Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

Chinese money laundering networks now process an estimated 20% of all illicit cryptocurrency funds, according to new research from the blockchain analytics firm Chainalysis. 

In 2025, they laundered on average $44 million in illicit crypto each day, amounting to $16.1 billion. Overall, Chainalysis estimated that $82 billion of cryptocurrency was laundered on-chain last year, a jump from $10 billion in 2020. 

The Chinese-language money laundering groups have professionalized laundering operations, promoting their services across a swath of Telegram groups and relying on “guarantee” platforms — marketplaces offering escrow protection where launderers can connect instantaneously with customers. 

“Very rapidly, these networks have developed into multi-billion dollar cross-border operations offering efficient, value-for-money laundering services that suit the needs of transnational organized crime groups across Europe and North America,” Tom Keatinge, director at the Centre for Finance & Security at the Royal United Services Institute, told Chainalysis.

Following efforts to crack down on guarantee services — including U.S. Treasury sanctions against the Cambodia-based Huione Group, the removal of some of its channels from Telegram and the subsequent revoking of its license by the Cambodian government — the exchange’s vendors have simply migrated to other platforms where they advertise their services, Chainalysis said.

They launder funds using a variety of mechanisms, including money mules and Black U services, which launder cryptocurrency explicitly stolen through hacking campaigns, exploit attacks, scams and other cybercrime. They also provide swapping services to convert crypto into multiple assets, a popular laundering method among Southeast Asian and North Korean criminal actors. 

In all, Chinese money laundering networks process an estimated 10% of funds stolen in pig butchering scams, according to Chainalysis, which are often carried out by transnational criminal groups operating in Southeast Asia.

In October, the U.S. Treasury sanctioned the Cambodian conglomerate Prince Group and its chairman, Chinese national Chen Zhi, and associates for an alleged sprawling cyber scam empire that included more than 100 shell companies used for money laundering. Zhi, who had $15 billion worth of bitcoin seized by the Justice Department, was arrested and extradited to China in January.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

James Reddick

James Reddick

has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.

 

Total
0
Shares
Previous Post

Dozens more are charged in Ploutus ATM jackpotting conspiracy

Next Post

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected

Related Posts

How To Browse Faster and Get More Done Using Adapt Browser

As web browsers evolve into all-purpose platforms, performance and productivity often suffer.  Feature overload, excessive background processes, and fragmented workflows can slow down browsing sessions and introduce unnecessary friction, especially for users who rely on the browser as a primary work environment. This article explores how adopting a lightweight, task-focused browser, like
Read More

CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is CVE-2025-61757 (CVSS score: 9.8), a case of missing authentication for a critical function that can result in pre-authenticated
Read More

Researchers Find Malicious VS Code, Go, npm, and Rust Packages Stealing Developer Data

Cybersecurity researchers have discovered two new extensions on Microsoft Visual Studio Code (VS Code) Marketplace that are designed to infect developer machines with stealer malware. The VS Code extensions masquerade as a premium dark theme and an artificial intelligence (AI)-powered coding assistant, but, in actuality, harbor covert functionality to download additional payloads, take
Read More