Original Article Title: The Crypto Industry’s $28 Billion in "Dirty Money"
Original Article Authors: David Yaffe-Bellany, Spencer Woodman, Sam Ellefson
Translation: Peggy, BlockBeats

Editor's Note: In recent years, the cryptocurrency industry has rapidly expanded globally. However, accompanying this growth are increasingly severe issues of money laundering, fraud, and regulatory loopholes. The opaque flow of funds reveals a concerning reality: major exchanges are not only hubs for digital asset trading but may also serve as "gateways" for illicit funds.

This article, based on an in-depth investigation by The New York Times and the International Consortium of Investigative Journalists, outlines the details of high-risk fund transactions between exchanges like Binance and OKX. It exposes regulatory failures, technical vulnerabilities, and how criminal networks leverage the crypto ecosystem to launder massive sums of money. Meanwhile, ordinary investors have suffered significant losses in scams, ranging from Ponzi schemes to fake investment platforms, creating a new breeding ground for global financial crime.

The following is the original article:

President Trump founded his own cryptocurrency company and vowed to make the U.S. the global "crypto capital." Cryptocurrency companies have touted their security and reliability, leading a range of major industries from Wall Street banks to online retailers to experiment with digital currency.

However, despite the gradual mainstream acceptance of the crypto industry, at least $28 billion linked to illicit activities flowed into cryptocurrency exchanges over the past two years. This data comes from a collaborative investigation by the International Consortium of Investigative Journalists, The New York Times, and 36 other global news outlets.

This funding originates from hackers, thieves, and ransomware operators and traces show their connections to North Korean cybercriminals and fraud syndicates stretching from Minnesota in the U.S. to Myanmar. The investigation repeatedly reveals these groups continuously funneling funds into the world's largest exchanges. These exchanges are online markets where individuals can convert dollars or euros into cryptocurrencies like Bitcoin and Ethereum.

One of the recipients of this "dirty money" is the world's largest cryptocurrency exchange Binance, which struck a $20 billion business deal with Trump's crypto enterprise in May. According to the investigation, these funds also flowed into at least 8 other prominent exchanges, including OKX, a global platform with an expanding influence in the U.S.

"Law enforcement agencies are overwhelmed by the overwhelming illegal activities in this space," stated Julia Hardy, co-founder of the crypto investigation firm zeroShadow. "This situation cannot continue."

The early days of cryptocurrency were dominated by thieves and drug dealers who were attracted to the speed and anonymity of cryptocurrency, making it an ideal tool for money laundering. The most popular cryptocurrency, Bitcoin, once powered dark web markets where vendors sold drugs and other contraband, leading to numerous drug overdose deaths and criminal charges.

Since then, the crypto industry has experienced exponential growth and has gradually professionalized, with legitimate daily transaction volumes reaching billions of dollars. The largest exchanges have pledged to combat criminals exploiting cryptocurrency to move funds. In 2023, Binance admitted to violating anti-money laundering regulations and agreed to pay a $4.3 billion fine to the U.S. government after previously facilitating transactions for terrorist organizations like Hamas and Al-Qaeda. Last year, the company claimed that the crypto industry had become a "highly unwelcoming place for bad actors."

Donald Trump's two sons, Eric on the left and Donald on the right, are pointing to a promotional event for the family's crypto business, World Liberty Financial.
Image Source: Eduardo Munoz/Reuters

Meanwhile, Mr. Trump has made cryptocurrency a core of his family business and has lifted regulatory pressure on the industry. Shortly before the 2024 election, he and his two sons founded World Liberty Financial, a crypto startup expected to generate tens of millions of dollars in revenue annually through business dealings related to Binance. Last month, Mr. Trump pardoned Binance's founder, Changpeng Zhao, who served four months in prison after a plea agreement.

The Trump administration also weakened law enforcement's ability to combat crypto crime. In April of this year, the Justice Department disbanded a cryptocurrency enforcement team, stating that prosecutors should focus on tackling terrorists and drug traffickers using cryptocurrency while avoiding cases against "platforms these companies use for illicit activities."

The analysis by The New York Times and its partners provides only a partial view of illicit funds on trading platforms, as many criminal accounts have not been publicly identified. However, this analysis marks the first systematic attempt to track the flow of these funds on specific platforms, which are often not individually listed by analytics firms that collect the most comprehensive data.

Whether exchanges are acting illegally is a complex issue. Companies dealing with illicit funds may still fulfill legal obligations, such as hiring compliance officers to combat fraud. However, in the U.S., crypto companies have been prosecuted under the Bank Secrecy Act for failing to establish robust internal systems to prevent money laundering.

The analysis section relies on overall data aggregated by the analysis company Chainalysis, but did not identify specific exchanges. The New York Times and the International Consortium of Investigative Journalists also used public records and consulted forensic experts to identify crypto accounts linked to criminals. Crypto transaction records are on public ledgers, allowing the flow of funds to be traced back to specific exchanges.

Binance founder Changpeng Zhao has deposited over $400 million in cryptocurrency to Binance through the Cambodian firm Huione Group since 2023.
Image Source: Grant Hindsley/The New York Times

The investigation results include:

- Since Binance's admission of guilt, the exchange has received over $400 million in deposits from the Huione Group, a Cambodian entity flagged by the U.S. Treasury for criminal activities. This year, an additional $900 million flowed into Binance's deposit address from a North Korean hacker's money laundering exchange.

- OKX has received over $220 million in deposits from Huione within five months of reaching a $504 million settlement with the U.S. government for violating money transmission laws.

- According to Chainalysis data, global crypto exchanges received at least $4 billion in funds linked to fraud in 2024. The New York Times and the Consortium of Journalists interviewed two dozen victims of crypto scams whose funds ultimately flowed into Binance, OKX, and other major exchanges like Bybit and HTX.

- Last year, over $500 million flowed into Binance, OKX, and Bybit from so-called "crypto-cash desks," businesses that allow individuals to convert cryptocurrency into cash. Many of these businesses operate in offices or storefronts, serving a variety of customers while providing convenient avenues for criminals to cash out their digital assets.

Binance spokesperson Heloiza Canassa stated that "security and compliance are the most important pillars" for the company and mentioned that since its establishment in 2017, Binance has responded to over 240,000 law enforcement requests, with 65,000 requests just last year.

OKX Chief Legal Officer Linda Lacewell stated that the company collaborates with law enforcement to "help stop fraud and other illicit activities" and has invested heavily in compliance, transaction monitoring, and fraud detection tools.

HTX did not respond to a request for comment, while a Bybit spokesperson stated that the company enforces a "strict zero-tolerance financial crime policy." A White House spokesperson declined to comment, with a representative from World Liberty stating that the company sees Binance as the exchange market for its tokens rather than a business partner.

The destination of money laundering funds once they enter a trading platform is hard to determine; at this point, the flow of funds has been obfuscated. The trading platform may quickly detect illicit activities and freeze funds or hand them over to law enforcement. However, undetected illicit funds bring transaction fee revenue to the trading platform, usually charging a small percentage fee based on the transaction amount.

"If they kick the criminal off the platform, then they lose a significant source of revenue," said John Griffin, a cryptocurrency expert at the University of Texas at Austin. "They are incentivized to keep this activity going."

The "Issue" with Cryptocurrency Exchanges

The Huione Group wields significant influence in Cambodia. As a financial group, it provides banking, payment, and insurance services. Customers can use its QR code to purchase groceries and pay restaurant bills.

However, these businesses conceal a more sinister enterprise.

Over the years, Huione has also operated a vast digital marketplace, described by an expert as a "criminals' Amazon," where online merchants sell stolen personal data, scam tech support, and money laundering services. According to law enforcement sources, the company has facilitated fund transfers for North Korean hackers and Southeast Asian scam networks.

In May of this year, the U.S. Treasury took action to block Huione from using the U.S. banking system, calling it a "key node" in online theft and investment fraud targeting Americans.

During this time, Huione has maintained financial ties with Binance and OKX.

In a Chinese-language financial report released last year, Huione disclosed multiple cryptocurrency wallet addresses, which consist of long strings of letters and numbers used to identify accounts on a digital currency transaction ledger. Analysis of these wallets revealed that from July 2024 to July 2025, over $400 million flowed from Huione into the Binance platform. In the first five months of this year, OKX received deposits of over $220 million from these wallets.

Funds continue to flow following the announcement by the Treasury Department on May 1. According to a consortium of journalists' analysis, these wallets deposited at least $77 million into Binance and $161 million into OKX over the next two and a half months.

Huione branch in Phnom Penh, Cambodia. The U.S. government has identified Huione as a "critical node" in online theft and investment fraud.
Image Source: Chang W. Lee/The New York Times

Binance and OKX have had previous records of violating financial regulations, leading to criminal settlements with the U.S. government. Both companies have committed to reforming their practices.

Ms. Lacewell of OKX stated that even before May, the company had implemented "enhanced transaction monitoring" for a wallet address identified in the Huione report. She mentioned that in October, the company "suspended all interactions between OKX wallets and Huione."

Ms. Canassa of Binance stated in a declaration that the exchange platform cannot prevent or reverse incoming transactions. However, once suspicious deposits enter the platform, Binance takes appropriate action.

She said: "The true measure of a cryptocurrency exchange platform's compliance is its ability to identify and address suspicious deposits. In these aspects, Binance is a leader in the industry."

Nevertheless, deposits from Huione have continued for months. And these deposits are far from the only suspicious funds received by Binance post-settlement with the U.S.

In February of this year, a North Korean hacker group called the Lazarus Group stole $1.5 billion in cryptocurrency from Bybit, a Dubai-based exchange, marking the largest hack in crypto history.

Within days, the North Korean hackers laundered the stolen funds through a crypto service that allows users to convert one digital currency to another. They were converting Ether to Bitcoin, the most valuable cryptocurrency.

Cryptocurrency Automated Teller Machines (A.T.M.s) can be used to convert cash to digital currency.
Image Source: Kin Cheung/AP

All of this Ether must ultimately flow somewhere. According to data from the crypto-tracking firm ChainArgos, during the same period when North Korean hackers were cashing out, five of Binance’s deposit accounts received a sudden surge of $9 billion worth of Ether from the same cash-out service.

The funds flowing into Binance may no longer belong to the North Korean hackers. But in reality, the exchange is at the other end of a series of transactions in which thieves laundered hundreds of millions of dollars’ worth of cryptocurrency, said Jonathan Reiter, CEO of ChainArgos.

Given the timing, he said the stolen Ether was the “sole possible source of these outflows” and should be marked as illicit.

“Binance should have caught these issues,” he said. “Even a bad—indeed, a flawed—screening tool can pick this up.”

Ms. Canassa did not directly address the movement of Ether. She said Binance maintains a “comprehensive, multilayered compliance plan and security framework.”

Rug Pulls and Smoke Screens

Last year, a father in Minnesota stumbled upon an investment opportunity. He started trading cryptocurrencies following the instructions of a family finance company with offices in Seattle and Los Angeles.

Then, his money vanished. He was scammed out of $1.5 million.

“My family and I are in financial ruin and emotional devastation,” he wrote in March to the Federal Bureau of Investigation (FBI), requesting anonymity for privacy.

No one recovered the stolen funds. But according to an analysis by a crypto data firm hired by the victim, over $500,000 eventually flowed to major exchanges, including Binance.

These scams have become one of the crypto industry’s most pernicious afflictions, emptying the pockets of elderly investors, lonely singles, and even a bank president in Kansas. According to FBI data, cryptocurrency investment scams cost victims $5.8 billion last year.

Some of the most common scams are known as “rug pulls,” a rough translation of a Chinese expression referring to fattening up an animal before slaughter. Many scammers pretend to have a romantic interest in victims, engaging in days or weeks of flirtation before urging them to invest in a false project.

Heartland Tri-State Bank President Shan Hanes (center) in Elkheart, Kansas, was sentenced for embezzlement last year after losing funds in a cryptocurrency scam.
Image Source: Christopher (KS) Smith/The New York Times

Cryptocurrency exchanges can play a role in this process. They serve as convenient "off-ramps," facilitating the conversion of illegally obtained cryptocurrency into cash.

Usually, the perpetrators remain largely anonymous. However, in a Minnesota case, Binance provided a rare window into its internal systems, allowing a glimpse into the situation.

Prior to onboarding customers, cryptocurrency exchanges are expected to request detailed personal information, a process known as "Know Your Customer" (KYC) designed to prevent fraud.

In response to a subpoena from Minnesota authorities, Binance shared documents revealing information on two account holders, linking these accounts to a "rug pull" scheme. The first client moved over $7 million within a few months in 2023 and 2024. A photo in the documents showed a woman standing in front of a corrugated metal wall, listing a rural Chinese family address.

The second set of Binance documents listed the name of another 24-year-old woman and a rural family address in Myanmar. This client transferred over $2 million within nine months up to mid-2024, equating to 1000 times the average annual salary in Myanmar.

Erin West, a former prosecutor running a nonprofit dedicated to fraud prevention, stated that these women appear to be "money mules," with their personal data potentially stolen by scammers to create bogus accounts on Binance.

"It doesn’t look legitimate at all," Ms. West said, reviewing these documents for The New York Times and the International Consortium of Investigative Journalists. "We see this sort of thing frequently."

Binance declined to comment on the case.

Law enforcement agencies often have little opportunity to track thieves operating thousands of miles away.

Carrissa Weber, a 58-year-old resident of Alberta, Canada, lost over $25,000 this year. She was scammed by an impostor posing as a startup company executive, encouraging her to invest in cryptocurrency. This represented her entire life savings.

Ms. Weber contacted the Canadian police but has not yet recovered the funds. "My case is just sitting in a filing cabinet, unactioned," she said.

An analysis of Ms. Weber's transaction records revealed that the money she lost ultimately flowed into a few specific cryptocurrency wallets. These wallets all funneled the funds to OKX. Ms. Lacewell of OKX stated that two receiving accounts that accepted these funds have been under scrutiny by the exchange since last year due to exhibiting "suspicious characteristics."

OKX only froze these accounts in October, six months after Ms. Weber was scammed.

Illegal Money Laundering

Behind a deli in Kyiv, Ukraine, past shelves stocked with snacks and sodas, an electronic doorbell leads to a door labeled "Currency Exchange."

Inside the small room behind the door is a business specializing in converting cryptocurrency into cash. On the table sits a cash counting machine, next to an old-school plastic calculator, and a paper box filled with rubber bands for bundling stacks of bills.

These "crypto-to-cash" storefronts scattered across Asia and Eastern Europe are emerging as the new frontier of global money laundering, according to cryptocurrency and law enforcement experts.

Anyone can walk into these shops, often without providing any personal information, and convert large amounts of cryptocurrency into dollars, euros, or other traditional currencies. According to the data from the crypto analytics company Crystal Intelligence, the crypto-to-cash counters in Hong Kong processed over $2.5 billion in transactions last year.

"These businesses can facilitate almost limitless amounts of financial crime," said Richard Sanders, a crypto tracking expert studying these counters.

Many crypto-to-cash businesses rely on major exchanges. According to Crystal's data, Binance, OKX, and Bybit collectively received $531 million from these cash exchange counters last year. While not everyone using these services is a criminal, the anonymous nature of the transactions makes them susceptible to money laundering and other illegal financial activities.

"Many of the counters we've encountered don't require any form of identification," said Nick Smart, Chief Intelligence Officer of Crystal. "You can pretty much walk in and deposit any amount."

OKX and two other exchanges collectively received $531 million from "crypto-to-cash" counters last year.
Image Source: Tyrone Siu/Reuters

One afternoon in July last year, a journalist arranged a transaction via the Telegram messaging app, sending $1,200 worth of cryptocurrency to a Kiev deli’s cash desk for cash-out. Within minutes, a man from the back room handed over a stack of banknotes bound with a thick rubber band.

No receipt was provided, and the Telegram chat record was immediately deleted. The cash desk did not respond to a request for comment.

In the following weeks this year, the International Consortium of Investigative Journalists gathered more than a dozen cryptocurrency wallet addresses used by similar storefronts in Ukraine, Poland, Canada, and the UAE.

According to transaction records, most wallets received funds from major exchanges, indicating that customers looking to exchange digital currency for cash first withdraw funds from their own accounts and then send the money to these desks for conversion.

On the 41st floor of a glass office tower in Dubai, a customer was observed by a journalist exchanging $6,000 worth of cryptocurrency for a stack of UAE banknotes in a cash-out operation. An analysis of the service’s crypto address showed it received over $2 million in a two-week period in September.

This included $303,000 from Binance.

「Original Article Link」

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia