As President Trump pushes for cryptocurrency and the crypto industry gradually enters the mainstream, funds from scammers and various criminal groups are continuously flowing into major cryptocurrency exchanges.
Written by: David Yaffe-Bellany, Spencer Woodman, and Sam Ellefson
Translated by: Luffy, Foresight News
President Trump has founded his own cryptocurrency business and vowed to make the U.S. the global "cryptocurrency capital." Cryptocurrency companies are claiming that their platforms are safe and reliable, and many mainstream industries, from Wall Street banks to online retailers, are also testing the waters of cryptocurrency business.
However, according to a joint investigation by the International Consortium of Investigative Journalists, The New York Times, and 36 other news organizations, even though the cryptocurrency industry has gained mainstream recognition, at least $28 billion in illicitly linked funds has flowed into cryptocurrency exchanges over the past two years.
These funds come from hackers, thieves, and extortionists, with sources ranging from North Korean cybercrime groups to scam organizations operating from Minnesota in the U.S. to Myanmar. Investigative analysis shows that these criminal groups repeatedly transfer funds to leading global cryptocurrency exchanges, which allow for the exchange of dollars, euros, and cryptocurrencies like Bitcoin and Ethereum.
Binance, the world's largest cryptocurrency exchange, is one of the recipients of this "dirty money." In May of this year, Binance reached a $2 billion commercial cooperation agreement with Trump's cryptocurrency company. The investigation also revealed that dirty money has simultaneously flowed into at least eight other well-known exchanges, including the globally expanding exchange platform OKX in the U.S. market.
Julia Hardy, co-founder of the cryptocurrency investigation firm zeroShadow, pointed out, "Law enforcement is simply unable to cope with the endless illegal activities in this field, and this situation cannot continue."
In the early days of cryptocurrency development, it became a gathering place for thieves and drug dealers. The fast transaction speed and anonymity of cryptocurrencies make them excellent tools for money laundering. As the most representative virtual currency, Bitcoin once provided transaction support for dark web markets, where illegal vendors sold drugs and other prohibited items.
Subsequently, the cryptocurrency industry has grown exponentially, gradually becoming more specialized, with daily legal trading volumes reaching billions of dollars. Leading exchanges have promised to combat the criminal use of cryptocurrencies for money transfer. In 2023, Binance admitted to committing money laundering-related crimes for processing transactions for terrorist organizations like Hamas and Al-Qaeda, agreeing to pay a $4.3 billion fine to the U.S. government. Last year, Binance also claimed that the cryptocurrency industry "will not tolerate criminals."
President Trump's sons Eric and Donald point to a promotional event that includes the Trump family's cryptocurrency business, World Liberty Financial.
Meanwhile, Trump has listed cryptocurrency business as a core part of the family business and has terminated regulatory crackdowns on the industry. On the eve of the 2024 election, he and his sons co-founded a cryptocurrency startup called World Liberty Financial. With cooperation from Binance, this company is expected to achieve annual revenues of tens of millions of dollars. Last month, Trump pardoned Binance founder Changpeng Zhao, who had previously been sentenced to four months in prison due to a company plea agreement.
The Trump administration has also weakened law enforcement's ability to hold cryptocurrency criminals accountable. In April of this year, the U.S. Department of Justice disbanded a specialized law enforcement team for cryptocurrency crimes, stating that prosecutors should focus on targeting terrorists and drug dealers using cryptocurrencies, rather than holding "the platforms that these criminal organizations rely on for illegal activities" accountable.
Since many criminal accounts have not been publicly exposed, the investigation by The New York Times and its partner organizations only reveals the tip of the iceberg regarding the issue of illegal funds in exchanges. However, this is the first systematic funding tracking investigation targeting specific platforms.
Whether exchanges are suspected of illegal activities requires specific analysis. Even if they handle dirty money, some companies may still be fulfilling their legal responsibilities, such as equipping compliance personnel to screen for fraud. However, in the U.S., if a cryptocurrency company fails to establish a robust internal anti-money laundering mechanism, it may be sued for violating the Bank Secrecy Act.
This investigation partially relied on data from blockchain analysis company Chainalysis (which did not specify the exchanges involved). The New York Times and the International Consortium of Investigative Journalists also used public records and consulted forensic experts to identify cryptocurrency accounts linked to criminal activities. Since cryptocurrency transaction records are recorded in a public ledger, the flow of funds can be traced to specific exchanges.
Binance founder Changpeng Zhao
Key findings of the investigation include:
After Binance's guilty plea, the Cambodian Huayuan Group transferred over $400 million to its accounts. The Huayuan Group has been designated as a criminal entity by the U.S. Treasury. Additionally, this year, $900 million in funds flowed into Binance's deposit accounts, all from a platform used by North Korean hackers for money laundering.
In February of this year, OKX reached a $504 million settlement with the U.S. government for violating funds transfer laws. Within five months of the agreement, the platform received over $220 million from the Huayuan Group.
Data from Chainalysis shows that in 2024, global cryptocurrency exchanges received at least $4 billion in scam-related funds. The New York Times and the International Consortium of Investigative Journalists interviewed 24 victims of cryptocurrency scams, and the funds they lost ultimately flowed into major exchanges like Binance, OKX, Bybit, and HTX.
Last year, over $500 million in funds flowed from cryptocurrency cash exchange stores into Binance, OKX, and Bybit. These stores provide users with services to exchange cryptocurrencies for physical cash, mostly operating in-store, serving various customers while also providing convenient channels for criminal groups to cash out cryptocurrencies.
Binance spokesperson Heloiza Canassa stated, "Safety and compliance are the core pillars of the company's operations." Since its establishment in 2017, Binance has responded to over 240,000 law enforcement requests for assistance, with 65,000 of those occurring just last year.
OKX Chief Legal Officer Linda Lacewell stated that the company actively cooperates with law enforcement to combat fraud and other illegal activities, investing significant resources in compliance management, transaction monitoring, and fraud detection tools.
HTX did not respond to requests for comment; a Bybit spokesperson stated that the company has a "zero-tolerance strict policy" against financial crime. The White House declined to comment; a representative of World Liberty Financial stated that the company only views Binance as a cryptocurrency trading platform, not a business partner.
The destination of dirty money after it flows into exchanges is often difficult to trace, and the trail of funds becomes hidden. If exchanges can detect illegal transactions in a timely manner, they may freeze the funds and hand them over to law enforcement.
John Griffin, a cryptocurrency expert at the University of Texas at Austin, pointed out, "If exchanges clear criminals from their platforms, they will lose a significant source of revenue. Therefore, they actually have a motive to allow such illegal activities to continue."
The chain of black market activities associated with exchanges
The Huayuan Group has extensive operations in Cambodia, as a large financial group involved in banking, payments, insurance, and other businesses. Local residents can use its QR codes to pay for shopping and dining.
However, behind these compliant businesses lies a sinister criminal network.
Law enforcement has revealed that for many years, the Huayuan Group has also operated a large illegal digital trading platform. Experts have described it as "the Amazon for criminals," where vendors sell stolen personal information, scam technical support services, and money laundering services. The group has also provided money transfer services for North Korean hackers and several scam groups in Southeast Asia.
In May of this year, the U.S. Treasury ordered a ban on the Huayuan Group's access to the U.S. banking system, stating that the group is a "core hub" for cyber theft and investment fraud targeting Americans.
During this time, the financial transactions between the Huayuan Group and Binance, OKX have remained uninterrupted.
Last year, the Huayuan Group publicly disclosed multiple cryptocurrency wallet addresses in a Chinese financial report. These long strings of letters and numbers are key identifiers for recognizing accounts in the cryptocurrency public ledger. Investigative analysis shows that between July 2024 and July 2025, the Huayuan Group transferred over $400 million to Binance. In the past five months, OKX has received over $220 million in deposits from related wallets of the Huayuan Group.
Even after the U.S. Treasury issued a ban on May 1, the flow of funds continued. Investigative findings show that within two and a half months after the ban was issued, the Huayuan Group's wallets transferred at least $77 million to Binance and $161 million to OKX.
The Huayuan branch in Phnom Penh, Cambodia, which the U.S. government describes as a "key node" for cyber theft and investment fraud.
Both Binance and OKX have previous violations of financial regulations, which has led them to reach criminal-related settlement agreements with the U.S. government. Both platforms have promised to rectify compliance issues.
Lacewell from OKX stated that even before May of this year, the company had initiated "enhanced transaction monitoring" for one of the wallet addresses mentioned in the Huayuan Group report and completely terminated all business dealings with the Huayuan Group in October.
Canassa from Binance issued a statement saying that the exchange cannot intercept or reverse incoming transactions, but once suspicious deposits are detected, appropriate measures will be taken. She also emphasized, "The key to measuring the compliance of cryptocurrency exchanges lies in their actions to identify and respond to suspicious deposits. In this regard, Binance is at the forefront of the industry."
However, the influx of funds from the Huayuan Group has persisted for several months. Moreover, after reaching a settlement with the U.S. government, Binance has received suspicious funds far beyond this amount.
In February of this year, the North Korean hacker group Lazarus Group hacked the Bybit exchange located in Dubai, UAE, stealing $1.5 billion worth of cryptocurrency, marking the largest hacking theft in cryptocurrency history.
Within just a few days, the hacker group transferred the stolen funds to a cryptocurrency exchange platform, converting Ethereum into Bitcoin, the cryptocurrency with the highest market value globally.
Cryptocurrency ATMs can be used to exchange cash for cryptocurrency.
Data from cryptocurrency tracking company ChainArgos shows that during the same period hackers were exchanging currency, five deposit accounts at Binance suddenly received $900 million in Ethereum from the exchange platform, making this large influx of funds appear extremely unusual.
Jonathan Reiter, CEO of ChainArgos, pointed out that although the funds flowing into Binance may no longer belong to North Korean hackers, the exchange has effectively become the terminal link in the hackers' money laundering chain, assisting in the laundering of hundreds of millions of dollars in cryptocurrency proceeds.
Reiter stated that from the timeline, the only reasonable source of these outflowing Ethereum is "stolen funds," which should have been flagged as dirty money. "Binance should have detected this anomaly; even poorly performing or flawed screening tools should have been able to identify such issues."
In response to the influx of funds, Canassa did not provide a direct answer, only emphasizing that Binance "has built a comprehensive and multi-layered compliance mechanism and security system."
Intricately Woven Scams
Last year, a father from Minnesota stumbled upon an "investment opportunity." Following the guidance of a family financial company based in Seattle and Los Angeles, he engaged in cryptocurrency trading, only to have his funds vanish, ultimately being scammed out of $1.5 million.
In March of this year, he wrote in a letter to the FBI: "My family and I are not only in financial ruin but have also suffered a heavy psychological blow." He requested anonymity to protect his privacy.
The stolen funds have yet to be recovered. However, according to an investigation by a cryptocurrency data company commissioned by the victim, over $500,000 ultimately flowed into major exchanges.
Such scams have become a significant problem in the cryptocurrency industry, with many elderly investors, single individuals, and even bank presidents falling victim. The FBI reported that last year, cryptocurrency investment scams caused victims to lose as much as $5.8 billion.
One of the most common types of scams is the "pig butchering" scheme. This scam method originates from a Chinese term, referring to scammers who first "fatten up" their victims before executing the scam. Scammers typically pose as admirers, engaging in flirtatious relationships with victims for days or even weeks, before luring them into false cryptocurrency investments.
The person in the image, Shan Hanes, is the president of Heartland Tri-State Bank in Elkhart, Kansas, who was convicted of embezzlement last year after losing funds in a cryptocurrency scam.
Cryptocurrency exchanges play a crucial role in these scams, serving as convenient channels for scammers to convert illegally obtained cryptocurrency into cash.
The identities of scammers are often difficult to trace, but this case from Minnesota provides a glimpse into Binance's internal systems.
According to regulations, cryptocurrency exchanges must perform KYC processes before opening accounts, collecting detailed personal information from customers to prevent fraud.
In response to a subpoena from the Minnesota police, Binance submitted account information related to two accounts involved in the pig butchering case. Within just a few months between 2023 and 2024, the first account had a transaction volume exceeding $7 million. Photos in the account information showed that the account holder was a woman standing in front of a corrugated iron wall, with a registered address in a village in China.
The second account was registered under the name of a 24-year-old woman from rural Myanmar. By mid-2024, this account had a transaction volume exceeding $2 million within nine months, an amount more than 1,000 times the average annual salary in Myanmar.
Erin West, head of a nonprofit focused on anti-fraud efforts and a former prosecutor, noted after reviewing the information that these two women were likely "money mules," and their personal information may have been stolen by scammers to register false accounts on Binance. She stated, "These accounts have no legitimacy whatsoever; we have seen this situation many times before." Binance declined to comment on this.
Law enforcement agencies often find themselves powerless against scammers located thousands of miles away.
Carrissa Weber, 58, from Alberta, Canada, was scammed out of her life savings of $25,000 by a scammer posing as a startup manager who lured her into investing in cryptocurrency. Weber reported the theft to Canadian police, but the stolen funds have yet to be recovered.
She expressed her frustration: "My case has just been left on the shelf, and no one is handling it."
Analysis of Weber's transaction records shows that her stolen funds flowed into multiple cryptocurrency wallets, ultimately all transferring to the OKX platform. Lacewell from OKX stated that the two accounts receiving these funds had been under monitoring for "suspicious characteristics" since last year, but the accounts were not frozen until October of this year—six months after Weber was scammed.
Gray Channels for Cashing Out Cryptocurrency
Deep within a deli in Kyiv, Ukraine, past shelves filled with snacks and sodas, pressing an electronic doorbell opens a door marked "Currency Exchange."
Inside the room is an offline store specializing in cryptocurrency exchange. A cash counting machine sits on the table, next to an old plastic calculator, and a box filled with rubber bands used to bundle stacks of cash.
Experts in the cryptocurrency field and law enforcement officials say that these cryptocurrency cash exchange stores, scattered across Asia and Eastern Europe, have become new hubs for global money laundering crimes.
Anyone walking into such a store often does not need to show identification to exchange large amounts of cryptocurrency for fiat currencies like dollars or euros. Data from cryptocurrency analysis company Crystal Intelligence shows that last year, these cryptocurrency exchange stores in Hong Kong processed transactions exceeding $2.5 billion.
Richard Sanders, a cryptocurrency tracking expert who has long studied these stores, stated, "These stores may provide unlimited money laundering opportunities for various financial crimes."
Many cryptocurrency cash exchange stores rely on major exchanges to conduct business. Crystal's data shows that last year, Binance, OKX, and Bybit collectively received $531 million from these currency exchange stores.
Nick Smart, Chief Intelligence Officer at Crystal, stated, "We found that many of these stores do not require identification, and there are basically no limits on the exchange amounts."
On a day in July this year, a reporter arranged a transaction via the Telegram chat app and transferred $1,200 in cryptocurrency to the exchange point inside the deli in Kyiv. Minutes later, the store staff handed him a bundle of cash secured with thick rubber bands, without providing a receipt, and the relevant Telegram chat records were immediately deleted after the transaction was completed. The exchange point did not respond to requests for comment.
In the weeks that followed, the International Consortium of Investigative Journalists collected cryptocurrency wallet addresses from dozens of such offline stores in countries including Ukraine, Poland, Canada, and the UAE.
Transaction records show that these wallets have mostly received funds from major exchanges. This means that users wishing to exchange cash first transfer funds from their exchange accounts to these stores to complete the exchange.
On the 41st floor of a glass-walled office building in Dubai, a reporter observed a customer exchanging a bundle of UAE currency for $6,000 in cryptocurrency at a cash exchange point. Analysis of the cryptocurrency address for that exchange point revealed that it received over $2 million in cryptocurrency within two weeks in September, including $303,000 from Binance.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
