How to follow the money in the crypto world 

Cryptocurrencies have become a haven for illicit funds, with more than $28 billion linked to criminal activity flowing through digital exchanges in recent years. But how do you follow the money in a virtual world designed to be untraceable? 

The Coin Laundry investigation, led by the International Consortium of Investigative Journalists (ICIJ), traced the flow of illicit funds through the crypto ecosystem, analyzing hundreds of wallet addresses tied to criminal activity, revealing the massive scale of crypto’s role in moving illegal funds.  

We spoke with Spencer Woodman, an ICIJ reporter, who over more than 10 months led an investigation team of 113 reporters from 37 media partners across 35 countries. He discussed his contribution to the investigation and the lessons it offers for journalists navigating the opaque world of cryptocurrency. 

From offshore leaks to blockchain analysis 

The project grew out of ICIJ’s decade-long focus on financial crime and money laundering, but it took shape around the publication of the Cyprus Confidential investigation in 2023. That’s when cryptocurrency addresses began appearing in documents from offshore jurisdictions, Woodman said to iMEdD. 

Confronted with the inherent anonymity of cryptocurrency and the limits of existing tracing tools, ICIJ journalists developed a unique methodology.  

First, they cultivated sources and reviewed leaks from major blockchain analytics firms. But realizing that those firms were often hesitant to name major industry players, particularly cryptocurrency exchanges, on the record because they were current or potential clients, they concluded that much of the data analysis would need to be done in-house, Woodman said. 

Then, they tracked illicit “wallet addresses”, which are codes consisting of letters and numbers that identify accounts on the public blockchain, by piecing together information from scam victims, court and police records, sanctions lists, regulator complaints, and test transactions with crypto services.

While transactions are publicly recorded on the blockchain, explained Woodman, the ownership of cryptocurrency wallet addresses often remains anonymous, making it difficult for law enforcement to identify who controls the funds or seize assets. “I was most alarmed by the fact that law enforcement did not have their cryptocurrency addresses,” he said. “And then, once we got the cryptocurrency addresses, the large amounts they were moving were astonishing.” 

The next step was to follow how assets moved into and out of accounts on the public blockchain, which led them to the biggest players, such as The Huione Group, “which is known as one of the world’s largest money laundering groups in cryptocurrency,” said Woodman.   

“We were able to obtain some of their cryptocurrency addresses. It was just three cryptocurrency addresses that we mostly focused on,” added Woodman. “Those addresses ended up being the largest amounts of money that our in-house data work encompassed, and that was hundreds of millions of dollars.” 

“We would double, triple, quadruple check” 

Cryptocurrencies are a form of digital currency secured by cryptography that lets people transact directly, without banks or governments. They operate on a decentralized blockchain network, and some of the most well-known are Bitcoin, Ether, Dogecoin, and Tether. 

The investigation team learned to use blockchain explorers, such as Tronscan, and Etherscan, and a more advanced, open-source analytics platforms, like Arkham Intelligence, built on blockchain data to help trace activity and link addresses to real‑world entities.  

But tools alone were not enough.  

“That can give you a rough sense of what you’re looking at,” said Woodman, emphasizing that it was a network of a dozen experts and organizations that helped them understand what they are really seeing in the data, track cryptocurrency transactions, and validate their analyses.

“In many cases, we would double, triple, quadruple check these findings because we know that we are not the experts”.  

From Ukraine to Dubai: a shadowy crypto-to-cash business 

The Coin Laundry investigation also looked into an opaque ecosystem of crypto-to-cash and courier services that make it possible to anonymously liquidate large sums of cryptocurrency without regulatory scrutiny. 

The investigation took Woodman to Ukraine and Dubai, where he shadowed Richard Sanders, a U.S. Army veteran and crypto specialist volunteering with Ukraine’s national police to track cryptocurrency payments to Russian operatives.  

“I ended up talking to some people who had researched these crypto-to-cash desks, doing in-person test transactions, and I got referred to Richard Sanders,” said Woodman. “He said, ‘Just come meet me in Ukraine, come meet me in Poland, wherever you can’. And so, we ended up settling on a date.” 

Crypto-to-cash desks are physical locations (or “shops”) where digital currency is exchanged for cash, often operating with little oversight. Sanders guided him through this shadowy business, visiting shops located from Kyiv’s backrooms to upscale Dubai offices, where he observed over $130,000 in transactions.  

The courier networks authorities rarely see 

As cryptocurrency moves ever deeper into the mainstream, the investigation raises a stark question: whether governments can catch up before the damage becomes irreversible. In the US, the investigation uncovered a network of courier services that convert cryptocurrency into cash.  

Operating through encrypted messaging apps like Telegram, these couriers meet customers at pre-arranged locations, hand over bundles of cash, and take cryptocurrency in return, often for a premium. “Telegram was a gateway to communicate with some of these services and ultimately write about them. Without being able to contact them on Telegram, we would have had very little,” said Woodman.  

Courier services let large sums of money move outside the banking system, largely evading anti–money laundering safeguards, and are connected to scams. Yet they happen under the radar of the authorities.  

“We found a complete collapse in law enforcement’s ability to address this, both from a technical standpoint and a resources standpoint, while victims were completely left out in the cold,” he added.  

Read all the stories of the Coin Laundry investigation here.