Illicit Crypto Networks Persist Despite Penalties, ICIJ Probe Reveals

A new wave of reporting by the International Consortium of Investigative Journalists (ICIJ) indicates that bad actors have been able to channel vast sums of cryptocurrency through exchanges, brokers, and off-ramp services, with similar laundering behaviors recurring even as several platforms operated under U.S. sanctions, plea agreements, or the oversight of court-appointed monitors.

ICIJ’s project, titled “The Coin Laundry,” highlights a widening gap between the data permanently etched onto blockchains and what investigators or exchanges are realistically able to analyze at scale. According to the consortium, the increasing reliance on anonymous wallets, intermediaries, and “swappers” forces investigators to slow down their tracing processes and expend far more resources, making real-time detection far more difficult for both exchanges and law-enforcement units.

Former compliance personnel at major exchanges echoed that sentiment, telling ICIJ and The Toronto Star that they struggled to “hardly keep pace with savvy criminals.”

One of the most granular case studies centers on Huione Group, a Cambodian financial entity the U.S. Treasury flagged as a “primary money laundering concern” in May. Despite that designation, ICIJ found that Huione “continued largely unabated,” routing large amounts of Tether’s USDT into customer accounts at Binance and OKX.

From July 2024 through July 2025, investigators tracked more than $408 million flowing from Huione into Binance user accounts—including daily averages around one million dollars in July 2025—while the exchange was still operating under two court-appointed monitors put in place after its 2023 guilty plea for AML violations. At the same time, at least $226 million moved from Huione into OKX accounts between February and July 2025, a period after OKX admitted in U.S. court to running an unlicensed money-transmission business.

OKX disputed the implications of the findings, insisting it “welcomes scrutiny” of how crypto firms approach illicit-finance risks but rejecting the characterization that exchanges function as laundering conduits. “Where credible risks are detected, we act quickly, including pausing interactions, blocking transfers, and supporting criminal investigations,” a spokesperson tosaid. The exchange added that the transactions cited by ICIJ represent “a very small fraction” of its total activity.

KuCoin—another exchange referenced in ICIJ’s investigation into crypto-to-cash storefronts—said in a statement that it “operates a rigorous and continuously evolving AML/CTF program,” consistent with global regulatory norms.

Tether, Binance, Coinbase, Kraken, and Bybit were also contacted for comment, and will update its reporting if they respond.

The ICIJ’s findings come as regulators continue levying penalties against exchanges while struggling with patchy enforcement and limited international coordination. Ari Redbord, a former Treasury and federal prosecutor who now serves as global head of policy at blockchain-intelligence company TRM Labs, said that TRM’s data reveals repeating behavioral patterns in how illicit funds move—typically involving “certain intermediaries, OTC brokers, or cross-chain services.”

“These patterns often reflect common laundering typologies rather than fixed or standardized ‘routing templates,’” Redbord noted. “In other words, illicit actors frequently exploit the same weak compliance points or high-risk service providers, which can make flows appear structurally similar even when they are not centrally coordinated.”

Redbord added that TRM’s work supports the idea that crypto-based laundering is better understood as a networked environment. Bad actors, he said, interact through “overlapping transactional relationships that cross jurisdictions and asset types.” Some networks—including pig-butchering syndicates, cartel-linked brokers, and North Korean operators—show “sustained coordination,” while most others form “opportunistic linkages” built around “shared infrastructure or mutual convenience.”

“The recurring patterns we see are best understood as emergent behavior within an adaptive ecosystem—not a coherent operational structure,” Redbord said.

By fLEXI tEAM