Beware! Six common criminal behaviors in cryptocurrency money laundering, these legal red lines must not be crossed
Written by: Xiao Sa Legal Team
The Chainalysis 2026 Cryptocurrency Money Laundering Report reveals six core service types of Chinese Money Laundering Networks (CMLNs)—money running, mule teams, underground OTC, Black U, crypto gambling, and token mixing—have become the prevalent criminal activity patterns in current cryptocurrency crimes. Combining the Criminal Law and the latest judicial interpretations and typical cases from the “Two Supreme” authorities, this article will analyze key issues such as the application of criminal charges, boundaries of offenses, and subjective intent recognition for these six service types, clarifying the legal red lines for criminal justice practice and industry compliance.
- Money Running (Running point brokers)
As the initial entry point for illegal funds into the crypto system, money running involves recruiting individuals to rent bank accounts, digital wallets, or exchange addresses to receive and transfer illegal proceeds from scams, gambling, etc. It is currently the most involved criminal laundering activity in judicial practice. The core of criminal charge recognition depends on the level of participation and subjective awareness, mainly involving aiding information network crimes (“assistance crime”) and concealing or disguising criminal proceeds (“concealment and obfuscation crime”).
(1) Pure account provision: Assistance crime
According to Article 287-2 of the Criminal Law and the Supreme People’s Court and Supreme People’s Procuratorate’s interpretation on applicable law for cases involving illegal use of information networks, providing payment settlement assistance knowingly for crimes committed via information networks, with amounts over 200,000 yuan or illegal gains over 10,000 yuan, constitutes a “serious circumstance” of assistance crime.
In judicial practice, individuals who only provide bank accounts or digital wallets without participating in fund splitting or transfer operations, and without prior conspiracy with upstream criminals, are convicted of assistance crime.
(2) Participants in fund operations: Concealment and obfuscation crime
If money runners or organizations not only provide accounts but also actively split funds, transfer across platforms, and coordinate with upstream criminals in real-time, indicating clear awareness that the funds are criminal proceeds and actively concealing or disguising them, they should be charged with concealment and obfuscation crime.
(3) Presumption of subjective intent
Judicial authorities do not require defendants to admit “knowing” explicitly; instead, they infer based on objective evidence: such as advertisements explicitly warning about “legal consequences,” commissions significantly higher than market norms, rapid in-and-out transactions, and counterparties being unspecified foreign entities, all can be presumed to indicate “knowing” intent.
- Money Mule Motorcades
Money mule teams are the core layer in crypto laundering, involving offline transactions, ATM withdrawals, third-party payments, etc., to achieve dual conversion between fiat and crypto, using multiple accounts and steps to obscure fund traces. Their behavior exceeds simple “helping with payments,” and in practice, is generally recognized as concealment and obfuscation crime, with some cases constituting accomplices to upstream crimes.
(1) Independent laundering: Concealment and obfuscation crime
According to Article 312 of the Criminal Law, transferring or converting criminal proceeds knowingly constitutes concealment and obfuscation crime. Mule teams operate in “teams,” splitting illegal funds and converting them into cryptocurrencies or cashing out to transfer to upstream criminals, typical of “transferring and converting criminal proceeds.”
For example, in the 2025 Wuhan police dismantling of a USDT laundering gang, the gang converted overseas scam proceeds into USDT and transferred over 6 million yuan, a typical operation involving mule teams, with all members liable for concealment and obfuscation.
(2) Collusion with upstream crimes: Upstream accomplices
If mule teams collude with telecom scams, online gambling, or other upstream criminal groups in advance, providing laundering services or participating in profit-sharing schemes, they are no longer considered independent concealment actors but are convicted as accomplices to fraud or illegal gambling. According to the “Opinions on Handling Crimes of Helping Information Network Crimes,” such cases should be punished more severely than concealment crimes, with much longer sentences.
(3) Cross-border teams and jurisdiction
For cross-border mule teams in Africa or Southeast Asia, according to the territorial jurisdiction principle in the Criminal Law, as long as part of the criminal conduct occurs within China (e.g., funds transferred from domestic accounts or organizers are Chinese citizens), Chinese authorities have jurisdiction and can prosecute accordingly.
- Underground OTC
Underground OTC is the core link for crypto-to-fiat exchange and a key bridge in laundering networks. Its behavior violates national financial regulation and anti-money laundering laws, with potential overlap of illegal operation and money laundering crimes, usually punished as a single offense in practice. Pure OTC transactions not connected to illegal funds are only charged with illegal business operations.
(1) Pure underground OTC: Illegal business operation
According to document Yinfa [2026] No. 42, virtual currency exchange and trading activities are considered illegal financial activities. Article 225 of the Criminal Law explicitly states that engaging in payment and settlement services without approval, disrupting market order, and involving serious circumstances constitute illegal business operations.
OTC traders without payment licenses or foreign exchange qualifications, engaging in fiat-crypto exchange regardless of illegal fund connection, are charged with illegal business operations. The standard amount for conviction refers to judicial practice: transactions over 5 million yuan or illegal gains over 100,000 yuan are considered “serious,” with penalties up to five years; amounts five times higher are “particularly serious,” with over five years’ imprisonment.
(2) Connecting illegal funds: Overlap of illegal business and money laundering
If OTC traders knowingly exchange funds derived from scams, gambling, corruption, etc., for transfer or conversion, they commit both illegal business and money laundering. Under Articles 191 of the Criminal Law and the “Two Supreme” interpretations, such transactions are directly recognized as money laundering.
This constitutes an overlapping offense; under the “one punishment for one crime” principle, the sentence for money laundering is higher (5-10 years for serious cases, over 5 years for particularly serious), and in practice, money laundering is prioritized.
(3) “White U” pretenses
Underground OTC traders often claim “clean funds” (“White U”) to evade responsibility, but law enforcement can refute this through on-chain data (wallet addresses linked to laundering networks, transaction counterparties’ identities). As long as on-chain evidence shows a connection to illegal funds, the trader’s “knowledge” is presumed, without requiring self-admission.
- Black U services
Black U services are a special type of crypto money laundering, involving publicly reselling illicit crypto assets obtained from hacking, scams, or wallet theft at 10-20% below market price. They are the most typical direct perpetrators of money laundering in practice, with little dispute over criminal charges.
(1) Typical money laundering cases
According to the “Two Supreme” interpretation on applicable law for money laundering cases, proceeds from drug crimes, organized crime, financial scams, and other seven categories of upstream crimes transferred or converted via virtual assets are directly recognized as money laundering under Article 191 of the Criminal Law. Black U services openly claim to handle “illegal crypto assets,” fulfilling all elements of money laundering: subjective “knowing” and objective “transferring or converting” criminal proceeds, with upstream crimes falling into the seven regulated categories.
(2) Sentencing aggravation and accomplice recognition
Sentencing focuses on the amount laundered and malicious intent: if the amount exceeds 5 million yuan, with multiple laundering acts, refusal to cooperate with asset recovery, causing losses over 2.5 million yuan, or other serious consequences, it is considered “serious” money laundering, with 5-10 years’ imprisonment and a fine of 5%-20% of the laundered amount.
If operators of Black U services participate in upstream hacking or scams—such as agreeing on profit-sharing with hackers or providing wallet addresses—they are considered accomplices to upstream crimes and money laundering, subject to cumulative penalties.
- Crypto gambling: primary offense of operating a casino, secondary of money laundering
Crypto gambling is not merely a laundering channel; it constitutes an independent crime. Operating a casino is the core offense, and using gambling platforms to launder funds from other crimes results in multiple charges; only providing settlement services to gambling platforms can be charged as an accomplice or concealment crime.
(1) Operating a crypto gambling platform: Casino operation
According to Article 303, paragraph 2 of the Criminal Law and related judicial opinions, organizing gambling activities via internet or mobile communication, transmitting gambling videos or data, constitutes operating a casino.
Crypto gambling platforms accepting virtual currency bets, setting odds, or manipulating results (e.g., “minimum payout” reports) are typical online casino operations. If total bets exceed 300,000 yuan and the number of participants exceeds 120, it is a “serious” circumstance, with 5-10 years’ imprisonment. For example, in the 2025 Hebei Handan virtual asset gambling case, defendant Xu used virtual assets “Ling Shi” to run an online casino with a transaction chain of 557 million yuan, ultimately convicted of operating a casino and sentenced to 8 years.
(2) Laundering funds for crypto gambling platforms: accomplice or money laundering
If individuals collude with gambling platforms beforehand, providing crypto recharge, withdrawal, or transfer services, they are accomplices to operating a casino. If they assist other criminal groups in laundering funds via gambling platforms without prior collusion, they are charged with money laundering.
Ordinary investors betting large amounts may be charged with gambling; if they provide fund settlement for others and meet the criteria for assistance crime, they are convicted accordingly.
- Token mixing (Money movement services)
Token mixing involves obfuscating transaction traces through coin mixing, cross-chain transfers, etc., providing “anonymization” for illegal funds. The key to criminal charge recognition is whether the service specifically targets illegal funds—i.e., whether it is a neutral technical service or criminal aiding.
(1) Connecting illegal funds: Money laundering
If operators knowingly serve criminals, providing mixing or cross-chain transfer services, or developing “anonymization” features (e.g., obfuscating on-chain traceability, forging transaction traces), they commit money laundering. A typical example is Tornado Cash sanctioned by the U.S. If operated within China, such services are automatically charged with money laundering.
(2) Neutral technical services for general users: Generally not criminal
If token mixing services are open to all users, do not specifically target illegal funds, and operators have taken reasonable precautions (e.g., KYC, monitoring suspicious transactions, reporting to regulators), they are considered neutral technical services and, due to lack of subjective “knowing,” are generally not criminal.
(3) Presumption of subjective intent: Based on service objects and design
Judicial recognition of operators’ subjective intent mainly considers two aspects: first, service targets—if over 90% of users are foreign illegal fund holders, it is presumed the operator “should know”; second, functional design—if core functions aim to “evade on-chain traceability” without compliance or risk controls, it is presumed the operator “knows.”
Conclusion
The anonymity, cross-chain, and cross-border features of cryptocurrencies make them significant vehicles for money laundering. The six service types—money running, mule teams, underground OTC, Black U, crypto gambling, and token mixing—form an interconnected Chinese crypto laundering network, becoming key areas for criminal justice enforcement. In practice, charges are not fixed but depend on subjective awareness, participation level, and connection to upstream crimes, distinguishing boundaries among assistance, concealment, illegal operation, and money laundering, while applying precise rules for accomplice and overlapping offenses, reflecting China’s careful and targeted approach to combating crypto money laundering.
Currently, regulators continue tightening controls over illegal crypto financial activities, and judicial authorities use on-chain data, objective evidence, and cross-border jurisdiction to address the challenges of crypto laundering recognition. For industry participants, understanding the criminal boundaries of these six service types is not only a legal red line but also essential for compliance. Only by abandoning complacency and strictly adhering to AML and financial regulations can they avoid legal risks.
At the judicial level, ongoing improvements are needed in evidence rules, standards for applying charges, and cross-border cooperation mechanisms to effectively combat crime while balancing technological innovation and financial security, thus safeguarding the healthy development of the digital economy.
This concludes today’s sharing from the Sa Jie team. Thank you for reading.