When attackers extort victims with ransomware and receive payments in bitcoins, these transactions are recorded on the blockchain. However, the wallets receiving these illicit funds become marked, prompting cybercriminals to launder the money through various complex methods to realize profits from online scams, thefts, and cyberattacks. Laundering cybercrime proceeds involves intricate transfers and conversions between cryptocurrencies and legal tender. Tracking these funds poses significant challenges for investigators. Raúl Orduna, head of Digital Security at the Basque technology center Vicomtech, notes that this activity creates a submerged yet vast and complex global economy. The critical issue for attackers post-cyberattack is how to access the obtained money. According to Chainalysis’s 2024 Crypto Crime Report, in 2023 the laundering of illicit cryptocurrency-linked funds reached about $22. 2 billion. Over the past year, the total value sent to illicit blockchain addresses—digital accounts for cryptocurrencies—was $40. 9 billion, potentially rising to $51. 3 billion. Cybercriminals aim to convert these vast illicit sums into clean money. George Smaragdakis, Cybersecurity professor at the Technical University of Delft, explains that attackers usually receive funds in bitcoin or other cryptocurrencies and then try to access them anonymously through mechanisms such as exchanges or mixers. The funds move across multiple blockchain addresses, with parts eventually entering the real economy. To understand this laundering maze, certain concepts need clarification. Smaragdakis and Orduna collaborate on the Horizon Project, a European initiative involving companies, research centers, and law enforcement aimed at bolstering the EU’s cyber threat readiness, including understanding how criminals profit. In cryptocurrencies, a wallet contains multiple blockchain addresses used to send or receive funds. While blockchain transactions are anonymous, their records are public, enabling analysts to detect money laundering patterns without identifying owners, says Orduna. Investigators focus on identifying crypto services analogous to banks but operating anonymously. They pay particular attention to blockchain systems like escrow smart contracts, which hold funds until contract terms are met, and mixers, designed to increase transaction anonymity by obscuring fund origins and exchanges between cryptocurrency types.

Orduna explains that mixers hinder tracing payment sources. Smaragdakis adds that while the source—the victim—is often identifiable, after numerous transfers, the trail becomes lost. Cybercriminals exploit the ease of creating thousands of blockchain addresses (unlike bank accounts, which are harder to open) to confuse tracking efforts. Previously, criminals centralized victim payments in one address, but now they assign unique addresses per victim and often multiple addresses per single victim, explains Smaragdakis. This tactic fragments illicit funds into smaller amounts across many addresses, complicating control and monitoring. Next, criminals may mix these funds with other monies or use crypto-accepting casinos. By making many micro-bets with minimal risk and profit, they effectively “clean” the money, which can then be withdrawn as legal tender, Orduna adds. Exchanges like Binance or Coinbase represent another laundering avenue but are generally off-limits to criminals since these platforms enforce anti-money laundering policies, requiring verified identity documents and selfies linked to user accounts. Law enforcement can request user information by court order, deterring illicit activity there. Thus, criminals turn to unregulated platforms mimicking exchanges. Orduna warns that these entities, though unregistered, exhibit transaction patterns similar to legitimate exchanges. Researchers at Vicomtech strive to detect such platforms by analyzing blockchain transaction patterns. By modeling the behavior of legitimate exchanges, investigators develop digital behavior models to identify illicit exchange-like activity across blockchain networks. The Vicomtech team collaborates closely with authorities, gathering requirements and examples of suspicious activity, generating synthetic anonymized data to build and test intelligent detection models. Once validated, these models assist real investigations managed by competent authorities. While much cybersecurity research focuses on understanding attacks, improving defenses, and mitigating breaches, another vital effort is tracing illicit money flows. This work is crucial in hampering criminals’ ability to profit, thereby reducing their economic incentive to conduct cybercrime.