Original Title: The Crypto Industry's $28 Billion in "Dirty Money"
Original Authors: David Yaffe-Bellany, Spencer Woodman, Sam Ellefson
Translated by: Peggy, BlockBeats
Editor’s Note: In recent years, the cryptocurrency industry has rapidly expanded globally, but the accompanying issues of money laundering, fraud, and regulatory loopholes have also become increasingly severe. The secretive chain of fund flows reveals a troubling reality: major trading platforms are not only hubs for digital asset trading but may also serve as "outlets" for illegal funds.
This article is based on an in-depth investigation by The New York Times and the International Consortium of Investigative Journalists, detailing the interactions between trading platforms like Binance and OKX and high-risk funds, revealing how regulatory failures, technical vulnerabilities, and criminal networks exploit the crypto ecosystem to launder vast amounts of money. Meanwhile, ordinary investors have suffered heavy losses in scams, with fraudulent tactics ranging from "pig butchering" to fake investment platforms, becoming a new breeding ground for global financial crime.
The following is the original text:
President Trump founded his own cryptocurrency company and vowed to make the U.S. the global "crypto capital." Crypto companies claim to be safe and reliable, while a range of large industries, from Wall Street banks to online retailers, have begun to experiment with digital currencies.
However, despite the cryptocurrency industry gradually gaining mainstream recognition, at least $28 billion related to illegal activities has flowed into cryptocurrency trading platforms over the past two years. This data comes from a joint investigation by the International Consortium of Investigative Journalists, The New York Times, and 36 other global news organizations.
These funds come from hackers, thieves, and extortionists, with tracking showing connections to North Korean cybercriminals and scam groups from Minnesota to Myanmar. Investigations repeatedly reveal that these groups continuously transfer funds to the world's largest trading platforms. These trading platforms are online markets where people can exchange dollars or euros for cryptocurrencies like Bitcoin and Ethereum.
One of the recipients of this "dirty money" is Binance, the world's largest cryptocurrency trading platform, which struck a $2 billion business deal with Trump's crypto company in May of this year. According to the investigation, these funds also flowed into at least eight other well-known trading platforms, including the globally expanding platform OKX in the U.S.
"Law enforcement cannot cope with the overwhelming illegal activities in this field," said Julia Hardy, co-founder of the crypto investigation firm zeroShadow. "This situation cannot continue."
The early stages of digital currency were dominated by thieves and drug dealers, attracted by the speed and anonymity of cryptocurrencies, making them ideal tools for money laundering. The most popular virtual currency, Bitcoin, once supported dark web markets where vendors sold drugs and other illicit goods, leading to numerous overdose deaths and criminal charges.
Since then, the crypto industry has grown exponentially and gradually professionalized, with daily legitimate trading volumes reaching billions of dollars. The largest trading platforms have pledged to combat criminals using cryptocurrencies to transfer funds. Binance admitted in 2023 to violating anti-money laundering regulations and agreed to pay a $4.3 billion fine to the U.S. government after the company handled transactions for terrorist organizations like Hamas and Al-Qaeda. Last year, the company claimed that the crypto industry had become "a place that is extremely unwelcome to criminals."
President Trump's two sons, Eric on the left and Donald on the right, are pointing to a promotional event involving the family crypto business World Liberty Financial.
Image Source: Eduardo Munoz/Reuters
Meanwhile, Mr. Trump has made cryptocurrency central to his family business and has ended regulatory crackdowns on the industry. Shortly before the 2024 election, he and his two sons founded World Liberty Financial, a crypto startup expected to generate tens of millions of dollars in revenue annually through business transactions related to Binance. Last month, Mr. Trump pardoned Binance founder Changpeng Zhao, who served four months in prison following a company plea agreement.
The Trump administration also weakened law enforcement's ability to combat crypto crime. In April of this year, the Justice Department disbanded a crypto enforcement team, explaining that prosecutors should focus on terrorists and drug dealers using cryptocurrencies while avoiding cases against "the platforms these businesses use to conduct illegal activities."
The analysis by The New York Times and its partners provides only a partial view of illegal funds in trading platforms, as many criminal accounts have yet to be publicly identified. However, this analysis is the first systematic attempt to track the flow of these funds on specific platforms, which are often not separately listed by analysis companies that collect the most comprehensive data.
Whether trading platforms are acting illegally is a complex question. Companies handling dirty money may still fulfill legal responsibilities, such as hiring compliance personnel to combat fraud. However, in the U.S., crypto companies have been prosecuted under the Bank Secrecy Act for failing to establish robust internal systems to prevent money laundering.
The analysis partially relies on overall data compiled by the analysis company Chainalysis but does not identify specific trading platforms. The New York Times and the International Consortium of Investigative Journalists also utilized public records and consulted forensic experts to identify crypto accounts associated with criminals. Crypto transaction records are on public ledgers, allowing fund flows to be traced to specific trading platforms.
Binance founder Changpeng Zhao, since 2023, the Cambodian company Huione Group has deposited over $400 million in cryptocurrency into Binance.
Image Source: Grant Hindsley/The New York Times
The investigation's findings include:
Since Binance's plea agreement, the trading platform has received over $400 million in deposits from Huione Group, a Cambodian company marked by the U.S. Treasury for involvement in criminal activities. This year, another $900 million flowed into Binance's deposit accounts from a trading platform used by a North Korean hacker for money laundering.
OKX received over $220 million in deposits from Huione within five months of reaching a $504 million settlement with the U.S. government for violating the Money Transmission Act.
According to Chainalysis data, global crypto trading platforms received at least $4 billion related to scams in 2024. The New York Times and the journalists' consortium interviewed two dozen victims of crypto scams, whose funds ultimately flowed into Binance, OKX, and other major trading platforms like Bybit and HTX.
Last year, over $500 million flowed into Binance, OKX, and Bybit from so-called "crypto cash exchange platforms," which allow people to exchange digital currencies for cash. Many such businesses operate in offices or storefronts, serving various customers while providing criminals with convenient ways to cash out digital currencies.
A Binance spokesperson, Heloiza Canassa, stated that the company "prioritizes security and compliance" and noted that since its establishment in 2017, Binance has responded to over 240,000 law enforcement requests, including 65,000 last year.
OKX's Chief Legal Officer, Linda Lacewell, stated that the company collaborates with law enforcement to "help stop fraud and other illegal activities" and has invested heavily in compliance, transaction monitoring, and fraud detection tools.
HTX did not respond to requests for comment, while a Bybit spokesperson stated that the company enforces a "strict zero-tolerance policy for financial crime." The White House declined to comment, and representatives of World Liberty stated that the company views Binance as a trading market for its tokens rather than a business partner.
The destination of dirty money after entering trading platforms is difficult to determine; at this point, the flow of funds has been obscured. Trading platforms may quickly detect illegal activities and freeze funds or hand them over to law enforcement. However, undetected dirty money can generate transaction fee revenue for trading platforms, typically charged as a small percentage of the transaction amount.
"If they kick criminals off the platform, they lose an important source of revenue," said John Griffin, a crypto expert at the University of Texas at Austin. "They have an incentive to let this activity continue."
The "Problems" of Crypto Trading Platforms
Huione Group has extensive influence in Cambodia. As a financial group, it provides banking, payment, and insurance services. Customers can use its QR codes to buy groceries and pay restaurant bills.
However, these businesses mask a more sinister enterprise.
For years, Huione has also operated a vast digital marketplace, described by one expert as "Amazon for criminals," where online vendors sell stolen personal data, scam technical support, and money laundering services. According to law enforcement sources, the company has facilitated fund transfers for North Korean hackers and scam networks in Southeast Asia.
In May of this year, the U.S. Treasury took action to prohibit Huione from using the U.S. banking system, calling it a "key node" for cyber theft and investment fraud against Americans.
During this time, Huione has maintained financial ties with Binance and OKX.
In a Chinese financial report released last year, Huione disclosed multiple cryptocurrency wallet addresses, which are long strings of letters and numbers used to identify accounts on the public ledger of digital currency transactions. Analysis of these wallets found that from July 2024 to July 2025, over $400 million flowed from Huione to the Binance platform. In the first five months of this year, OKX received over $220 million in deposits from these wallets.
The flow of funds continued even after the Treasury's announcement on May 1. According to the journalists' consortium analysis, these wallets deposited at least $77 million into Binance and $161 million into OKX in the following two and a half months.
Huione branch in Phnom Penh, Cambodia. The U.S. government calls Huione a "key node" for cyber theft and investment fraud.
Image Source: Chang W. Lee/The New York Times
Binance and OKX have previously had records of violating financial regulations, leading to criminal settlements with the U.S. government. Both companies have pledged to rectify their behavior.
Ms. Lacewell from OKX stated that even before May, the company had implemented "enhanced transaction monitoring" on a wallet address identified in the Huione report. She mentioned that the company "suspended all interactions between the OKX wallet and Huione" in October.
Ms. Canassa from Binance stated in a statement that the trading platform cannot prevent or reverse incoming transactions. However, once suspicious deposits enter the platform, Binance takes appropriate measures.
She said, "The true measure of a crypto trading platform's compliance is its ability to identify and respond to suspicious deposits. In these areas, Binance is a leader in the industry."
However, deposits from Huione continued for months. These deposits were far from the only suspicious funds Binance received after settling with the U.S.
In February of this year, a North Korean hacking group known as Lazarus Group stole $1.5 billion in cryptocurrency from the Bybit trading platform, headquartered in Dubai, UAE, marking the largest hack in crypto history.
Within days, the North Korean hackers transferred the stolen funds into a crypto service that allows users to exchange one digital currency for another. They were converting Ethereum into Bitcoin, the most valuable cryptocurrency.
Cryptocurrency ATMs can be used to convert cash into digital currency.
Image Source: Kin Cheung/AP
All of this Ethereum ultimately had to go somewhere. According to data from crypto tracking company ChainArgos, during the same period the North Korean hackers were exchanging, five deposit accounts at Binance received an unusually large influx of $900 million in Ethereum from the same exchange service.
The funds entering Binance may no longer belong to the North Korean hackers. But in reality, the trading platform is on the other end of a series of transactions in which thieves laundered hundreds of millions of dollars in cryptocurrency, said Jonathan Reiter, CEO of ChainArgos.
Given the timing, he stated that the stolen Ethereum is "the only possible source of these funds flowing out" and should be flagged as dirty money.
"Binance should have detected these issues," he said, "even a bad—even flawed—screening tool could have caught this."
Ms. Canassa did not directly address the issue of Ethereum flows. She stated that Binance "maintains a comprehensive, multi-layered compliance program and security framework."
Pig Butchering and Smoke Screens
Last year, a father in Minnesota stumbled upon an investment opportunity. He began trading cryptocurrency according to the instructions of a family financial company with offices in Seattle and Los Angeles.
Then, his money disappeared. He was scammed out of $1.5 million.
"I and my family found ourselves in a state of financial collapse and emotional devastation," he wrote to the FBI in March. He requested anonymity to protect his privacy.
No one has recovered the stolen funds. However, according to an analysis by a crypto data company hired by the victim, over $500,000 ultimately flowed into large trading platforms, including Binance.
These scams have become one of the biggest scourges in the crypto industry, draining the accounts of elderly investors, lonely singles, and even a bank president in Kansas. According to FBI data, crypto investment scams caused victims to lose $5.8 billion last year.
Some of the most common scams are referred to as "pig butchering," a rough translation of a Chinese expression that refers to fattening an animal before slaughtering it. Many scammers pretend to have romantic interest in their victims, flirting with them for days or weeks before urging them to invest in fake projects.
Shan Hanes, president of Heartland Tri-State Bank in Elkhart, Kansas, was convicted of embezzlement last year after losing funds in a crypto scam.
Image Source: Christopher (KS) Smith/The New York Times
Cryptocurrency trading platforms can play a role in this process. They serve as convenient "outlets" for converting illegally obtained cryptocurrency into cash.
Typically, perpetrators are nearly impossible to identify. But in the Minnesota case, Binance provided a rare window into its internal systems.
Before opening accounts for customers, cryptocurrency trading platforms should require detailed personal information, a process known as "Know Your Customer" (KYC), aimed at preventing fraud.
In response to a subpoena from Minnesota law enforcement, Binance shared documents revealing the identities of two account holders, which local investigators had linked to the "pig butchering" case. The first customer transferred over $7 million within a few months in 2023 and 2024. A photo in the documents shows a woman standing in front of a corrugated metal wall, listing a family address in a Chinese village.
The second Binance document listed the name of another 24-year-old woman and a family address in rural Myanmar. This customer transferred over $2 million in the nine months leading up to mid-2024, which is 1,000 times the average annual salary in Myanmar.
Erin West, a former prosecutor who now runs a nonprofit dedicated to stopping scams, stated that these women appear to be "money mules," whose personal data may have been stolen by scammers to create fake accounts on Binance.
"This looks completely devoid of any legitimacy," Ms. West said, who reviewed these documents for The New York Times and the International Consortium of Investigative Journalists. "We see this kind of thing all the time."
Binance declined to comment on this case.
Law enforcement often has little opportunity to track thieves thousands of miles away.
Carrissa Weber, 58, a resident of Alberta, Canada, lost over $25,000 this year after being scammed by someone posing as a startup manager and urged to invest in cryptocurrency. It was her entire savings.
Ms. Weber contacted Canadian police but has not recovered her funds. "My case just sits in a file cabinet, and no one is handling it," she said.
Analysis of Ms. Weber's transaction records shows that the money she lost ultimately flowed into a few crypto wallets. All of these wallets transferred funds to OKX. Ms. Lacewell from OKX stated that the two deposit accounts receiving these funds have been under scrutiny by the trading platform since last year for exhibiting "suspicious characteristics."
OKX did not freeze these accounts until October, six months after Ms. Weber was scammed.
Illegal Inflows and Outflows
Behind a deli in Kyiv, Ukraine, through aisles filled with snacks and sodas, an electronic doorbell leads to a door marked "Currency Exchange."
Inside the small room behind the door is a business specializing in converting cryptocurrency into cash. A counting machine sits on the table, next to an old plastic calculator and a box filled with rubber bands for bundling stacks of cash.
These "crypto cash exchange" shops, found throughout Asia and Eastern Europe, are becoming a new frontier for global money laundering, according to cryptocurrency and law enforcement experts.
Anyone can walk into these shops, often without providing any personal information, and exchange large amounts of cryptocurrency for dollars, euros, or other traditional currencies. According to data from crypto analysis company Crystal Intelligence, crypto cash exchange counters in Hong Kong processed over $2.5 billion in transactions last year.
"These businesses can facilitate almost unlimited amounts of financial crime," said Richard Sanders, a crypto tracking expert who studies these counters.
Many crypto cash exchange businesses rely on large trading platforms. According to Crystal's data, last year Binance, OKX, and Bybit received a total of $531 million from these currency exchange counters. While not everyone using these services is a criminal, the anonymous nature of the transactions makes them easy to use for money laundering and other illegal financial activities.
"Many of the counters we've encountered do not require any identification documents," said Nick Smart, Chief Intelligence Officer at Crystal. "You can almost deposit any amount you want."
OKX and two other trading platforms received a total of $531 million from "crypto cash exchange" counters last year.
Image Source: Tyrone Siu/Reuters
On an afternoon in July last year, a reporter arranged a transaction via the Telegram chat app and sent $1,200 worth of cryptocurrency to the cash exchange counter at the deli in Kyiv. Within minutes, a man from the back room handed over a stack of cash bound with thick rubber bands.
He did not provide a receipt, and the Telegram chat record was immediately deleted. The counter did not respond to requests for comment.
In the following weeks, the International Consortium of Investigative Journalists collected the crypto wallet addresses used by more than a dozen such shops in Ukraine, Poland, Canada, and the UAE.
According to transaction records, most wallets received funds from large trading platforms. This indicates that customers wishing to convert digital currency into cash first withdraw funds from their accounts and then send the money to these counters for exchange.
On the 41st floor of a glass office building in Dubai, a reporter observed a customer exchanging $6,000 worth of cryptocurrency for a stack of UAE banknotes at a cash exchange business. Analysis of the crypto address for that service showed it received over $2 million in two weeks in September.
This included $303,000 from Binance.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
