*This article has been automatically translated. Please refer to the original article for accurate content.
Main points
- The Chinese Money Laundering Network (CMLN), which emerged early in the pandemic, is now a major player in known cryptocurrency money laundering operations, estimated to have handled approximately 20% of illicit cryptocurrency funds over the past five years. The growth in flows into CMLN is 7,325 times faster than the growth in illicit flows into centralized exchanges since 2020.
- CMLN is expected to process $16.1 billion in 2025, equivalent to approximately $44 million per day across over 1,799 active wallets.
- Chainalysis identified six distinct service types within the CMLN ecosystem, each with unique on-chain behavioral patterns: Black U and gambling services split large transactions into multiple smaller amounts to avoid detection, while over-the-counter (OTC) services aggregate smaller transactions into larger amounts and consolidate funds.
- Collateral platforms like Huione and Xinbi act as hubs for money launderers, but do not control the underlying transaction activity themselves, and therefore are not included in the aggregate metrics for this analysis. While law enforcement crackdowns have had some impact, they often simply move launderers onto other channels, highlighting the need to directly target the laundering operators themselves.
The illicit on-chain money laundering ecosystem has expanded dramatically over the past few years, growing from $10 billion in 2020 to over $82 billion by 2025. [1] This significant growth in total value reflects the increasing accessibility and liquidity of cryptoassets, as well as structural changes in how money is laundered and by whom.
As the chart below shows, Chinese-speaking money laundering networks (CMLNs) will increase their share of known illicit money laundering activity to approximately 20% by 2025. This regional connection is also supported by the off-ramp patterns we observe. For example, as noted in the fraud chapter of this report, CLMNs have expanded to currently consistently launder over 10% of funds stolen in pig butchering schemes, while at the same time, we have seen a consistent decline in the use of centralized exchanges, likely due in part to their ability to freeze funds.
Compared to other money laundering destinations, identified inflows into CMLN have grown 7,325 times faster than inflows into centralized exchanges, 1,810 times faster than inflows into decentralized finance (DeFi), and 2,190 times faster than on-chain transfers between malicious actors since 2020. While CMLN is not the only enabler of on-chain money laundering, Chinese-speaking Telegram-based services account for a disproportionate share of attributable on-chain money laundering worldwide, resulting in funds from a wide range of criminal activity, both on-chain and off-chain, being processed through these services.
A series of enforcement actions, including sanctions designations and recommendations, against money laundering support networks in recent months have further highlighted national security threats affecting victims around the world. These include the sanctions designation of the Prince Group by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) and the U.K. HM Treasury's Office of Financial Sanctions Implementation (OFSI), the Financial Crimes Enforcement Network's (FinCEN) final rule designating Huione Group as a person of major money laundering concern, and FinCEN's recommendation regarding a Chinese-backed money laundering network .
These major money laundering intermediaries have been receiving much more attention recently and rightfully so, but this chapter provides the first detailed analysis of how these large underground money laundering networks use cryptocurrencies, revealing the scale of their ecosystem. These networks operate openly across multiple platforms, and are complex, multi-tiered operations with industrial-grade throughput, high business continuity, and sophisticated technical capabilities.
CMLN reaches $16.1 billion
We have identified six distinct types of services that make up the CMLN ecosystem, and we will look at each in more detail in the following sections. Collectively, these services contributed $16.1 billion to CMLN in 2025. While limited to a handful of actors just a few years ago, these networks have expanded rapidly, with over 1,799 active on-chain wallets identified in 2025.
The speed at which these operations scale is an equally significant concern. Comparing the time it took each service type to process $1 billion cumulatively, starting from the address that first received funds in that category, reveals surprisingly fast ramp-up times and notable differences between services. The Black U service reached this level in just 236 days, while the running point broker took 843 days and the OTC service took 1,136 days. Money mules (1,277 days) and money movement services (1,790 days) are moving at a slower pace, and the gambling insider service has yet to reach the $1 billion threshold. Overall, the CMLN ecosystem will process approximately $44 million per day in 2025.
The rapid expansion of these networks in such a short space of time indicates strong ties to off-chain criminal networks, as such growth would not have been possible without mobilizing a large pool of capital. It also reveals the existence of a sophisticated operational infrastructure spanning both on-chain and off-chain. At the center of this ecosystem is the Guarantee platform, a centralized marketplace that serves as the backbone of CMLN's operations.
Tom Keatinge, Director of the Centre for Finance & Security (CFS) at RUSI , said: "These networks have very quickly developed into multi-billion dollar cross-border businesses, providing efficient, cost-effective money laundering services to meet the needs of international organized crime groups in Europe and North America. The simple answer to why they have developed so rapidly is that it is an unintended consequence of the imposition of capital controls in China: wealthy individuals seeking to circumvent the controls and move their funds out of China are providing the engine and liquidity pool to support services for Western-based organized crime groups. Professional intermediaries facilitating this capital flight connect these two independent yet mutually beneficial needs."
Similarly, Chris Urben, Managing Director at Nardello & Co , explains, "The biggest change in Chinese money laundering networks in recent years has been the rapid shift from underground banking methods that rely on informal value transfer systems such as Black Market Peso and Fei Qian to cryptocurrencies, which offer an efficient means of covertly moving funds across borders without relying on complex, manual, international informal ledger networks."
Guarantee platform: the cornerstone of the CMLN ecosystem
Guarantee services primarily function as an infrastructure for CMLN, acting as a customer acquisition channel and escrow function. While they provide a certain trust mechanism for vendors, they do not control actual money laundering activity itself, and do not include it in our aggregated metrics. While Huione and Xinbi have dominated the market in recent years, many other Guarantee services continue to operate without restrictions.
While Telegram's deletion of some accounts disrupted Huione's Guarantee operations, vendors who used Huione continue to use and advertise on alternative platforms, with little impact to actual operations. While these hubs still serve to connect vendors and customers, many vendors advertise on multiple platforms and are not reliant on any one service. Similar to legitimate e-commerce platforms, service ratings and reviews create a level of accountability within the fraudulent ecosystem, and vendors build market reputations by publicly promoting their trustworthiness and service quality, as shown in the screenshot below.
CMLN, which advertises on the Guarantee service, offers a variety of money laundering methods, with the primary goal of integrating illicit funds into the legitimate financial system. Some utilize extensive money mule networks to access laundering services on mainstream cryptocurrency exchanges, while others operate their own on-chain laundering infrastructure. While these methods differ in approach, they are all variations on the same goal: to clean dirty money.
Six types that make up the CMLN
CMLN offers a variety of "laundering-as-a-service" businesses. Analysis of Chinese-speaking vendor postings reveals that these services primarily involve six methods of moving funds: running point brokers, money mules, OTC services, Black U services, gambling platforms, and money movement services offering cryptocurrency mixing and swapping. These operations involve thousands of vendors, totaling tens of billions of dollars. Understanding how these entities operate and how they form comprehensive laundering networks provides crucial insights for identifying future detection opportunities. We take a closer look at these service categories below.
1. Running point broker: Entrance point for inflow
In the money laundering process, "running points" serve as key entry points for illicit funds. Individuals are recruited through vendors' classified ads and lend out their financial identities, such as bank accounts, digital wallets, and deposit addresses on mainstream exchanges, to receive and transmit illicit funds.
Advertisements often clearly warn that participants bear all legal responsibility and financial losses if authorities intervene, leaving no doubt that the activity is illegal.
Originally focused on online gambling, Running Point's services have expanded to launder all manner of illicit cryptocurrency activity, including romance scams, exchange hacking, and human trafficking via Telegram. This wide range of uses demonstrates its functionality as a vital bridge between the legitimate financial system and the criminal underground economy.
As the Chainalysis Reactor graph below shows, the running point broker acts as a routing mechanism for funds from various illicit sources, ultimately sending them to accounts at mainstream exchanges, likely under the name mule, including other laundering services, popular fiat exchanges, and platforms related to the Huione Group ecosystem.
2. Money mule motorcade: the middle layer of laundering
While "running points" act as entry points to exchanges, money mules, or "motorcades," orchestrate the core layering phase of money laundering. These specialized operators create networks of accounts and wallets, skillfully hiding the origin of funds through multi-stage transactions.
Money mule operations use multiple methods to exchange fiat for crypto and vice versa, including offline services where dealers meet customers in person, ATM cash withdrawals converted into crypto, digital wallet-to-digital wallet transfers using third-party payment platforms, and even card schemes that exchange credit cards and gift cards for crypto. While vendors openly advertise the financial institutions, crypto exchanges, and payment methods they accept, the actual specific arrangements with cardholders and intermediaries are conducted privately outside of public Telegram channels.
While it is not possible to determine the nationality of Money Mule Motorcade from Telegram posts alone, the posts are almost entirely written in simplified Chinese, and many of them suggest bank accounts and locations in mainland China. This suggests that these money laundering vendors likely serve a primarily Chinese-speaking clientele. A recent study by the Royal United Services Institute (RUSI) also points to the growing involvement of Chinese-backed organized crime. Despite the large-scale cryptocurrency ban imposed by Chinese authorities, these networks and legitimate cryptocurrency use remain active. Chinese authorities have focused on selective policing and AML enforcement, tolerating or effectively ignoring some cryptocurrency activity while aggressively cracking down on activities that threaten capital controls and financial stability.
Beyond domestic operations, these networks are also actively offering services focused on cross-border remittances via global payment methods and foreign currencies. Vendors actively promote the breadth of their operations, with Telegram posts showing some vendors claiming to control "fleets" (likely conglomerates of motorcades or money mules) across Africa, suggesting that CMLNs' reach extends far beyond China and East Asia. "CMLOs (Chinese Money Laundering Organizations) correctly recognize cryptocurrencies as a means to accelerate laundering while reducing risk, thanks to less stringent KYC compliance than traditional banks or non-cryptocurrency transactions," Urben notes. "Furthermore, cryptocurrencies also make it much easier to physically move large amounts of assets across borders. Billions of dollars' worth of Bitcoin can be transported simply by carrying a cold wallet on a hard drive in your pocket."
Advertisements promoting money transfer services share a common thread: they consistently emphasize the importance of urgency, confidentiality, and speed. While vendors repeatedly emphasize the need to transfer funds quickly before they are frozen, they offer minimal, simple guidance on how to deal with issues arising from funds or accounts that have already been restricted by financial institutions or cryptocurrency exchanges.
Within the Guarantee platform, the majority of services listed are money transfers organized by running point brokers and money mules. Significant similarities in the wording and structure of advertisements suggest that these operators likely operate within larger umbrella organizations or maintain strategic collaborations with one another. Together, these money transfer services form the backbone of the money laundering infrastructure within the underground banking ecosystem.
The United Nations Office on Drugs and Crime (UNODC) best describes this relationship: motorcade acts as an extension of the running point syndicate, providing sophisticated layering schemes that route illicit funds through multiple bank accounts in exchange for a percentage of the total amount transferred. The UNODC 2024 report on Casinos, Money Laundering and Transnational Organized Crime in East and Southeast Asia also highlights the use of third- and fourth-party payment service providers. These networks exhibit a high degree of connectivity, suggesting that multiple layers of payment services may actually function as front companies for the same group, facilitating laundering.
3. Informal OTC and P2P Services: A Means of Avoiding Regulation
Informal over-the-counter (OTC) desks are another important channel for money laundering. Unlike formal OTCs, these services operate without regulatory oversight or clear ties to any particular jurisdiction, deliberately circumventing capital controls required in strict markets like China . Their ability to process fund transfers without KYC (know your customer) makes them an attractive option, especially for users looking to transfer assets of questionable origin.
Many OTC vendors advertise themselves using phrases like "clean fund" or "White U." The exchange rates displayed in their posts are often above market rates, reflecting the premiums they pay for circumventing regulations. These services handle both domestic and international remittances, further expanding the geographic reach of illicit capital flows.
However, on-chain analysis contradicts these "clean fund" claims. These ostensibly legitimate OTC services have extensive ties to multiple Guarantee platforms, including Huione, revealing their deep integration into the overall CMLN ecosystem. The same vendors claiming to be "White U" regularly interact with confirmed money laundering services, demonstrating that informal OTC desks can function as important transit points for illicit crypto assets.
4. Black U service: selling dirty funds at a discount
"Black U" services, which primarily operate outside the Guarantee platform, occupy a unique position in the CMLN ecosystem and can be considered the flip side of informal "White U" OTC. These vendors specialize in cryptocurrencies obtained through illicit means, such as hacking, exploitation of vulnerabilities, fraud, and wallet theft, and openly state this fact in their advertising. Their business model is to sell illegally obtained cryptocurrencies at discounted rates.
In exchange for accepting assets of known criminal origin, the buyer obtains funds at a discount of 10-20% below market value, in return for assuming the burden of legal risks and the possibility of funds being seized.
The operational structure of the Black U service suggests a highly coordinated and coordinated approach. While services are separated by vendor, the front-end websites share a nearly identical layout, apart from cosmetic details such as domain names and branding, and the Telegram channels also display a similar pattern. This commonality in infrastructure suggests that these seemingly separate businesses may actually be operating as compartmentalized units within a single organization, or may be a network coordinated to maintain operational consistency.
5. Gambling services: the digital equivalent of traditional laundering
While gambling services themselves are not necessarily illegal in many jurisdictions, the large amounts of cash involved, the frequency of transactions, and the built-in mechanisms for converting funds into other forms have made them a popular method of traditional and crypto-based laundering. Casinos and online betting platforms offer an effective means for betting, dispersing, and ultimately integrating illicit proceeds into the legitimate financial system, particularly as they provide plausible explanations for "sudden wealth."
Many of these gambling services accept cryptocurrency deposits and do not require KYC information. Third-party payment providers facilitate account top-ups in both fiat and cryptocurrencies, and some payment processors consolidate top-ups to multiple gambling sites, allowing cross-platform transfers of funds. Additionally, some vendors on Telegram offer "insider information" on predicted or manipulated results, and advertisements guarantee compensation if customers' "winning numbers" are not selected. This suggests that some gambling services are not merely laundering conduits but are actively supporting the fixation of outcomes.
The Reactor graph below shows how gambling services are used by insiders. Insiders withdraw profits from manipulated bets from the gambling platform and then continue the laundering process by sending the funds to additional money laundering services such as Black U service or money mule. On-chain activity also confirms that the gambling insider operators are pumping some of the funds back into the gambling platform.
6. Money movement service: mixing/swapping services
Mixing transactions to hide their origins is a well-established technique in sophisticated cyber theft. Professional mixing services such as Tornado Cash and Blender.io gained international notoriety when they were sanctioned by the US government for their involvement in laundering stolen funds ( Tornado Cash has since been removed from OFAC's sanctions list ).
In the Southeast Asian underground banking ecosystem, there are specialized vendors offering "swapping-as-a-service" services across multiple Guarantee service platforms, converting crypto assets into various other assets. These swap services have become popular among illicit actors operating in Southeast Asia, China, and even North Korea, and are used as a means to launder funds while keeping them on-chain.
On-chain data reveals similarities between CMLN flows and traditional laundering stages
Analysis of transaction flows through CMLN services paints a picture of traditional money laundering methods being deployed on an industrial scale. The following chart tracks how various services divide and aggregate illicit funds, revealing clear patterns of structuring (smurfing) and aggregation as funds move through the laundering cycle.
Using such a quantitative framework, it may be possible to understand the role and position of each service within the overall money laundering ecosystem, even before the actual operational mechanisms are fully understood.
The Black U service exemplifies highly aggressive structuring behavior. From inflow to outflow, small-value (under $100) transactions increased by 467%, while medium-value ($100-$1,000) transactions increased by 180%. Larger transfers (over $10,000) were also 51% more likely to be sent to the destination wallet than to the source wallet, demonstrating a consistent distribution of funds across a larger number of wallets. Money mules and money movement services exhibit similar behavior, albeit to a lesser extent. In these cases, the shift toward smaller transaction units and an increased number of counterparties is typical of smurfing (the division of criminal proceeds into smaller amounts to evade detection thresholds).
Meanwhile, gambling insiders, running point brokers, and OTC services act as the primary aggregators in this ecosystem. These services have a greater number of inflow transactions than outflow transactions at almost all denomination levels, suggesting they aggregate funds from multiple points and send them on-chain to a small number of counterparty wallets. For OTC services in particular, this pattern of fund aggregation reflects their role in the final stage of laundering: integration, the process of combining many small deposits into larger amounts suitable for reinflow into the legitimate financial system.
CMLN prioritizes high-value clients, with much of the illicit funds moving within minutes
The speed at which funds are moved through various laundering services also shows distinct patterns. As can be seen in the chart below, high-value transactions are prioritized across all laundering types. However, services that have built automated laundering mechanisms tend to improve their efficiency over time, regardless of the amount of money being laundered. Meanwhile, services that rely on manual mechanisms, while still prioritizing high-value transactions, remain less efficient at processing small-value transactions.
In terms of funds processing efficiency, the Black U service showed the highest performance, settling even very large transactions in an average of 1.6 minutes in the fourth quarter of 2025. The business imperative to move illicit funds quickly appears to have been a major factor in shaping the Black U service's technology infrastructure. Some of these services also offer self-service swap functionality, where customers simply enter the desired exchange amount and destination address, and the system automatically executes the swap. This automation not only speeds up the laundering process, but also reduces operational costs and minimizes the digital footprint that manual processing often leaves behind.
Similarly, gambling operators rely on integrated payment solutions to process millions of transactions every day. These automated systems speed up the deposit-to-settlement process, enabling them to efficiently handle large capital flows.
In contrast, money mules and running points exhibit highly variable payment speed patterns. These networks still rely heavily on human labor, requiring recruited individuals to process transactions in real time using their own bank accounts or digital wallets. This human element introduces variability into the laundering process, resulting in inconsistent timing rather than the consistent processing patterns of automated services.
Public-private collaboration to tackle cryptocurrency-linked money laundering network
The Chinese-speaking Guarantee platform, money movement service, and associated financial crime networks represent a complex and resilient ecosystem that continues to adapt despite law enforcement crackdowns. As with other illicit on-chain activity, actions against the Guarantee service result in short-term disruption, but the underlying network persists and easily shifts to alternative channels when challenged.
The scale and sophistication of these operations pose significant challenges to financial crimes compliance, intelligence, and law enforcement efforts. Effective disruption requires targeting the fraudulent operators and vendors themselves, in addition to addressing the advertising media. These networks constitute the essential infrastructure for the mass and systematic conversion of illicit proceeds from fraud, scanning, and other crimes into seemingly legitimate assets.
More importantly, while CMLNs play a disproportionate role in cryptocurrency-based money laundering, they are not the only laundering networks to have made technological adaptations. In December 2024, the UK National Crime Agency (NCA) uncovered a multibillion-dollar Russian-speaking money laundering network serving a wide range of illicit actors, including Russian and international elites, cybercriminals, and drug cartels. As Keatinge points out, "In many countries, there is a significant gap between criminal and law enforcement capabilities regarding the use of cryptocurrencies. A combination of different national laws, border barriers, inadequate information sharing, and limited cryptocurrency tracing and asset recovery capabilities has made cryptocurrencies a low-risk, high-reward avenue for criminals to enjoy the proceeds of their crimes. While some blockchain analytics companies have provided significant support, this capacity building is only the tip of the iceberg. A systematic, global effort to improve the cryptocurrency capabilities of law enforcement agencies around the world and to develop better information-sharing mechanisms is urgently needed."
Countering money laundering networks integrated with cryptocurrencies requires public-private collaboration and a paradigm shift from reactive enforcement of individual platforms to proactively disrupting the underlying networks themselves. Urben emphasizes, "The most effective investigative strategy is to align our investigative tools with CMLO's operational methods. To detect these money laundering networks, we need to combine open-source intelligence and HUMINT (human intelligence) with blockchain analysis. Only when these tools work together and complement each other's leads can we link actors and financial movements and map the structure of the entire network."
Combining the legal authority of law enforcement with the technical capabilities and blockchain analytical expertise of the private sector will enable more effective identification and dismantling of these services, which operate across multiple platforms, jurisdictions, and communication channels. On-chain transparency provides unprecedented visibility into these operations. Combined with cross-platform intelligence sharing and coordinated law enforcement, these tools can help raise the operational costs and risks of large-scale money laundering services. Future intervention strategies must prioritize this collaborative approach to effectively and sustainably disrupt crypto-linked laundering networks, including CMLNs.
[1] This is a lower bound estimate based on CMLN activity and reflects only the services identified by Chainalysis, not the Guarantee Service itself.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient's use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claims attributable to errors, omissions, or other inaccuracies of any part of such material.
The postChinese-based money laundering networks are key vectors of the cryptocurrency criminal economy, accounting for 20% of the total appeared first on Chainalysis .
