Illicit crypto isn’t just a retail-scam problem – it is a fast-moving, system-level problem. According to the FBI Internet Crime Complaint Center’s (IC3) 2024 Internet Crime Report, victims reported over $6.5B in cryptocurrency investment-fraud losses, the year’s largest loss category. According to the Chainalysis, 2025 Crypto Crime Trends report, analysts estimate $40.9B flowed to known illicit addresses, and United Nations Office on Drugs and Crime (UNODC) report Transnational Organized Crime and the Convergence of Illicit Markets (2024), also highlights how cyber-enabled crime and crypto channels intersect across the region.
Furthermore, State-linked actors continue to steal and move funds at scale (e.g., DPRK-associated operations), and policy actions around major platforms and stablecoin rails are reshaping how money exits the system. Amid Nigeria’s crackdown, Binance announced it would halt naira services and auto-convert balances to USDT; stablecoin issuers have also frozen addresses linked to terrorism financing. Each development changes off-ramp behavior.
As indicated by the sources above, and further evidenced by the U.S. Treasury’s 2024 National Money Laundering Risk Assessment (NMLRA), illicit actors systematically using cross-chain bridges to chain-hop, alongside mixers/tumblers, smart-contract anonymity protocols (e.g., Tornado Cash), unregistered OTC brokers, and privacy coins. Independent reporting also quantifies the scale of cross-chain laundering.
These obfuscation layers challenge tracing and complicate attribution. U.S. Treasury notes chain-hopping can “frustrate the ability to trace financial transactions quickly,” and Europol lists anonymization services and obstacles to international cooperation as persistent investigative challenges contributing to more frequent stalls and delays at these obfuscation junctures.
Taken together, this indicates that published figures are a lower bound that will rise as more wallets are identified. It also suggests an uncovered area beyond what analytics alone cover, calling for methodological and procedural approaches, alongside technology, to overcome these challenges.
Current best practice
Under the umbrella of non-technical, complementary solutions, two common and valuable practices stand out. When executed well, they consistently improve outcomes:
Enabling training
“Enabling training” means professional, role-based instruction that builds knowledge and skills and maintains practical capability – so investigators, prosecutors, and, where relevant, judges, share a common vocabulary, understand evidentiary standards, and can act on complex traces. It is recurrent and scenario-driven, designed to prevent proficiency drift. Given the challenges above, staying ahead of the curve benefits from a professional training approach, akin to what cyber analysts and even pilots use.
Close LEA \ prosecutor coordination
Timely, lawful information-sharing between law-enforcement units, FIUs, and prosecutors greatly improves outcomes on cross-jurisdictional, cross-border, and cross-cultural cases. Unfortunately, this is difficult in practice: time zones, language, and differing standards create real friction.
Disrupting the illicit flow of funds
Going deeper to mitigate these challenges, we propose, based on our investigative experience, that analyzing both the illicit flow of funds and considering the logic that drives it can improve outcomes by opening additional opportunities for data collection and corroboration. In other words, acknowledging the sequence of actions used to evade tracing and liquidate proceeds, together with the underlying motivations such as speed, liquidity, low attribution risk, and jurisdictional arbitrage, tends to expand options for resolution.
The following chart illustrates a typical illicit flow of funds. While not every case includes every element, the structure and motivations are consistent: intake in widely recognized assets such as BTC/ETH or liquid stablecoins (easier to lure victims and accept funds); obfuscation via mixers/tumblers, smart-contract anonymity protocols (e.g., Tornado Cash), DEX swaps and bridges, privacy coins, and unregistered OTC brokers; re-entry to liquid rails; and cash-out through centralized exchanges or OTC facilitators.
While layering disguise techniques and adding hops can increase an offender’s odds of success, each additional step also creates more traces and interfaces for a skilled investigator to exploit. In practice, terror-finance cases often illustrate a pattern of OTC intake > mixer egress > stablecoin re-entry, which creates a short, visible window right as funds leave the mixer, when the withdrawal addresses and their first-hop destinations can be more easily identified. During that window, investigators can – in principle – send narrowly scoped, lawful preservation requests to the relevant exchanges or service providers. In cross-border investment-fraud cash-outs, bridge exits into high-liquidity stablecoins tend to cluster around a small set of venues, producing patterned liquidity spikes that guide precise requests and evidence packaging.
In both patterns, the post-egress window is often shorter than normal response cycles. A structured process bakes these into preparation, not improvisation. This makes teams better prepared and raises the chance of capturing early artifacts before liquidation.
How the methodology supports investigations
Adopting a structured, process-led approach, provides investigators with the following benefits (to avoid aiding offenders, we omit operational thresholds, sensitive heuristics, and play-by-play case steps. The benefits below describe process effects, not tactics)
More observables
Though it’s true that each obfuscation step (mixer, bridge, swap, OTC handoff) adds to the complexity of the investigation, it also leaves additional traces across time, liquidity, counterparties, and jurisdiction.
Therefore, a defined workflow turns that volume into a usable signal (e.g., triage, cross-chain pivot map, targeted requests), enabling earlier intervention before liquidation and reducing blind alleys.
Pattern-led anticipation
Different typologies (such as the above-mentioned terror finance and investment fraud) express different “logic” (speed requirements, liquidity preferences, target-audience behavior).
Encoding these patterns upfront helps anticipate likely next moves (e.g., likely OTCs and bridge exits into liquid stablecoins) from initial leads and prompts earlier searches for corroborating hints.
Predefined checklists at transitions
Pattern-led thinking also enables investigators to anticipate transitions (e.g., mixer egress to CEX adjacency, bridge exit to asset/liquidity shift) and maintain data checklists – conditional on hop count and sequence – that specify required on-chain artifacts and any off-chain asks.
This contributes to fewer omissions (e.g., by creating pre-drafted language), faster assembly of evidence, and clearer rationale for each request.
Process management and feedback
Tracking and measuring predefined KPIs such as time-to-first-hypothesis, request “hit rate” (by external players such as exchanges and other VASPs), rework rate, and pattern-classification accuracy, enables continuous improvement of the process and skills (similarly to ongoing professional training, such conduct often requires an organizational shift toward a more structured, professional cadence).
Tool alignment kits per pattern
As the process reveals what evidence is needed at each gate, it allows investigators to select or combine tools accordingly (a “kit” per case type/pattern, e.g., emphasizing jurisdictional OSINT + mixer-egress monitoring for better encountering the terror-finance pattern), without assuming any platform is sufficient on its own. This allows better tool fit and fewer dead ends caused by over-reliance on a single analytic path.
Focused engagement at cash-out points
Systematic mapping of likely exit routes (e.g., OTC facilitators, adjacent exchanges, and the small set of venues showing clustered stablecoin inflows) concentrates effort on the exchanges/VASPs and OTC facilitators most relevant to the case. This allows clearer liaison targets and documentation standards. While not all entities cooperate, and some appear overnight, a methodical approach improves the odds and speeds responses.
Conclusion
The growing complexity and volume of illicit on-chain activity have produced a stall gap in investigations. Closing that gap requires professional approaches that work alongside analytic tools while relying on human skill and dedicated training. We propose that understanding, framing, and managing the illicit flow, create structured opportunities to advance investigations. While this does not eliminate the gap, it reduces it.
