Crypto Money Laundering: Red Flags and What the Evidence Shows

A screening alert links an incoming crypto payment to an exchange that has also received fraud proceeds. The compliance team needs to know what that link means. Did the payment itself have a documented connection to the fraud, or did both transactions simply touch the same service?

Crypto money laundering investigations turn on that distinction. Transaction records establish part of the sequence. Evidence about the customer, account and commercial purpose is needed to interpret it.

Key takeaways

• Crypto money laundering can involve proceeds generated on-chain or money from an offence that took place outside the crypto sector.
• A blockchain record may verify a transfer. It does not necessarily identify the person who instructed it or establish the source of funds.
• Direct transaction exposure, indirect exposure and use of a shared service are different findings.
• Privacy tools, cross-chain transfers and self-custody can have legitimate uses. Assess them in context.
• Separate confirmed facts, attribution assumptions and unresolved questions before escalating a case.

What Is Crypto Money Laundering?

Crypto money laundering involves using cryptoassets to handle criminal proceeds or disguise their origin, ownership or movement. The precise legal definition depends on the jurisdiction. The underlying offence might be an exchange theft or ransomware attack. It might also be an investment fraud in which victims initially paid through bank accounts.

The traditional model describes placement, layering and integration: introducing proceeds into financial channels, obscuring their link to the underlying offence and using them as apparently legitimate funds. These are analytical categories, not a required sequence. A theft that generates proceeds in crypto does not require an initial cash-to-crypto conversion. Criminal proceeds can also be held or spent without conversion back to conventional currency.

A UK case illustrates why the underlying offence matters. In November 2025, Zhimin Qian was sentenced at Southwark Crown Court after pleading guilty to acquiring and possessing criminal property in cryptocurrency. The Crown Prosecution Service linked the seized bitcoin to an investment fraud in China. The investigation concerned the origin of the assets, not simply the fact that they were held in bitcoin.

Which Crypto Transactions Warrant Closer Review?

A pattern is useful when it raises a question that the team can test. Consider:

• Activity inconsistent with the customer’s profile. The value, frequency or counterparties do not fit the declared business activity or expected use of the account.
• An unexplained third-party payment. The party funding a transaction is not the party named in the contract, and the relationship has not been substantiated.
• A documented connection to a high-risk address. Evidence links the address to a specific fraud, theft or other illicit activity. The analyst still needs to establish how that address relates to the transaction under review.
• Inconsistencies in the source-of-funds explanation. The documents do not reconcile with the payment amount, timing, counterparties or stated purpose.
• Complex activity without a credible explanation. Transfers across services, assets or networks are difficult to reconcile with the customer’s stated activity. Complexity alone is not evidence of laundering.

The same pattern can have different explanations. Rapid transfers may reflect routine treasury activity. A self-custody wallet may be used for legitimate security reasons. The question is whether the available evidence supports the explanation in this case.

Case findings can inform a wider AML risk assessment. They should not be treated as proof that all customers using the same product or service present the same risk.

What Can Blockchain Analysis Establish?

On many public blockchains, transaction records can show when a transfer occurred, the asset and amount involved, and the addresses recorded on the network. Analysts can reconstruct parts of the transaction history and identify potential connections to other addresses or services.

Attribution is a separate task. A label may link an address to a custodian or exchange. It may not identify the individual account holder. A group of addresses that appears to operate together is an analytical inference unless further evidence establishes common control.

The public record also does not ordinarily show the commercial purpose of a transfer. An exchange can credit or debit customer balances in its own systems without publishing each account movement on-chain. Once the analysis reaches that boundary, the team needs other records or must state what remains unknown.

One Exchange, Two Customers: The Attribution Test

Consider a hypothetical payment of 12,000 USDC from an address attributed to a centralised exchange. An alert also identifies fraud proceeds sent to a deposit address associated with that exchange. Both findings carry the same service label.

That label does not establish that the payer controlled the fraud-linked account or that the outgoing payment was funded by the fraud proceeds. The exchange may hold or transfer assets for many customers.

Before drawing a conclusion, test three separate claims:

1. Transaction: Which transfers can you verify on the relevant network? Record the transaction identifiers, asset, amounts and dates.
2. Attribution: What connects each address to the service? Is there evidence linking either transfer to a specific customer account, or does the attribution stop at the exchange?
3. Source and purpose: Can the payment be reconciled with records the team is authorised to review, such as an exchange statement, invoice or customer explanation? Do those records explain the source of the funds, or only the immediate payment?

A defensible report might say: “The payment originated from an address attributed to the exchange. A separate fraud-linked transfer also reached that service. The evidence reviewed does not establish that the transactions involved the same customer or funds.”

That wording preserves the risk signal without overstating the connection. If the gap is material, the compliance team can decide what further evidence to seek and whether escalation is warranted.

What to Document Before Escalating a Case

Keep a chronology that another reviewer can reproduce. Record:

• Observed transfers: the network, asset, transaction identifiers and dates.
• Address or service attributions: the source, date and limitations of each label.
• Off-chain evidence: relevant payment records, customer information, agreements and corporate records obtained through authorised channels.
• Competing explanations: what the evidence supports, what it contradicts and what it does not resolve.
• Decision: who reviewed the issue, what remained uncertain and why it was escalated or closed.

Where companies or intermediaries appear in the trail, establish their role rather than assuming it. Shell company research can help examine whether an entity’s stated purpose and ownership match the payment explanation. It cannot establish wallet control without evidence linking the company to the relevant address or account.

Reporting obligations and restrictions depend on the firm and jurisdiction. Refer those decisions to the responsible compliance team or legal counsel. A risk score is not a legal finding.

Where Molfar Intelligence Can Help

Molfar Intelligence’s AML investigations examine the people, companies, ownership links and payment explanations behind a financial crime concern. Where a case starts with a crypto alert, this work can complement specialist blockchain analysis by testing the off-chain claims on which attribution depends.

To scope a review, identify the transaction or counterparty, the evidence already available and the question your team needs to resolve. The investigation does not replace the firm’s AML responsibilities, legal advice or specialist on-chain analysis.

FAQ

Can investigators identify a person from a public wallet address alone?

Generally not. An address is an identifier on a network, not a verified identity. Linking it to a person or company typically requires additional evidence, such as reliable service attribution, account records or other corroboration. If the evidence identifies only an exchange, report that limit.

Does a payment from a regulated crypto exchange prove the funds are legitimate?

No. The exchange may be the immediate sender or custodian. That does not establish the customer’s underlying source of funds. Review the specific payment, account evidence and commercial explanation rather than relying on the provider’s status alone.

Is indirect exposure to a fraud-linked wallet enough to conclude money laundering?

No. Establish what the reported exposure represents. A documented transfer path differs from a connection inferred through a shared service. Assess the reliability of the attribution, the relevance to the payment and any additional evidence before drawing conclusions.

Can crypto money laundering start with an ordinary bank transfer?

Yes. The original offence may take place outside the crypto sector, with the proceeds later moved into cryptoassets. The records needed to explain where the money came from may therefore include bank, payment, corporate and customer records as well as blockchain data.