June 17, 2025

Money laundering is a major concern in cybersecurity and financial crime, involving methods to hide illicit funds as legitimate. In the digital age, cryptocurrencies, dark web marketplaces, and decentralized finance has allowed money laundering tactics to evolve in complex ways. This blog explores traditional money laundering stages and how they’ve transformed on the dark web, the use of NFT art in laundering schemes, and how decentralized tools like mixers and privacy wallets facilitate modern laundering. 

The Traditional Stages of Money Laundering 

Money laundering is the process of concealing illegally obtained money so that it appears to come from a legitimate source. Money laundering consists of three sequential stages: 

1. Placement: Introducing “dirty” money into the financial system. This might involve depositing cash into banks, or buying assets. 

2. Layering: Moving and converting funds through a series of transactions to obscure the money’s origin. Launderers create complex layers of transfers – between accounts, through shell companies, via wire transfers, or by converting into different assets. 

3. Integration: Reintroducing the cleansed money back into the economy as apparently legitimate funds. At this stage, the money may emerge as proceeds from a fake business, real estate investment, luxury asset sale, or other legitimate-seeming revenue. 

The advent of digital currencies and the dark web has added new twists to each stage. Placement now often begins with cryptocurrency instead of cash, layering can involve blockchain transactions or token swaps, and integration might occur through crypto exchanges or NFT sales. 

Evolution in the Digital Age and the Dark Web 

Hidden online marketplaces accessible via Tor and similar networks have changed how criminals earn and launder money. Dark web marketplaces enable global trade in illicit goods (drugs, stolen data, malware, etc.) paid for with cryptocurrency. This means that criminals increasingly acquire illicit funds already in digital form, like Bitcoin, rather than cash. Money laundering strategies have adapted to take advantage of new digital platforms and applications. 

Vendors and buyers use encrypted communications, and payments are almost exclusively in cryptocurrency. This digital placement of funds is immediate – for example, a ransomware group or drug vendor receives Bitcoin directly as the proceeds of crime. The challenge for criminals is to cash out or further obscure those crypto funds without revealing their identity. In response, they leverage a variety of obfuscation tactics online. 

One key evolution is the use of conversion services and intermediaries. According to Chainalysis, after illicit crypto is obtained (from hacks, darknet sales, etc.), criminals send it through “conversion services” during the layering stage – swapping coins, using DeFi protocols, gambling sites, mixers, or cross-chain bridges.  

At the same time, cryptocurrency’s transparency can aid investigators. Public blockchains allow law enforcement and blockchain analytics companies to trace flows of illicit crypto. As noted in a 2024 Chainalysis report, investigators leverage blockchain transparency to uncover illicit activity that might go undetected in cash dealings. 

NFT Art as a Laundering Vehicle 

In recent years, criminals have shown interest in non-fungible tokens (NFTs) as a new avenue for money laundering. NFTs are unique blockchain tokens often linked to digital art or collectibles. This is like traditional money laundering in the traditional art world where valuable art pieces can be bought with dirty money and later sold, making the sale look legitimate. 

While NFT-based laundering is a smaller piece of the puzzle, it is visible. Blockchain analysis by Chainalysis found that the value sent to NFT marketplaces from illicit addresses jumped significantly in late 2021, reaching about $1.4 million in Q4’2021. 

Criminals are indeed experimenting with NFTs by trading NFTs between wallets, they control (wash trading) or buying high-value NFTs with tainted crypto as they aim to obscure origins. 

Mixers, Tumblers, and Privacy Tools 

To further muddy the waters of blockchain tracing, criminals turn to cryptocurrency mixers (also called tumblers) and other  tools. Mixers are services that pool together cryptocurrency from many users and then pay it out to new random addresses, thus breaking any link between the incoming and outgoing funds. The result is that it becomes very difficult to prove which output coins are associated to which input, thereby obscuring the origin of the funds. Popular mixer implementations have included Tornado Cash (for Ethereum) and various Bitcoin tumbling services (like Blender.io, ChipMixer, Wasabi wallet’s CoinJoin feature, etc.).  

Mixers play the role of layering in the crypto laundering process. Illicit actors use mixers as “safe havens” to launder criminal proceeds, including funds from hacks, fraud, ransomware, and darknet sales. For example, after a big cryptocurrency theft or ransomware payout, the criminals will often route the BTC or ETH through one or multiple mixer services. By the time the coins exit the mixer, the hope is that investigators cannot easily follow the money, since the trail “goes cold” at the mixer’s wallet. 

Tornado Cash deserves special mention because it was an Ethereum-based mixer that gained popularity for its use by cybercriminals. Tornado Cash allowed users to deposit tokens and withdraw to a fresh address with no link. By 2022, it had become a go-to laundering tool for groups like Lazarus Group (North Korea) to launder their ransomware proceeds. The U.S. Treasury’s OFAC sanctioned Tornado Cash in August 2022. In 2023, the U.S. Department of Justice went further by indicting two alleged Tornado Cash founders. The August 2023 indictment accused them of facilitating over $1 billion in money laundering transactions through Tornado, including hundreds of millions of dollars for the Lazarus Group.  

Conclusion 

Money laundering has always been about staying one step ahead of investigators by exploiting gaps in the financial system. The dark web and cryptocurrencies introduced a new venue for launderers, where geography means little and anonymity is the default. We’ve seen how traditional stages of money laundering (placement, layering, integration) have counterparts in the crypto realm. From cash to crypto, to complex hops through mixers and tokens, then cashing out via exchanges or NFT sales. Tools like Bitcoin and Ethereum have public ledger trails, but coins like Monero offer near-total concealment but are harder to cash out. Decentralized mixers and wallets provide new ways to wash funds, even as authorities push back with sanctions and arrests. Meanwhile, novel schemes like NFT-based laundering show the creative lengths to which criminals will go. 

Interested in fraud prevention? Check out our use case.