Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

Chinese money laundering networks now process an estimated 20% of all illicit cryptocurrency funds, according to new research from the blockchain analytics firm Chainalysis. 

In 2025, they laundered on average $44 million in illicit crypto each day, amounting to $16.1 billion. Overall, Chainalysis estimated that $82 billion of cryptocurrency was laundered on-chain last year, a jump from $10 billion in 2020. 

The Chinese-language money laundering groups have professionalized laundering operations, promoting their services across a swath of Telegram groups and relying on “guarantee” platforms — marketplaces offering escrow protection where launderers can connect instantaneously with customers. 

“Very rapidly, these networks have developed into multi-billion dollar cross-border operations offering efficient, value-for-money laundering services that suit the needs of transnational organized crime groups across Europe and North America,” Tom Keatinge, director at the Centre for Finance & Security at the Royal United Services Institute, told Chainalysis.

Following efforts to crack down on guarantee services — including U.S. Treasury sanctions against the Cambodia-based Huione Group, the removal of some of its channels from Telegram and the subsequent revoking of its license by the Cambodian government — the exchange’s vendors have simply migrated to other platforms where they advertise their services, Chainalysis said.

They launder funds using a variety of mechanisms, including money mules and Black U services, which launder cryptocurrency explicitly stolen through hacking campaigns, exploit attacks, scams and other cybercrime. They also provide swapping services to convert crypto into multiple assets, a popular laundering method among Southeast Asian and North Korean criminal actors. 

In all, Chinese money laundering networks process an estimated 10% of funds stolen in pig butchering scams, according to Chainalysis, which are often carried out by transnational criminal groups operating in Southeast Asia.

In October, the U.S. Treasury sanctioned the Cambodian conglomerate Prince Group and its chairman, Chinese national Chen Zhi, and associates for an alleged sprawling cyber scam empire that included more than 100 shell companies used for money laundering. Zhi, who had $15 billion worth of bitcoin seized by the Justice Department, was arrested and extradited to China in January.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

James Reddick

James Reddick

has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.

 

Total
0
Shares
Previous Post

Dozens more are charged in Ploutus ATM jackpotting conspiracy

Next Post

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected

Related Posts

New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory

A high-severity security flaw has been disclosed in MongoDB that could allow unauthenticated users to read uninitialized heap memory. The vulnerability, tracked as CVE-2025-14847 (CVSS score: 8.7), has been described as a case of improper handling of length parameter inconsistency, which arises when a program fails to appropriately tackle scenarios where a length field is inconsistent with the
Read More

ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

Think your Wi-Fi is safe? Your coding tools? Or even your favorite financial apps? This week proves again how hackers, companies, and governments are all locked in a nonstop race to outsmart each other. Here’s a quick rundown of the latest cyber stories that show how fast the game keeps changing. DeFi exploit drains funds Critical yETH Exploit Used to Steal $9M
Read More