Chainalysis Uncovers $16.1bn in Activity Tied to Vast Chinese Crypto Laundering Networks

New research from blockchain analytics firm Chainalysis has identified specialised underground groups linked to Chinese money laundering operations that processed more than $16.1bn in transaction volume during the 2025 calendar year.

According to the findings, these networks handled an average of roughly $44m per day and relied on at least 1,799 active digital wallet addresses to sustain their activity.

Chainalysis said the growth of these organisations has dramatically outpaced other forms of illicit crypto activity. The expansion rate of these dedicated laundering groups was more than seven thousand times faster than the growth in illicit flows moving through traditional cryptocurrency exchanges.

Investigators are particularly alarmed by the shift away from fiat-based shadow banking models toward systems built entirely around stablecoins, a transition that has enabled financial crime to be carried out on an industrial scale that was previously unattainable.

Rapid professionalisation since 2020

Historical analysis shows that these covert networks have undergone a process of rapid professionalisation and scaling over the past five years. In 2020, value transfers through such channels were fragmented and largely dependent on small, peer-to-peer transactions. By 2025, however, the ecosystem had transformed into a highly organised industry that in many ways resembles the operational efficiency of legitimate global logistics companies.

Forensic analysts estimate that daily transaction volumes now reach approximately $44m.

Rather than being evenly distributed, this activity is concentrated within a core cluster of 1,799 primary wallet addresses that function as the backbone of the global laundering infrastructure. The extraordinary pace of growth — seven thousand times faster than regulated platforms’ intake of illicit funds — suggests that increasingly stringent controls at mainstream services are pushing criminals toward these specialised underground brokers.

As these networks have expanded, they have become the preferred laundering partners for a wide range of criminal enterprises, including large-scale investment fraud rings and narcotics traffickers. The link between organised fraud and these laundering hubs is especially visible in stablecoin flows, which provide the liquidity necessary to move vast sums across borders almost instantly.

By operating outside the conventional banking system, these groups are able to offer speed and resistance to censorship that traditional shadow banks cannot match. Their infrastructure is built for resilience: when individual nodes are flagged or disrupted, replacements are rapidly brought online. This adaptability ensures that overall throughput remains largely unaffected, even as law enforcement pressure increases. The scale implied by the $16.1bn figure underscores the urgency of developing a deeper understanding of these specialised financial conduits.

How value is moved and identities obscured

Stablecoins sit at the core of these operations, allowing value to be preserved while passing through multiple stages of the laundering cycle. Criminal groups favour these assets because they combine the irreversible nature of blockchain transactions with a stable link to the US dollar, making them ideal for high-volume settlement.

To conceal origins, funds are layered through thousands of intermediary wallets, creating dense transaction webs designed to overwhelm conventional monitoring methods. Advanced forensic software is required to detect the subtle behavioural patterns that connect these apparently unrelated addresses back to a single coordinating entity. Often, the movement of funds is disguised as legitimate commercial activity, such as payments linked to cross-border trade or services.

Another widely used technique involves splitting large transfers into many smaller ones. These micro-transactions are routed through separate pathways and later recombined at an exit point, reducing the likelihood of triggering automated large-transaction alerts. In addition, decentralised liquidity pools enable actors to swap between assets without interacting with compliant institutions. By using automated market makers, they maintain a continuous flow of value while avoiding single points of failure.

The sophistication of these methods reflects a high level of technical expertise. The operators behind these networks are not simply opportunistic criminals, but highly skilled financial engineers who understand how to exploit the unique features of distributed ledger technology.

Underground guarantee platforms industrialise laundering

One of the most significant developments highlighted in the research is the emergence of centralised guarantee platforms. These online hubs operate as marketplaces where laundering vendors advertise their services to criminal clients. The platform itself functions as an escrow provider, holding funds until both sides confirm that a transaction has been completed satisfactorily.

This model has effectively industrialised money laundering, enabling extensive specialisation among service providers and supporting transaction volumes that were previously unimaginable. In 2025, some specialised service categories within these platforms processed more than $1bn in just 236 days, illustrating both the efficiency of the model and the enormous demand for dependable laundering services.

Typically, these platforms are organised hierarchically. Senior administrators oversee networks of smaller vendors, each focused on a particular service such as currency conversion or identity obfuscation. This division of labour allows individual units to optimise their functions, strengthening the resilience of the broader system. The platforms also supply technical infrastructure and support, helping vendors stay ahead of forensic investigators.

Because these hubs often do not directly handle illicit funds, they can claim a degree of plausible deniability, complicating efforts by regulators and law enforcement to pursue the organisers.

Six core underground service typologies

Chainalysis identified six primary service categories that collectively underpin the $16.1bn in annual volume:

Running point brokers (pao fen merchants) act as the entry layer, recruiting ordinary individuals to use their personal payment accounts for small transfers. By breaking large sums into thousands of tiny payments, they evade bank and payment processor monitoring.

The collected fiat is then used to purchase digital assets, which are passed on to the central syndicate, effectively severing the link to the original crime.

Money mule motorcades consist of groups hired to move funds rapidly through chains of bank accounts. Money may change hands dozens of times in a single day, generating enormous transactional “noise” and creating distance between the criminal source and the eventual crypto conversion.

Over-the-counter (OTC) desks function as high-volume brokerages for converting millions of dollars at once. Often based in jurisdictions with weak anti-money laundering regimes, they process large sums with little or no due diligence and serve as key gateways where illicit crypto is converted back into usable fiat.

Black U markets specialise in trading stablecoins linked to major hacks or crimes. Although such assets are frequently blacklisted by mainstream exchanges, they continue to circulate on underground markets at a discount. Some Black U services have processed more than $1bn in only 236 days.

Gambling platforms are used as integration tools. Criminals deposit crypto into offshore online casinos and withdraw it as purported winnings, blending illicit proceeds with legitimate gaming activity and complicating forensic tracing.

Technical money movement services rely on cross-chain bridges and privacy-enhancing protocols to fracture audit trails and ensure that the $16.1bn in annual volume can circulate freely across the global crypto ecosystem.

Building global resistance to a growing threat

Preserving the integrity of the global financial system will require a coordinated and proactive response to the rise of industrialised laundering networks. While digital assets have given criminals powerful new capabilities, they also generate permanent public records that can be analysed.

By applying advanced analytics and machine learning, investigators can begin to map relationships among the 1,799 core wallets driving this activity. Success will depend on real-time information sharing between governments and the adoption of consistent regulatory standards worldwide, reducing the number of safe havens where such groups can operate.

Greater cooperation with the private sector is also essential. Banks and digital asset platforms must collaborate to identify the points where illicit funds attempt to enter the legitimate economy. Strengthening controls at these exit points can effectively trap criminal value on-chain, where its usefulness is limited.

Given the ongoing professionalisation of these services, laundering networks are likely to continue adapting. Regulatory frameworks must therefore evolve at the same pace. The battle against these $16.1bn networks is not a single campaign, but an ongoing process of monitoring, analysis and disruption, requiring sustained global commitment to protect the stability of the financial system from organised crime.

By fLEXI tEAM