Part 2: Common Laundering Techniques and Laundering Infrastructure

Common Money Laundering Techniques in Cryptocurrency

Understanding laundering techniques is essential for blockchain investigators, security researchers, AML analysts, and compliance teams.

It is important to emphasize that these techniques are discussed strictly from a defensive, investigative, and educational perspective.

The purpose of this section is to help researchers understand how criminal actors attempt to obscure transaction trails and how investigators identify those efforts.

Chain Hopping

What Is Chain Hopping?

Chain hopping refers to the movement of digital assets across multiple blockchain networks.

Rather than keeping assets on a single blockchain, criminal actors may transfer value between different chains in an attempt to increase transaction complexity.

Examples may involve movement between:

• Bitcoin
• Ethereum
• Base
• BNB Chain
• Tron
• Polygon
• Arbitrum
• Solana

Why Criminals Use It

The primary objective is often to create additional investigative hurdles.

Criminal actors may incorrectly assume that moving funds across several ecosystems will eliminate forensic visibility.

Investigative Indicators

Analysts often monitor:

• Repeated cross chain activity
• Rapid asset conversions
• Unusual bridge interactions
• High frequency network transitions

Detection Methods

Investigators increasingly rely on:

• Cross chain analytics
• Entity attribution databases
• Behavioral analysis
• Multi network transaction correlation

Key Research Insight

Modern blockchain forensic platforms increasingly support cross chain tracing, significantly reducing the effectiveness of chain hopping as an evasion strategy.

Cross Chain Bridges

What Are Bridges?

Cross-chain bridges facilitate movement of assets between blockchain ecosystems.

Bridges are essential components of modern decentralized finance.

However, they have also become prominent components in many laundering investigations.

Why Launderers Use Bridges

Bridges may be used to:

• Increase transaction complexity
• Separate funds from the original crime scene
• Move assets into different ecosystems

Investigative Indicators

Investigators watch for:

• Repeated bridge usage
• Large bridge transfers
• Sequential bridge activity
• Immediate post-bridge asset movement

Detection Methods

Detection often relies on:

• Bridge monitoring
• Wallet clustering
• Transaction graph analysis
• Behavioral fingerprinting

Security Perspective

Many major cryptocurrency investigations involve bridge activity at some stage of the laundering process.

As a result, bridges are increasingly monitored by forensic platforms and compliance teams.

Mixing Services

What Are Mixing Services?

Mixing services are designed to obscure relationships between transaction inputs and outputs.

Historically, some have marketed themselves as privacy tools.

However, numerous investigations have demonstrated their use in laundering stolen cryptocurrency.

Criminal Objective

The goal is generally to make transaction tracing more difficult by reducing visibility into direct fund relationships.

Investigative Indicators

Analysts commonly monitor:

• Known mixer interactions
• Exposure scores
• Indirect mixer exposure
• Transaction graph anomalies

Detection Methods

Detection may involve:

• Heuristic analysis
• Pattern recognition
• Cluster analysis
• Exposure tracing

Law Enforcement Perspective

Many enforcement actions worldwide have specifically targeted laundering infrastructures associated with illicit activity.

CoinJoin Systems

What Is CoinJoin?

CoinJoin is a transaction coordination mechanism primarily associated with Bitcoin privacy practices.

It combines multiple participant transactions into larger aggregated transactions.

Criminal Use Cases

Some illicit actors have attempted to use CoinJoin systems to complicate forensic analysis.

Investigative Indicators

Indicators may include:

• Known CoinJoin transaction structures
• Characteristic transaction patterns
• Coordinated wallet activity

Detection Methods

Researchers often apply:

• Transaction graph analysis
• Wallet behavior analysis
• Cluster reconstruction

Important Reality

CoinJoin may increase investigative complexity but does not necessarily eliminate traceability.

Layering Through Multiple Wallets

Overview

One of the most common laundering behaviors involves transferring assets through large numbers of wallets.

This is often referred to as wallet fragmentation.

Purpose

Criminal actors may attempt to:

• Create confusion
• Increase analyst workload
• Break apparent transaction chains

Investigative Indicators

Common indicators include:

• Hundreds of intermediary wallets
• Consistent transfer amounts
• Repetitive transaction structures
• Rapid wallet creation

Detection Methods

Analysts use:

• Wallet clustering
• Graph analytics
• Temporal analysis
• Behavioral profiling

Research Observation

Large wallet networks often reveal patterns that become easier to identify at scale.

Decentralized Exchanges (DEXs)

What Are DEXs?

Decentralized exchanges facilitate asset swaps without centralized custodians.

Examples include:

• Automated market makers
• Liquidity based exchanges
• Onchain swap protocols

Criminal Objective

Launderers may use DEXs to:

• Convert assets
• Diversify holdings
• Increase transaction complexity

Investigative Indicators

Analysts watch for:

• Frequent token swaps
• High volume conversions
• Unusual trading behavior
• Rapid asset diversification

Detection Methods

Investigation teams may analyze:

• Trading behavior
• Smart contract interactions
• Wallet relationships
• Timing patterns

NFT Wash Trading

What Is NFT Wash Trading?

Wash trading occurs when the same actor appears on both sides of a transaction.

The purpose may include:

• Artificial volume generation
• Market manipulation
• Potential laundering activity

Investigative Indicators

Researchers examine:

• Repeated counterparties
• Circular ownership patterns
• Abnormal pricing
• Coordinated wallet activity

Detection Methods

Detection often involves:

• Ownership graph analysis
• Market anomaly detection
• Entity clustering

DeFi Protocols

Why DeFi Matters

The decentralized finance ecosystem provides access to:

• Lending platforms
• Borrowing markets
• Liquidity pools
• Yield protocols
• Derivatives systems

These protocols represent major innovation but can also appear within laundering investigations.

Criminal Objectives

Potential objectives may include:

• Increasing transaction complexity
• Diversifying asset exposure
• Creating multiple transaction pathways

Investigative Indicators

Analysts often monitor:

• Rapid protocol hopping
• Abnormal liquidity interactions
• High risk wallet participation

Detection Methods

Common approaches include:

• Smart contract tracing
• Protocol interaction analysis
• Risk scoring

OTC Brokers

What Are OTC Brokers?

Over the counter (OTC) brokers facilitate large transactions outside traditional exchange order books.

Investigative Relevance

Certain illicit actors have historically attempted to use OTC channels to convert digital assets.

Detection Indicators

Investigators may examine:

• Large transfers
• OTC-associated wallets
• Exchange withdrawal patterns

Detection Approaches

Compliance teams frequently apply:

• Customer due diligence
• Enhanced monitoring
• Transaction reviews

Shell Companies

Overview

Shell companies remain relevant in both traditional and cryptocurrency-related financial crime investigations.

Potential Role

They may be used to:

• Obscure ownership structures
• Conceal beneficial owners
• Create legitimacy narratives

Detection Opportunities

Investigators often combine:

• Corporate records
• Blockchain intelligence
• Banking intelligence
• Public filings

Money Mule Networks

Definition

Money mules are individuals who knowingly or unknowingly facilitate movement of illicit proceeds.

Investigative Indicators

Analysts monitor:

• Multiple unrelated deposits
• Unusual account activity
• Repeated high-risk counterparties

Detection Methods

Detection may involve:

• Network analysis
• Identity verification
• Financial intelligence sharing

Privacy Focused Cryptocurrencies

Overview

Certain cryptocurrencies incorporate enhanced privacy features.

These technologies may reduce transaction visibility compared to fully transparent blockchains.

Investigative Challenges

Investigators may encounter:

• Reduced visibility
• Limited attribution opportunities
• Smaller intelligence datasets

Detection Methods

Researchers often rely more heavily on:

• Exchange intelligence
• OSINT investigations
• Infrastructure analysis
• Offchain evidence

Infrastructure Commonly Used by Launderers

Understanding laundering infrastructure is critical because investigators rarely focus on individual transactions alone.

Instead, they map entire ecosystems.

Wallet Infrastructure

Wallets represent the foundational layer of cryptocurrency ecosystems.

Investigators typically categorize wallets into:

• Victim wallets
• Attacker wallets
• Consolidation wallets
• Distribution wallets
• Exchange deposit wallets

Understanding wallet relationships is often the starting point of forensic investigations.

Centralized Exchanges (CEXs)

Centralized exchanges frequently become critical investigative touchpoints.

Why?

Because exchanges often possess:

• Customer records
• Identity verification data
• Login history
• Device intelligence
• Compliance records

For investigators, exchange interactions often create opportunities to connect blockchain activity with real world identities.

Decentralized Exchanges (DEXs)

DEXs introduce additional complexity because users interact directly through smart contracts.

Investigators therefore focus on:

• Wallet behavior
• Smart contract interactions
• Liquidity activity
• Trading patterns

Cross Chain Bridge Ecosystems

Bridge infrastructure has become increasingly important.

Investigators often map:

Victim Wallet

↓

Attacker Wallet

↓

Bridge Interaction

↓

Destination Chain Wallet

↓

Exchange Deposit Wallet

This simplified model helps analysts understand asset movement across ecosystems.

Mixing Infrastructure

Investigators commonly build transaction maps showing:

Source Wallets

↓

Aggregation Layer

↓

Obfuscation Layer

↓

Distribution Layer

↓

Cash Out Attempts

Such mappings help reveal broader laundering ecosystems rather than isolated transactions.

Privacy Infrastructure

Privacy focused services may include:

• Privacy wallets
• Privacy protocols
• Enhanced confidentiality technologies

Investigators increasingly study behavioral patterns surrounding these technologies.

Peer to Peer Marketplaces

P2P platforms facilitate direct user-to-user transactions.

These marketplaces may appear during investigations involving:

• Fraud
• Money mule networks
• Illicit asset conversion

Telegram Based Criminal Services

Threat intelligence reporting has increasingly identified criminal service providers operating through messaging platforms.

Examples may include:

• Fraud networks
• Laundering facilitators
• Scam operators

Investigators often combine blockchain intelligence with communication platform intelligence.

Laundering as a Service (LaaS)

A growing concern within threat intelligence circles is the emergence of criminal service ecosystems.

These networks may provide:

• Obfuscation services
• Financial crime support
• Infrastructure access

Researchers increasingly view these ecosystems as organized cybercrime supply chains.

Key Takeaways

✅ Most laundering relies on ecosystem complexity rather than true anonymity.

✅ Cross-chain activity has become a major investigative focus.

✅ Wallet clustering remains one of the most powerful forensic techniques.

✅ Bridges, DEXs, mixers, and OTC channels frequently appear in laundering investigations.

✅ Modern blockchain analytics significantly reduces the effectiveness of many historical laundering techniques.