Alexandre Berkovic and Chrisjan Wüst · Sphinx Frameworks · 2026
TL;DR: On a public ledger the money is never hidden. The people are. Illicit addresses received at least $154 billion in 2025, and settlement is final before an analyst opens the alert. Five stages, asked of the same wallet, turn a hop count into a disposition: behavior, typology, exposure, counterparty, and the off-chain record.
The ledger is public. The people are not.
Traditional transaction monitoring rests on two comforts: funds move slowly enough that a suspicious payment can be held, and every leg passes through an institution that knows its customer. Neither holds on a public blockchain. A transfer confirmed on Ethereum or Tron is final in seconds. The recipient is an address. It may belong to a regulated exchange, a self-hosted wallet, a smart contract with no operator, or a laundering desk.
The compensation is transparency. Every transaction is recorded, permanently, for anyone to read. An investigator who would have needed a subpoena to see the next hop in a correspondent chain can follow a crypto transfer through fifty addresses in an afternoon. The monitoring problem is inverted: more data about the movement of value than ever, and less certainty about who is moving it. Fiat programs that start from a named customer and a slow rail are described in behavioral transaction monitoring. This volume starts from the address.
Illicit cryptocurrency addresses received at least $154 billion in 2025, a 162 percent increase on the prior year (Chainalysis, 2026). A second estimate, using a different attribution set, put the figure at $158 billion, up roughly 145 percent (TRM Labs, 2026). Both are lower bounds that rise as attribution improves. The 2024 estimate of $40.9 billion had been revised to $57.2 billion a year later. The increase was driven by a 694 percent rise in value received by sanctioned entities, most of it linked to Russian settlement infrastructure. Nearly 95 percent of inflows to sanctioned entities arrived as stablecoins. Illicit activity as a share of all on-chain volume still fell, from 1.3 percent to 1.2 percent. Crypto is not mostly crime. The criminal share moves at block speed through the same rails as everyone else.
FATF's June 2025 targeted update found that 73 percent of surveyed jurisdictions had passed Travel Rule legislation, and that 50 of those 85 had taken no supervisory or enforcement action on it. Only 3.8 percent of the $1.46 billion stolen from Bybit had been recovered (FATF, 2025). The standards exist. The gap is where laundering lives. Crypto businesses feel that gap first, because the onward flow is visible and the name is not.
Five questions, one wallet
Treating on-chain monitoring as five independent rule sets produces five alert queues, none with enough context to close a case. A dormancy alert without counterparty attribution is noise. A sanctions hit without behavioral context cannot tell a customer who received tainted change from a laundering intermediary. The stages are the order in which an experienced analyst works a wallet.
Five analytical stages on the same address, feeding one explainable disposition.
On-chain behavior. Is this wallet behaving like itself? Wallets develop patterns of value, frequency, counterparty mix, and protocol use. A common convention is a trailing six-to-twelve-month window, recalibrated so a growing business is not perpetually alerting against a stale baseline. Deviation is the earliest signal of compromise, account takeover, or a change in purpose. Dormancy matters because of what follows the reactivation, not because the wallet was quiet.
Laundering typologies. Does the sequence resemble a known technique for breaking the trail? A peel chain, as the Bitfinex complaint described it, is a large balance sent through a series of transactions in which a slightly smaller amount moves to a new address each time, with the peeled portion deposited to an exchange (U.S. Department of Justice, 2022). Transit wallets, on-chain structuring, bridge hops, and mixer deposits are the same bet against the investigator's patience. Direct transfers from illicit entities to exchanges fell from about 40 percent of flows in 2021–22 to about 15 percent by the second quarter of 2025. The value moved instead through DEXs, bridges, and coin-swap services: $21.8 billion of illicit and high-risk value by mid-2025, up from $7 billion in 2023 (Elliptic, 2025). A third of complex investigations now span more than three blockchains.
The Bybit theft is the case at scale. On 21 February 2025 roughly $1.46 billion left the exchange. Within two hours the funds sat in about 50 wallets. Tokens were swapped to native ETH, then bridged. More than 161,000 ETH moved in 3,934 bridge transactions over 115 hours. The FBI attributed the theft to the DPRK-linked TraderTraitor cluster. Graph analysis follows the value. It does not follow the person. Reconstruction has a limit, and the disposition has to say where that limit is.
Exposure by hop. Direct exposure is a fact: the wallet, or the transaction, touches a sanctioned address. Indirect exposure is a judgment about distance. OFAC has been listing addresses since 2018. The targets have changed, from mixers (Blender.io in 2022, Sinbad in 2023) to exchanges and their successors (Garantex, then Grinex). Tornado Cash was designated, litigated, and removed from the SDN List on 21 March 2025 after the Fifth Circuit held that its immutable smart contracts are not property under IEEPA (U.S. Treasury, 2025). The delisting removed a blocking obligation on specific contracts. It did not make mixer exposure a non-event. Mixers still exist to defeat tracing, and the Lazarus Group remains designated. Treat mixer exposure as a laundering typology with a sanctions overlay.
FATF lists need a date. After the June 2026 plenary the grey list stood at 22 jurisdictions. The Democratic People's Republic of Korea and Iran remain subject to a call for countermeasures, and Myanmar to enhanced due diligence. A stablecoin transfer is not lower risk than bitcoin because of the asset. Stablecoins carried nearly all of the 2025 inflows to sanctioned entities. Their compensating feature is that issuers can freeze balances, which is why launderers swap them for base assets early. That swap is itself a signal.
Counterparty and protocol. Who is on the other side, and are they what they claim? The register is public. A licensed exchange, an unregistered OTC desk, a lending protocol, a gambling application, and a mixer are different counterparties, and the policy should say so. A transfer from a licensed exchange lowers counterparty risk. It does not tell you who the exchange's customer is, and OFAC's 2021 virtual-currency guidance is explicit that a company cannot rely on another firm's compliance program (OFAC, 2021). DeFi with no operator is classified by function. Ordinary use of a DEX is low risk in itself. Use as a conversion step in a laundering sequence is a typology. A protocol with an admin key and a legal wrapper may be a VASP. One with neither is infrastructure, and the risk sits with the wallets on either side.
The Travel Rule draws the line between obliged and unobliged. In the EU it has applied since 30 December 2024, with no de minimis, and self-hosted address ownership above EUR 1,000 has to be verified (Regulation (EU) 2023/1113). The UK's broader cryptoasset regime under FSMA commences in October 2027, with the authorization gateway opening in September 2026. A program that treats "the counterparty is an exchange" as the end of the inquiry will not survive that perimeter.
Documents and identity. The chain says what happened. The file says who and why. KYC, the Travel Rule payload, and proof of wallet ownership should tell one story. Possession of a private key is the proof of control that counts. An invoice can be tested against the ledger: the amount, the asset, the address, and the time. Where they disagree, the paper loses.
A disposition that reads like a case note
Every threshold in a crypto program is an illustrative convention. Dormancy windows, hop counts, and value triggers vary by institution, and any of them can be learned by an adversary who transacts long enough. The framework describes which signals to combine. It does not prescribe the numbers, and neither should a vendor.
The close is argued, not scored. A Prosecutor assembles the case that the wallet is illicit exposure or a laundering step. A Defender assembles the innocent explanation: a customer who received change, a licensed counterparty, a Travel Rule payload that matches. A Judge arbitrates under the institution's policy and writes the rationale. Ambiguous inputs and contradictory outputs go to a person. The pattern is the Interpretable Agentic Framework, and it is the same standard set out in Financial Crime in the Age of AI. What the system should never decide alone is a potential sanctions block, a filing, or a case where the attribution and the off-chain identity disagree.
Frequently asked questions
Does the Tornado Cash delisting mean mixer exposure is no longer a concern?
No. The March 2025 delisting removed the blocking obligation attached to specific smart-contract addresses. Mixers still exist to defeat tracing, and designated actors still use them. Treat mixer exposure as a laundering typology with a sanctions overlay.
Is a stablecoin transfer lower risk than bitcoin?
Not in itself. Stablecoins carried nearly 95 percent of inflows to sanctioned entities in 2025. Issuers can freeze balances, which is why launderers swap them for base assets early. That sequence is a signal.
Can I rely on the counterparty exchange's KYC?
You can factor it into the risk assessment. You cannot substitute it for your own. A transfer from a licensed exchange lowers counterparty risk and does not tell you who the exchange's customer is.
Read the handbook
Baselines, peel chains, hop-level exposure, and the regulatory anchors a policy should cite are in Crypto Transaction Monitoring at Block Speed. The off-chain half of the fifth stage, when the document itself cannot be trusted, is covered in validating source of funds.
.png)