The New York Times: $28 Billion in "Black Money" in the Cryptocurrency Industry

As Trump vigorously promotes cryptocurrency and the crypto industry gradually enters the mainstream, funds from scammers and various criminal organizations are continuously flowing into major cryptocurrency exchanges.

Written by: David Yaffe-Bellany, Spencer Woodman, and Sam Ellefson

Translated by: Luffy, Foresight News

President Trump has founded his own cryptocurrency business and has vowed to make the United States the global "crypto capital." Cryptocurrency companies are touting the safety and reliability of their platforms, and a wide range of mainstream industries—from Wall Street banks to online retailers—are also experimenting with crypto businesses.

However, according to a joint investigation by the International Consortium of Investigative Journalists, The New York Times, and 36 other global news organizations, even as the crypto industry gains mainstream recognition, at least $28 billion in illicitly linked funds have flowed into cryptocurrency exchanges over the past two years.

These funds originate from hackers, thieves, and extortionists, with sources ranging from North Korean cybercrime groups to scam syndicates operating from Minnesota in the United States to Myanmar. The investigation shows that these criminal groups have repeatedly transferred funds into the world's leading cryptocurrency exchanges—online platforms that enable the exchange of dollars, euros, and cryptocurrencies such as bitcoin and ethereum.

Binance, the world's largest cryptocurrency exchange, is one of the recipients of this "dirty money." In May this year, Binance reached a $2 billion business deal with Trump's cryptocurrency company. The investigation also revealed that dirty money has flowed into at least eight other well-known exchanges, including Okx, a global platform with growing influence in the U.S. market.

Julia Hardy, co-founder of crypto investigation firm zeroShadow, pointed out: "Law enforcement is simply unable to keep up with the endless illegal activities in this field. This situation cannot be allowed to continue."

In the early days of cryptocurrency development, it became a gathering place for thieves and drug dealers. The speed and anonymity of crypto transactions make it an excellent tool for money laundering. As the most representative virtual currency, bitcoin once supported transactions on dark web markets, where illegal vendors sold drugs and other contraband.

Since then, the crypto industry has grown exponentially and become increasingly professionalized, with daily legal trading volumes reaching billions of dollars. Leading exchanges have pledged to crack down on the use of crypto for illicit fund transfers. In 2023, Binance admitted to money laundering-related crimes for processing transactions for terrorist organizations such as Hamas and al-Qaeda, and agreed to pay a $4.3 billion fine to the U.S. government. Last year, Binance also declared that the crypto industry "will show zero tolerance for criminals."

President Trump's sons Eric and Donald point to a promotional campaign that includes the Trump family's crypto business, World Liberty Financial

Meanwhile, Trump has made crypto business a core part of his family enterprise and has ended regulatory crackdowns on the industry. On the eve of the 2024 election, he and his sons co-founded a crypto startup called World Liberty Financial. With its partnership with Binance, the company is expected to generate tens of millions of dollars in annual revenue. Last month, Trump pardoned Binance founder Changpeng Zhao, who had previously been sentenced to four months in prison under a company plea agreement.

The Trump administration has also weakened law enforcement's ability to hold crypto criminals accountable. In April this year, the U.S. Department of Justice disbanded a special crypto crime enforcement team and declared that prosecutors should focus on terrorists and drug dealers using crypto, rather than holding "the platforms these criminal organizations rely on for illegal activities" responsible.

Because many criminal accounts have not been publicly exposed, this investigation by The New York Times and its partners only reveals the tip of the iceberg regarding illicit funds at exchanges. However, this is the first systematic fund-tracing investigation targeting specific platforms.

Whether exchanges are breaking the law requires specific analysis. Even if they process dirty money, some companies may still be fulfilling their legal obligations, such as employing compliance staff to screen for fraud. But in the U.S., if a crypto company fails to establish robust internal anti-money laundering mechanisms, it could be sued for violating the Bank Secrecy Act.

This investigation is partly based on data from blockchain analytics firm Chainalysis (which did not specify the exchanges involved). The New York Times and the International Consortium of Investigative Journalists also used public records and consulted forensic experts to identify crypto accounts linked to criminal activity. Because crypto transactions are recorded on public ledgers, fund flows can be traced to specific exchanges.

Binance founder Changpeng Zhao

Main findings of the investigation include:

• Since Binance's guilty plea, Cambodia's Huione Group has transferred over $400 million to its accounts. Huione Group has been designated a criminal entity by the U.S. Treasury Department. In addition, this year, $900 million flowed into Binance deposit accounts from a platform used by North Korean hackers for money laundering.
• In February this year, Okx reached a $504 million settlement with the U.S. government for violating fund transfer laws. Within five months of the settlement, the platform received over $220 million from Huione Group.
• According to Chainalysis, in 2024, at least $4 billion in scam-related funds were received by global crypto exchanges. The New York Times and the International Consortium of Investigative Journalists interviewed 24 crypto scam victims, whose stolen funds ultimately flowed into major exchanges such as Binance, Okx, Bybit, and HTX.
• Last year, over $500 million flowed from crypto cash-out shops into Binance, Okx, and Bybit. These shops, mostly brick-and-mortar, provide crypto-to-cash exchange services for all kinds of customers, and also offer a convenient channel for criminal groups to cash out crypto.

Binance spokesperson Heloiza Canassa stated, "Security and compliance are the core pillars of our operations." Since its founding in 2017, Binance has responded to over 240,000 law enforcement requests, including 65,000 last year alone.

Okx Chief Legal Officer Linda Lacewell said the company actively cooperates with law enforcement to combat fraud and other illegal activities, and has invested heavily in compliance management, transaction monitoring, and fraud detection tools.

HTX did not respond to a request for comment; a Bybit spokesperson said the company has a "zero-tolerance strict policy" toward financial crime. The White House declined to comment; a World Liberty Financial representative said the company only regards Binance as a crypto trading platform, not a business partner.

The destination of dirty money after entering exchanges is often difficult to trace, and the fund trail disappears. If exchanges detect illegal transactions in time, they may freeze the funds and hand them over to law enforcement.

John Griffin, a crypto expert at the University of Texas at Austin, pointed out: "If criminals are cleared from the platform, exchanges will lose a major source of revenue. Therefore, they actually have an incentive to allow such illegal activities to continue."

The Black Industry Chain Linked to Exchanges

Huione Group has extensive business operations in Cambodia, engaging in banking, payments, insurance, and more as a large financial group. Locals can use its QR codes to pay for shopping and meals.

But behind these legitimate businesses lies a sinister criminal network.

Law enforcement revealed that for years, Huione Group has also operated a massive illegal digital trading platform. Some experts describe it as "Amazon for criminals," where vendors sell stolen personal information, scam tech support services, and money laundering services. The group has also provided fund transfer services for North Korean hackers and multiple Southeast Asian scam syndicates.

In May this year, the U.S. Treasury Department ordered Huione Group to be cut off from the U.S. banking system, calling it a "core hub" for cyber theft and investment scams targeting Americans.

During this period, Huione Group's financial dealings with Binance and Okx continued uninterrupted.

Last year, Huione Group disclosed several crypto wallet addresses in a Chinese financial report. These long strings of letters and numbers are key identifiers for accounts on the public crypto ledger. Investigation shows that from July 2024 to July 2025, Huione Group transferred over $400 million to Binance. In the first five months of this year, Okx received over $220 million in deposits from Huione Group's related wallets.

Even after the U.S. Treasury's ban on May 1, fund transfers continued. The journalists' investigation found that in the two and a half months after the ban, Huione Group's wallets transferred at least $77 million to Binance and $161 million to Okx.

Huione's Phnom Penh branch in Cambodia; the U.S. government calls Huione a "key node" for cyber theft and investment scams

Both Binance and Okx have previous violations of financial regulations, leading to criminal settlements with the U.S. government. Both platforms have pledged to rectify compliance issues.

Okx's Lacewell said that as early as before May this year, the company had launched "enhanced transaction monitoring" on one of the wallet addresses mentioned in Huione Group's report, and in October fully terminated all business dealings between Okx wallets and Huione Group.

Binance's Canassa stated that the exchange cannot intercept or reverse incoming transactions, but will take appropriate action once suspicious deposits are detected. She emphasized: "The key to measuring a crypto exchange's compliance is its actions in identifying and responding to suspicious deposits. In this regard, Binance is an industry leader."

However, the inflow of Huione Group's funds continued for months. Moreover, after Binance's settlement with the U.S. government, it received more than just this one suspicious fund.

In February this year, North Korean hacker group Lazarus Group hacked Bybit in Dubai, UAE, stealing $1.5 billion worth of crypto, making it the largest crypto theft in history.

Within days, the hackers transferred the stolen funds to a crypto exchange platform, converting ethereum into bitcoin, the world's largest cryptocurrency by market cap.

Crypto ATMs can be used to convert cash into cryptocurrency

According to crypto tracking firm ChainArgos, at the same time as the hackers were exchanging currencies, five Binance deposit accounts suddenly received $900 million worth of ethereum from the exchange platform—a highly unusual inflow.

ChainArgos CEO Jonathan Reiter pointed out that although these funds flowing into Binance may no longer belong to the North Korean hackers, the exchange actually became the final link in the hackers' money laundering chain, helping to launder hundreds of millions in stolen crypto.

Reiter said that from the timeline, "the only reasonable source for these outgoing ethereum is the stolen funds," which should have been flagged as dirty money. "Binance should have detected this anomaly—even poor or flawed screening tools should have caught this kind of issue."

Regarding this fund inflow, Canassa did not respond directly, only emphasizing that Binance "has built a comprehensive and multi-layered compliance and security system."

Elaborately Crafted Scams

Last year, a father in Minnesota stumbled upon an "investment opportunity." Following the guidance of a family financial firm based in Seattle and Los Angeles, he engaged in crypto trading, only for the funds to vanish—ultimately losing $1.5 million to scammers.

In March this year, he wrote to the FBI: "My family and I are not only in financial ruin, but also suffering emotionally." To protect his privacy, he requested anonymity.

The stolen funds have not been recovered. However, according to a crypto data firm commissioned by the victim, more than $500,000 of it ultimately flowed into major exchanges.

Such scams have become a major problem in the crypto industry, with many elderly investors, singles, and even bank presidents falling victim. FBI data shows that last year, crypto investment scams caused $5.8 billion in losses to victims.

One of the most common scam types is the "pig-butchering" scam. Originating from a Chinese term, it refers to scammers "fattening up" victims before defrauding them. Scammers typically pose as admirers, engage in flirtatious relationships with victims for days or weeks, and then lure them into fake crypto investments.

The person in the photo, Shan Hanes, is president of Heartland Tri-State Bank in Elkhart, Kansas, who was convicted of embezzlement last year after losing funds in a crypto scam

Crypto exchanges play a key role in these scams, serving as convenient channels for scammers to convert illicitly obtained crypto into cash.

Scammers' identities are often hard to trace, but the Minnesota case offers a glimpse into Binance's internal systems.

By regulation, crypto exchanges must conduct KYC procedures before opening accounts, collecting detailed personal information to prevent fraud.

At the request of a Minnesota police subpoena, Binance submitted information on two accounts linked to the pig-butchering scam. In just a few months from 2023 to 2024, the first account had over $7 million in transactions. The account photo showed a woman standing in front of a corrugated metal wall, with a registered address in a Chinese village.

The second account was registered to a 24-year-old woman from rural Myanmar. By mid-2024, the account had over $2 million in transactions in nine months—more than 1,000 times Myanmar's average annual salary.

Erin West, head of an anti-fraud nonprofit and former prosecutor, reviewed the information and pointed out that these two women were likely "money mules," whose personal information may have been stolen by scammers to register fake Binance accounts. She said: "These accounts have no legitimacy at all; we've seen this kind of thing countless times." Binance declined to comment.

For scammers thousands of miles away, law enforcement is often powerless.

Fifty-eight-year-old Carrissa Weber from Alberta, Canada, was induced by a scammer posing as a startup manager to invest in crypto this year, losing her life savings of $25,000. Weber reported to Canadian police, but the stolen funds have not been recovered.

She said helplessly: "My case is just sitting there, and no one is handling it."

An analysis of Weber's transaction records shows her stolen funds flowed into several crypto wallets, ultimately ending up on Okx. Okx's Lacewell said the two accounts receiving the funds had been under monitoring for "suspicious characteristics" since last year, but were not frozen until October this year—six months after Weber was scammed.

Gray Channels for Cashing Out Crypto

In the back of a deli in Kyiv, Ukraine, past shelves of snacks and sodas, pressing an electronic doorbell opens a door marked "Currency Exchange."

Inside is a brick-and-mortar shop specializing in crypto exchange. On the table is a bill counter, an old plastic calculator, and a box full of rubber bands for bundling stacks of cash.

Crypto experts and law enforcement say these crypto cash-out shops, found throughout Asia and Eastern Europe, have become new hubs for global money laundering crime.

Anyone can walk into these shops, often without showing ID, and exchange large amounts of crypto for dollars, euros, or other fiat currencies. According to crypto analytics firm Crystal Intelligence, last year such crypto exchange shops in Hong Kong handled over $2.5 billion in transactions.

Richard Sanders, a crypto tracking expert who has long studied these shops, said: "These shops may provide unlimited laundering space for all kinds of financial crime."

Many crypto cash-out shops rely on major exchanges for their business. Crystal's data shows that last year, Binance, Okx, and Bybit collectively received $531 million from these currency exchange shops.

Crystal Chief Intelligence Officer Nick Smart said: "We found that many of these shops require no ID, and there are basically no limits on exchange amounts."

One day in July this year, after arranging a deal via Telegram, a reporter transferred $1,200 in crypto to the exchange point inside the Kyiv deli. Minutes later, the shop staff handed him a stack of cash bundled with thick rubber bands, provided no receipt, and deleted the Telegram chat after the transaction. The exchange point did not respond to a request for comment.

Over several weeks this year, the International Consortium of Investigative Journalists collected wallet addresses from a dozen such brick-and-mortar shops in Ukraine, Poland, Canada, and the UAE.

Transaction records show that these wallets mostly received funds from major exchanges. This means users wishing to cash out would first transfer funds from their exchange accounts, then to these shops for conversion.

On the 41st floor of a glass office tower in Dubai, a reporter saw a customer exchange $6,000 in crypto for a stack of UAE banknotes at a cash exchange point. Analysis of the shop's crypto address showed it received over $2 million in crypto in two weeks in September, including $303,000 from Binance.