2024 saw many positive developments for the crypto ecosystem. In many ways, crypto assets have continued to gain mainstream acceptance, such as the approval of Bitcoin and Ethereum spot ETFs in the United States and the Financial Accounting Standards Board's (FASB) amendments to fair accounting rules. Additionally, inflows into legitimate services so far this year (YTD) are the highest since the peak of the last bull market in 2021. In fact, the total value of illicit activity has fallen 19.6% YTD, from $20.9 billion to $16.7 billion. This indicates that legitimate activity is growing at a faster pace than on-chain illicit activity. This positive sign suggests continued global crypto adoption.
These global trends are also reflected in Japan's cryptocurrency ecosystem. In particular, the exposure of domestic Japanese services to global illegal services such as those subject to economic sanctions, darknet markets, and ransomware services is generally low. This is because Japanese cryptocurrency exchanges basically only provide services to Japanese residents. However, this does not mean that there are no cryptocurrency-related crimes in Japan. Reports from public organizations, including JAFIC , the Financial Intelligence Unit (FIU) of the National Police Agency, have highlighted that cryptocurrency poses significant risks in terms of money laundering. Japan's exposure to organizations involved in international fraud may be limited, but it is not without its own challenges. Although off-chain criminal organization activities using cryptocurrency are widespread, it is not easy to catch them all.
In this article, we will look at two prominent cryptocurrency crimes currently occurring in Japan: money laundering and fraud.
Cryptocurrency money laundering
Let’s start by looking at how money laundering and crypto relate. Crypto money laundering is often associated with darknet markets and hiding the proceeds of crypto-native crimes such as ransomware. However, as the world continues to embrace crypto, there will be those seeking to exploit this powerful new technology. Now in 2024, crypto-based money laundering has come to encompass a whole range of crimes. With the right tools and knowledge, investigators can leverage blockchain transparency to uncover and address on-chain and off-chain fraud.
Crypto-Native Money Laundering
The process of laundering funds obtained directly through cryptocurrencies is often sophisticated, as cybercriminals use a variety of services to conceal the origin and movement of funds. A deep understanding of cryptocurrency tools is a persistent challenge for cryptocurrency operators and law enforcement agencies.
In crypto-native money laundering, cryptocurrencies are immediately and directly involved in the first stage (placement). Despite the transparency of the blockchain, criminals often choose cryptocurrencies for money laundering because it is easier to create a private wallet that does not require KYC (Know Your Customer) information than traditional methods of money laundering, such as setting up a dummy bank account for the recipient. There are various types of layering methods, which are the next stage of money laundering. In traditional fiat currency laundering, funds are transferred via multiple bank accounts or paper companies, but in the case of cryptocurrencies, the following methods are possible:
- Intermediate Wallets : Using multiple private wallets to complicate tracing, they often account for 80% or more of the funds flowing through money laundering channels, but investigators and compliance officers using Chainalysis can detect fraudulent activity and trace intermediate wallets with relative ease.
- Services that complicate the flow of funds : Although these services are widely used for money laundering purposes, it is important to note that they also have a nominal use case, namely to protect privacy, which is not inherently illegal.
- Mixers : A service that mixes cryptocurrencies from various users to make it difficult to determine the source and ownership of funds. As the market boomed, mixer activity began to increase in 2024.
- Cross-Chain Bridges: Services or protocols that facilitate asset transfers between different blockchain networks, but add complexity to the transaction flow.
- Privacy coins: These are tokens such as Monero and Zcash that use advanced encryption technology to hide transaction details, making them a convenient tool for criminals.
- Stablecoins: Due to an overall increase in the adoption of stablecoins globally over the past few years, they have also become a favored means of transferring criminal proceeds. However, the use of stablecoins also poses greater risks for money launderers, as many stablecoin issuers are cooperative with authorities and have the ability to freeze funds.
- Over-the-counter (OTC) brokers: OTCs can be found around the world and are able to handle large transactions with minimal vetting, often avoiding public order books and KYC requirements.
While some cybercriminals may store their ill-gotten gains in private wallets for years, hoping that authorities will turn a blind eye and forget about them, most bad actors are looking to cash out from crypto assets. More than 50% of illicit funds end up in centralized exchanges, directly or indirectly, after using techniques that complicate the flow of funds. For money laundering, centralized exchanges offer high liquidity, allow easy conversion of crypto assets to fiat currency, and are connected to traditional financial services. There are now many centralized services that receive more than $1 million in illicit funds every year.
Non-crypto native money laundering
Traditional money launderers get into crypto in a similar way to how they work with fiat currency. Unlike crypto-native money laundering, non-crypto-native money laundering starts with the placement phase, which works with fiat currency. Criminals first use bank accounts for fiat funds, which they then convert to crypto. From there, they can use the same layering techniques as crypto-native money laundering.
Non-cryptocurrency-native fund laundering involves off-chain crimes such as drug trafficking and fraud. Identifying new on-chain money laundering patterns is often similar to detecting fiat transactions, which involves examining transaction patterns and anomalies. In such non-cryptocurrency-originating money laundering cases, on-chain analysis usually starts at a centralized exchange, so it is difficult to determine whether a transfer from the exchange is a legitimate or illegitimate transaction unless there is additional background information on the case. However, data science techniques can provide insight into potential money laundering indicators.
One way to identify non-crypto-native money laundering is by detecting repeated transfers just above the reporting threshold, which we explain in detail in our 2024 Crypto Money Laundering Report . These thresholds vary by country, but the Financial Action Task Force (FATF) has recommended that cryptocurrency transactions over 1,000 USD/EUR be subject to the Travel Rule , and in the United States, this threshold is set at 3,000 USD. Additionally, the US Bank Secrecy Act (BSA) requires reporting of cash transactions over $10,000 USD. This means that transactions above these amounts are subject to additional scrutiny, but transactions below these thresholds, even if they are only $1, do not receive the same level of scrutiny.
The chart below shows the value of funds moving to centralized exchanges by transfer amount YTD 2024. We see significant spikes in transfers just below or just above the $1,000, $3,000, and $10,000 thresholds. Transfers slightly above these thresholds may be due to errors in exchange rates. Such spike patterns are typical of bad actors crafting payments to avoid triggering reporting requirements. Transactions that are just below the reporting requirement are one of the red flags highlighted by the FATF in its guidance for virtual asset service providers (VASPs) to help identify suspicious activity.
Aggregation Point
Another good approach for exchanges is to look at aggregation wallets that they have a business relationship with. When funds are laundered through multiple intermediate wallets, the flow of transactions is often not simple and linear. However, funds may be split into multiple wallets and then aggregated later through multiple transactions.
Aggregation wallets centrally consolidate funds from multiple wallets or funding services. This pattern of funds passing through multiple separate intermediate wallets and then being aggregated in a single address or cluster suggests this may be an attempt to evade detection.
The following graph from Chainalysis' analytics tool illustrates this type of fund transfer in a known fraud ring targeting seniors. In this scenario, the fraudsters likely instructed their victims to use a specific service (Exchange 1) to purchase crypto assets. Each victim was then instructed to transfer funds to different wallets controlled by the fraudsters, but these funds were aggregated into a single wallet that was then taken to Exchange 2.
It is difficult for Exchange 1's compliance officers to directly link victims to fraudsters, especially if the intermediate addresses are one-time disposable and have no history of being associated with fraudulent activity, unless they trace the transactions to an aggregation wallet. The use of pre-aggregation intermediate wallets is a ploy to hide the connections between all the victims who sent funds from Exchange 1's compliance officers.
While the above example is relatively simple, more complex money laundering networks will have wallets aggregating funds from dozens or even hundreds of intermediate wallets. By querying Chainalysis data, we can identify key aggregated wallets, which are often a strong lead. For example, so far this year, the top 100 Bitcoin aggregation wallets in 2024 (all transacting two hops away from exchanges) have received $968 million worth of Bitcoin from over 14,970 different addresses.
Looking more broadly, we can identify over 1,500 aggregated wallets that received a combined total of $2.6 billion worth of Bitcoin in 2024. Each of these wallets obtained funds from at least 10 different wallets. Again, this pattern alone is not conclusive evidence of laundering illicit funds; it may in fact represent a legitimate flow of funds. Nevertheless, patterns like this are something to be aware of.
Fraudulent Activity in Japan: Money Laundering and Fraud
In Japan, conversations with key industry players and statistics and documents published by authorities suggest that the main illicit use of crypto assets is the laundering of funds from non-cryptocurrency-native crimes and fraud. In this paper, we discuss how these issues are perceived in Japan and consider ways to estimate the damage caused by such crimes.
Money laundering for non-cryptocurrency-native crimes
As mentioned above, it is difficult to track non-cryptocurrency-based crimes on a large scale without background information on the case. In many cases, such information is only known to those involved in the case, such as law enforcement agencies, financial institutions, cryptocurrency businesses, and victims. However, some of our clients provide us with address identification information, which can help us understand the money laundering situation of non-cryptocurrency-native crimes in Japan. Based on the information we have obtained so far, many fraudulent accounts on cryptocurrency exchanges are created to receive fiat funds from traditional fraudulent activities or phishing campaigns that steal funds from online banks. This topic was also covered in our blog post last year.
According to statistics released by the National Police Agency for 2023 , the total number of reported fraud cases was 19,038, with total losses amounting to 45.26 billion yen (approximately $300 million). These figures are higher than those for the previous fiscal year, 2022, suggesting that such fraud remains a significant problem. The statistics do not reveal the amount of fiat currency converted into crypto assets, but as we will discuss later, it is estimated that a significant portion of it is laundered through crypto assets.
According to a report published by the Cyber Police Bureau of the National Police Agency, nearly half of the funds stolen from online bank accounts, totaling 8.73 billion yen, were transferred to bank accounts of cryptocurrency exchanges, suggesting that cryptocurrencies are increasingly being used as a means to launder funds stolen in various forms.
Scam trends in Japan
As we have covered in our Crypto Crime Report, fraud has consistently ranked among the top illegal crypto categories. While we have identified notable crypto clusters related to Japan-based fraud in the past, Japanese law enforcement is now keeping a close eye on a new wave of fraud that exploits social media (SNS) and is classified as SNS-based investment and romance fraud .
Recent investment scams often involve posting advertisements soliciting investments on major social media platforms to attract the attention of potential victims. To attract more people, scammers impersonate prominent economists or celebrities , and the URL in the advertisement leads to a group chat on a popular messaging app. There, many fake users are typically active in posting comments, praising the group host (teacher). Victims are drawn into conversations with scammers who claim to be the owner or assistant of the group chat, and are ultimately instructed to make transactions on a fake investment site.
Romance scams, also known as "pig butchering" because criminals "fatten" their victims to extract maximum profits from them, are a big problem that is closely related to cryptocurrencies. Romance scammers first build relationships with their victims over time (often by making them fall in love), often by first contacting them by pretending to text a false number or through a dating app. Once the relationship has developed, the scammer will eventually convince the victim to put money into a fake investment scheme, either in crypto or fiat currency, and continue to do so until they finally cut off contact.
According to the latest statistical data released by the National Police Agency , between January and August this year, the number and amount of damage caused by this type of fraud increased at a rate significantly higher than the previous year.
- Social networking site investment fraud: 6,868 cases, total damage of 64.014 billion yen (9.9% of the cases involved fraud involving cryptocurrencies)
- Social media romance fraud: 4,639 cases, total damage of 23.65 billion yen (17.7% of the cases involved fraud using cryptocurrency)
The government recognizes that such scams are a serious threat to the Japanese people and has convened a Cabinet Meeting on Crime Prevention to consider measures to combat them, including strengthening investigative capabilities regarding crypto assets, preventing fraudulent transfers from banks, and establishing a legal framework to ensure the seizure and recovery of assets.
On-chain analysis of Japanese cases
It is difficult to track non-cryptocurrency-based money laundering cases on a large scale, but as we discussed in our blog last year , if you provide us with information on such cases along with related addresses and transactions, we can trace the flow of funds. We will continue to work closely with our Japanese customers and partners to strengthen our data, especially on non-cryptocurrency-native money laundering, in order to analyze the cryptocurrency fraud and illicit activity situation in Japan.
Shown below are the total amounts received by fraudulent accounts (related to cases not originating from cryptocurrencies) and clusters related to cryptocurrency scams.
Total amount received by clusters linked to crimes not originating from crypto assets (Japanese yen is calculated as 150 JPY = 1 USD)
| BTC | ETH | |
| 2023 | 36,500,131.70 USD (approximately 5.48 billion yen) | 3,070,942.20 USD (approximately 460 million yen) |
| 2024 (January - June) | 18,850,727.33 USD (approximately 2.83 billion yen) | 1171.32 USD (approximately 176,000 yen) |
Total amount received by the scam cluster where cryptocurrency was directly transferred (Japanese yen is 150 JPY = 1 USD)
| BTC | ETH | |
| 2023 | 11,015,099.48 USD (approximately 1.65 billion yen) | 44,641,910.52 USD (approximately 6.7 billion yen) |
| 2024 (January - June) | 5,677,761.22 USD (approximately 850 million yen) | 13,700,140.32 (approx. 2.06 billion yen) |
However, there are naturally cases that are not recognized, especially those that do not originate from cryptocurrencies, so these figures should be viewed as a lower limit.
That said, these cases share a common pattern: the involvement of aggregated wallets: primary addresses that receive funds directly from exchanges are decentralized and short-lived, but funds from these addresses are ultimately sent to a smaller number of private wallets or deposit addresses for services.
Narrowing our investigation to cases involving ETH, we found that these aggregated wallets often also use decentralized exchanges (DEXs) or bridges to convert ETH to USDT.
- Blue line: Transfers from Japanese exchanges to temporary addresses suspected of fraud
– Red line: Transfer from temporary address to primary aggregation point
– Green line: Transfer from primary aggregation point to secondary aggregation point
– Purple line: Transfer from secondary aggregation point to DEX (ETH<->USDT)
Because new wallet addresses are created and used at a rapid pace, it is not easy to track them all individually, but by identifying common aggregation points from the clusters we have identified as illicit, we can estimate the scale of these illicit activities. In this article, we followed the process below to estimate the amount of potential illicit funds associated with the Japanese cases.
- Analyze fund movements from clusters already identified in Japan as illicit funds and find aggregation points
- For each aggregation point cluster found, add up the fraud classes identified in Japan and the total amount of receiving exposure from the Japanese exchange cluster.
Below are the results.
Estimated total amount of funds linked to non-cryptocurrency-based crimes (Japanese yen is calculated at 150 JPY = 1 USD)
| BTC | ETH | |
| 2023 | 410,660,875.52 USD (approximately 61.6 billion yen) | 9,478,208.96 USD (approximately 1.42 billion yen) |
| 2024 (Jan – Jun) | 30,738,415.72 USD (approximately 4.61 billion yen) | 851,372.94 USD (approximately 130 million yen) |
Estimated total amount of fraudulent funds transferred directly in cryptocurrency (Japanese Yen is 150 JPY = 1 USD)
| BTC | ETH | |
| 2023 | 80,001,762.23 USD (approximately 12 billion yen) | 173,179,428.38 USD (approximately 26 billion yen) |
| 2024 (Jan – Jun) | 43,436,507.05 USD (approximately 6.52 billion yen) | 68,779,128.04 USD (approximately 10.3 billion yen) |
Although these are merely estimates, the scale of the figures matches the statistical figures released by the authorities.
Criminal methods are becoming increasingly sophisticated
The fact that criminals are constantly adapting their money laundering methods and exploiting new types of cryptocurrency services is reflected in the changes in money laundering methods used by a wide range of threat actors that we have covered so far. In order to combat such illicit activities, law enforcement and compliance departments need to be aware of and explore new on-chain laundering techniques and patterns.
Chainalysis’ contribution
As criminal money laundering methods evolve, whether crypto assets are the source of origin or not, a comprehensive approach is needed to stay one step ahead. By leveraging reliable blockchain intelligence, advanced technology, training and expert capabilities, government agencies and cryptocurrency exchanges can effectively combat money laundering and other cybercrimes.
If you are interested in our solutions or story, please contact us at japan@chainalysis.com .
The contents of this article were also explained in a Japanese webinar on August 26, 2024. If you are interested, please watch the recording.
This material is not intended to provide legal, tax, financial, investment, regulatory or other professional advice, nor is it to be relied upon as a professional opinion. Recipients should consult their own advisors before making these types of decisions. Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information herein, and assumes no obligation to update any forward-looking statements to reflect any circumstances that may arise after the date such statements are made. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient's use of this material.
The postCryptocurrency Money Laundering in Japan: A Global Common Problem Seen from a Japanese Perspective appeared first on Chainalysis .
