limits on transaction sizes.”
On a July day this year, a reporter arranged a trade via Telegram, sending $1,200 in cryptocurrency to the Kyiv exchange. Minutes later, the shop handed over a stack of cash bound with a thick rubber band—no receipt provided, and the Telegram chat was deleted immediately afterward. The exchange did not respond to requests for comment.
Over several weeks this year, the ICIJ collected cryptocurrency wallet addresses from over a dozen such physical outlets in Ukraine, Poland, Canada, and the UAE.
Transaction records show these wallets mostly received funds from major exchanges, meaning customers looking to cash out typically first transfer money from their exchange accounts to these shops to complete the conversion.
On the 41st floor of a glass-walled office building in Dubai, a customer exchanged $6,000 in cryptocurrency for a stack of UAE dirham bills at a cash exchange booth. Analysis of the booth’s crypto address revealed it received over $2 million in cryptocurrency within two weeks in September, including $303,000 from Binance.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@nytimes
