The Crypto Industry’s $28 Billion in ‘Dirty Money’
As President Trump has championed crypto and the industry has gone mainstream, funds from scammers and other criminal groups have flowed onto major crypto exchanges.
By David Yaffe-Bellany, Spencer Woodman and Sam Ellefson
David Yaffe-Bellany reported from New York; Spencer Woodman from Kyiv, Ukraine, and Dubai, United Arab Emirates; and Sam Ellefson from Washington.
Credit...Karolis StrautniekasPresident Trump has started his own cryptocurrency business and vowed to make the United States the world’s “crypto capital.”
Crypto companies have declared themselves safe and secure.
And a procession of major industries, from Wall Street banks to online retailers, have experimented with digital coins.
But even as the crypto industry gains mainstream acceptance, at least $28 billion tied to illicit activity has flowed into crypto exchanges over the last two years, according to an examination by the International Consortium of Investigative Journalists, The New York Times and 36 other news organizations around the world.
The money came from hackers, thieves and extortionists.
It was traced to cybercriminals in North Korea and scammers whose schemes stretched from Minnesota to Myanmar.
Over and over, the analysis showed, these groups have moved money onto the world’s largest exchanges, which are online marketplaces where people can convert U.S. dollars or euros into Bitcoin, Ether and other digital coins.
Among the recipients of this “dirty money” was Binance, the world’s biggest crypto exchange, which participated in a $2 billion business deal with Mr. Trump’s crypto firm in May.
The money also flowed into at least eight other prominent exchanges, including OKX, a global platform with a growing footprint in the United States, according to the analysis.
“Law enforcement can’t cope with the overwhelming amount of illicit activity in the space,” said Julia Hardy, a co-founder of zeroShadow, a crypto investigations firm.
“It can’t go on like this.”
The early days of digital currencies were dominated by thieves and drug dealers, who were attracted by the speed and anonymity of crypto, which make it a useful vehicle for money laundering.
Bitcoin, the most popular virtual currency, underpinned dark-web markets where merchants sold narcotics and other outlawed substances, leading to overdose deaths and criminal charges.
Since then, the crypto industry has grown exponentially and become professionalized, with billions of dollars a day in legitimate transactions.
The largest exchanges have pledged to crack down on criminals who use crypto to move funds.
Binance pleaded guilty to money-laundering violations in 2023 and agreed to pay a $4.3 billion penalty to the U.S. government after processing transactions for terrorist groups like Hamas and Al Qaeda.
Last year, it declared that the crypto industry was “an extremely unwelcoming place to bad actors.”
At the same time, Mr. Trump has made crypto a cornerstone of his family business and ended a regulatory clampdown on the industry.
Shortly before the 2024 election, he and his sons founded World Liberty Financial, a crypto start-up that is poised to generate tens of millions of dollars a year from the business deal involving Binance.
Last month, Mr. Trump granted a pardon to Changpeng Zhao, Binance’s founder, who had served a four-month term in prison after the company’s plea agreement.
The Trump administration has also weakened law enforcement’s ability to prosecute crypto crime.
In April, the Justice Department dismantled a crypto enforcement team, explaining that prosecutors should target terrorists and drug traffickers who use crypto, while eschewing cases against “the platforms that these enterprises utilize to conduct their illegal activities.”
The analysis by The Times and its colleagues provides only a partial window into illicit funds on exchanges, because many criminal accounts have not been publicly identified.
But it is one of the first systematic efforts to trace this money on specific platforms, which are rarely singled out by the analytics firms that collect the most comprehensive data.
Whether the exchanges have broken the law is a nuanced question.
Companies that process dirty money may still be fulfilling their legal responsibilities — by hiring compliance staff to root out fraud, for example.
But in the United States, crypto firms have been prosecuted under the Bank Secrecy Act for failing to create robust internal systems to prevent money laundering.
The analysis relied partly on aggregate data that was assembled by Chainalysis, an analytics firm, and that did not identify specific exchanges.
The Times and the International Consortium of Investigative Journalists also used public records and consulted with forensic experts to identify crypto accounts tied to criminals.
Crypto transactions are recorded on a public ledger, allowing the movement of funds to be traced to individual exchanges.
The findings included:
- Since Binance’s guilty plea, the exchange has received more than $400 million in deposits from Huione Group, a Cambodian operation that the Treasury Department has flagged for criminal activity.
An additional $900 million flowed into Binance deposit accounts this year from a platform that North Korean hackers were using to launder stolen funds.
- OKX received more than $220 million in deposits from Huione in the five months after OKX struck a $504 million settlement with the U.S. government in February for violating a money-transmission law.
- Crypto exchanges worldwide received at least $4 billion linked to scams in 2024, according to data from Chainalysis.
The Times and the journalist consortium interviewed two dozen victims of crypto scams whose stolen funds ended up on Binance, OKX and other large exchanges like Bybit and HTX.
More than $500 million flowed into Binance, OKX and Bybit last year from “crypto-to-cash desks,” which allow people to trade digital coins for actual bills.
Many of these businesses operate out of offices or storefronts, serving various types of customers — and offering a convenient avenue for criminals who want to convert digital currencies into cash.
Heloiza Canassa, a Binance spokeswoman, said that “security and compliance stand as utmost pillars” of the company’s operations and that it had responded to more than 240,000 law enforcement requests since its founding in 2017, including 65,000 last year.
Linda Lacewell, OKX’s chief legal officer, said the company worked with law enforcement “to help stop fraud and other illicit activity” and invested heavily in compliance, transaction monitoring and fraud detection tools.
HTX representatives did not respond to requests for comment, and a Bybit spokesman said the company enforced “a strict zero-tolerance policy toward financial crime.”
A White House spokeswoman declined to comment, while a representative for World Liberty said the firm viewed Binance as a marketplace for its coins and not as a business partner.
What happens after dirty money reaches an exchange can be difficult to determine; at that point, the money trail is hidden from view.
Exchanges may catch illegal activity fast enough to freeze the funds or turn them over to law enforcement.
But dirty money that goes undetected can benefit an exchange by generating trading fees, typically a small percentage of the transaction.
“If they kick criminal actors off the platform, then that’s a big revenue source that they lose,” said John Griffin, a crypto expert at the University of Texas, Austin.
“They have an incentive to allow this activity to continue.”
The Binance Connection
Huione Group has an extensive reach in Cambodia.
A financial conglomerate, it offers banking, payment and insurance services.
Customers use its QR codes to buy groceries and pay restaurant bills.
Those offerings conceal a more sinister enterprise.
For years, Huione has also run a vast digital marketplace that one expert has described as “Amazon for criminals,” where online merchants sell stolen personal data, tech support for scammers and money-laundering services.
The company has moved money for North Korean hackers and scam networks throughout Southeast Asia, according to law enforcement.
In May, the Treasury Department moved to ban Huione from the U.S. banking system, calling it a “critical node” for cyberheists and investment scams targeting Americans.
Throughout, Huione has maintained financial ties with Binance and OKX.
In a Chinese-language financial report last year, Huione published several of its crypto wallet addresses, long strings of letters and numbers that identify accounts on the public ledger of digital currency transactions.
An analysis of those wallets found that more than $400 million flowed from Huione onto Binance’s platform from July 2024 to July 2025.
Over five months this year, OKX received more than $220 million in deposits from the Huione wallets.
The flows continued even after the Treasury Department’s announcement on May 1.
The wallets deposited at least $77 million into Binance over the next two and a half months and $161 million into OKX, according to the journalist consortium’s analysis.
A Huione branch in Phnom Penh, Cambodia. The U.S. government says Huione is a “critical node” for cyberheists and investment scams.Credit...Chang W. Lee/The New York TimesBinance and OKX previously had a record of flouting financial rules, leading to their criminal settlements with the U.S. government.
Both have promised to clean up their acts.
Ms. Lacewell of OKX said that even before May, the company had applied “enhanced transaction monitoring” to one of the wallet addresses identified in Huione’s report.
The company “paused all interactions between OKX wallets and Huione” in October, she said.
Binance’s Ms. Canassa said in a statement that the exchange could not block or reverse incoming transactions.
But once suspicious deposits land on the platform, Binance reacts appropriately, she said.
“The true measures of compliance for a crypto exchange are the steps it takes to identify and react to suspicious deposits,” she said.
“It is in these areas that Binance is an industry leader.”
In February, a North Korean hacking syndicate called the Lazarus Group stole $1.5 billion of crypto from the Bybit exchange, which is based in Dubai, United Arab Emirates.
It was the largest hack in crypto history.
Within days, the North Koreans routed the stolen funds to a crypto service that lets people swap one digital currency for another.
They were converting Ether into Bitcoin, the most valuable cryptocurrency.
All of the Ether would eventually have to end up somewhere.
Over the same period when the North Koreans made the swaps, five Binance deposit accounts received an unusual spike of $900 million in Ether from the same swapping service, according to ChainArgos, a crypto tracking firm.
The funds that entered Binance may not have belonged to the North Koreans anymore.
But in effect, the exchange was on the other end of a series of transactions in which the thieves laundered hundreds of millions of dollars in crypto, said Jonathan Reiter, the chief executive of ChainArgos.
Given the timing, the stolen Ether was “the only conceivable source for these outflows,” Mr. Reiter said, and should have been flagged as dirty money.
“Binance should have caught these,” he said.
“Even a bad — maybe even defective — screening tool would spot that.”
Ms. Canassa did not directly address the flow of Ether.
Binance “maintains a comprehensive, multilayered compliance program and security framework,” she said.
Smoke and Mirrors
Last year, a father in Minnesota stumbled into an investment opportunity.
He started trading crypto at the direction of a family-run financial firm with offices in Seattle and Los Angeles.
Then his money vanished.
He had lost $1.5 million to a scammer.
“My family and I were left financially shattered and emotionally broken,” he wrote to the Federal Bureau of Investigation in March.
He asked not to be named to protect his privacy.
No one has recovered the stolen money.
But more than $500,000 ended up in major exchanges, including Binance, according to an analysis by a crypto data firm the victim hired.
These schemes have become one of the crypto industry’s biggest scourges, draining the accounts of elderly investors, lonely singles and even the president of a Kansas bank.
Crypto investment fraud cost victims $5.8 billion last year, according to the F.B.I.
Some of the most common scams are known as “pig butchering,” a rough translation of a Chinese expression that refers to the fattening of an animal for slaughter.
Many fraudsters feign romantic interest, flirting with their targets for days or weeks before encouraging them to invest in fraudulent schemes.
Crypto exchanges can be useful in this process.
They are convenient “offramps” — a way to convert ill-gotten crypto into cash.
Often the perpetrators are impossible to identify. But in the Minnesota case, Binance provided a rare window into its internal systems.
Before opening an account for a customer, crypto exchanges are supposed to request detailed personal information, a process called “know your customer,” or K.Y.C., which is designed to prevent fraud.
In response to a subpoena from the police in Minnesota, Binance shared files revealing information on two accounts that local investigators had linked to the pig-butchering case.
The first customer had moved more than $7 million over a few months in 2023 and 2024.
A photo in the file showed a woman standing in front of a corrugated metal wall and listed a home address in a Chinese village.
A second Binance file listed the name of a 24-year-old woman with a home address in rural Myanmar.
Over nine months ending in mid-2024, the customer moved more than $2 million, over 1,000 times the average annual salary in Myanmar.
Erin West, a former prosecutor who runs a nonprofit dedicated to stopping scams, said the women appeared to be “money mules” whose personal data may have been harvested by scammers to create fake accounts on Binance.
“There’s nothing that appears legitimate about this in any way,” said Ms. West, who reviewed the files for The Times and the International Consortium of Investigative Journalists.
“We see this all the time.”
Binance declined to comment on the case.
Law enforcement often stands little chance of tracking down thieves thousands of miles away.
Carrissa Weber, 58, a resident of the Canadian province of Alberta, lost more than $25,000 this year to a scammer who posed as a start-up manager and encouraged her to invest in crypto.
It was her life savings. Ms. Weber reached out to the Canadian police but has not recovered the funds.
“My case is sitting in a filing cabinet, and no one’s doing anything with it,” she said.
An analysis of Ms. Weber’s transaction records showed that the money she lost had ended up in a handful of crypto wallets.
All of them channeled funds into OKX.
Two deposit accounts that received that money had been under scrutiny by the exchange since last year for exhibiting “suspicious characteristics,” said Ms. Lacewell of OKX.
OKX did not freeze the accounts until October, six months after Ms. Weber was scammed.
Crypto for Cash
At the back of a deli in Kyiv, Ukraine, past shelves lined with snacks and sodas, an electronic buzzer offered access to a door labeled “Currency Exchange.”
Inside the back room was a business dedicated to converting crypto into cash.
A cash-counting machine was perched on a desk, next to an old-school plastic calculator and a cardboard box filled with rubber bands for binding stacks of bills.
These crypto-to-cash storefronts, dotted throughout Asia and Eastern Europe, are a new frontier in global money laundering, crypto and law enforcement experts said.
Anyone can walk into these businesses and, often without presenting any personal information, exchange large quantities of cryptocurrency for U.S. dollars, euros or another traditional currency.
Last year, crypto-to-cash desks in Hong Kong processed more than $2.5 billion in transactions, according to Crystal Intelligence, a crypto analytics firm.
“These can enable an almost endless volume of financial crime,” said Richard Sanders, a crypto tracer who has studied the cash desks.
Many crypto-to-cash businesses rely on major exchanges.
Binance, OKX and Bybit received a total of $531 million from the currency desks last year, according to data from Crystal.
While not everyone using these services is a criminal, the anonymous nature of the transactions lends itself to money laundering and other types of illicit finance.
“A lot of the ones that we’ve come across don’t require any identity documents,” said Nick Smart, Crystal’s chief intelligence officer.
“You can put almost as much as you want in any of them.”
OKX and two other exchanges received a total of $531 million from their crypto-to-cash desks last year.Credit...Tyrone Siu/ReutersOne afternoon in July, a reporter sent $1,200 in cryptocurrency to the cash desk in the Kyiv deli, after arranging the transaction on the Telegram chat app.
Within minutes, a man in the back room handed over a stack of bills wrapped in a thick rubber band.
He did not offer a receipt, and the Telegram chat was promptly deleted.
The desk did not respond to a request for comment.
Over several weeks this year, the International Consortium of Investigative Journalists gathered crypto wallet addresses used by more than a dozen of these storefronts in Ukraine, Poland, Canada and the United Arab Emirates.
Most of them received funds from the major exchanges, according to transaction records.
That suggests that customers looking to convert digital currencies into cash withdrew funds from their accounts before sending the money to the desks for conversion.
On the 41st floor of a glass office tower in Dubai, the reporter observed a customer at one cash operation change $6,000 in crypto for a wad of Emirati bills.
An analysis of the service’s crypto address showed that it had received more than $2 million over two weeks in September.
The total included $303,000 sent from Binance.
Reporting was contributed by Saw Nang, Yi Liu, Agustin Armendariz, Miguel Fiandor Gutiérrez and Ben Dooley.
David Yaffe-Bellany writes about the crypto industry from New York.
0 comments:
Publicar un comentario