Money Laundering Investigation

The Coin Laundry: How Binance and OKX Moved $634 Million in Dirty Money After Guilty Pleas

A 37-country ICIJ investigation tracked hundreds of millions in criminal cryptocurrency flowing through the world's largest exchanges - from scam compounds forcing 300,000 people into slavery, to North Korean weapons programs, to a Mexican drug cartel. The exchanges were supposedly under court-ordered cleanup. Then Trump fired the regulators and pardoned the CEO.

Major crypto exchanges processed hundreds of millions in dirty money even after pleading guilty to money laundering violations. Photo: Unsplash

The world's two largest cryptocurrency exchanges sat under court-appointed compliance monitors, mandated to clean up their acts after pleading guilty to federal money laundering violations. The monitors were paid to watch. Regulators were supposed to check in. And yet the dirty money kept flowing - $1 million a day, every day, for more than a year.

That is the core finding of The Coin Laundry, the most extensive investigation into criminal cryptocurrency flows ever conducted. Led by the International Consortium of Investigative Journalists with 37 media partners across 35 countries, the investigation analyzed tens of thousands of cryptocurrency transactions across public blockchains - and found that the compliance pledges made by Binance and OKX were, in practice, meaningless.

At least $408 million in tether - a dollar-pegged stablecoin favored by criminal networks for its stability and traceability evasion tools - flowed from Huione Group, a Cambodian financial conglomerate flagged by U.S. authorities as a hub for human trafficking proceeds, into customer accounts at Binance between July 2024 and July 2025. That period covers nearly the entire span of Binance's court-ordered compliance oversight, following its $4.3 billion guilty plea in November 2023.

At OKX, another $226 million arrived from Huione during the five months immediately following OKX's own guilty plea in February 2025. And even after the U.S. Treasury Department formally designated Huione a "primary money laundering concern" in May 2025 - a designation that in theory should halt any sane financial institution from dealing with them - at least $161 million more continued flowing into OKX accounts.

The math is simple, and damning: $634 million in funds from a known criminal enterprise flowed into two exchanges that had already confessed to enabling money laundering, while court-appointed monitors watched, and regulators - until recently - were supposed to be paying attention.

The Machine Behind the Money: Huione Group

Scam compound operations across Southeast Asia have enslaved an estimated 300,000 people, forcing them to defraud victims worldwide. Photo: Unsplash

To understand where the money comes from, you have to understand Huione Group - and to understand Huione, you have to understand what human beings are being forced to do in the jungles of Myanmar, Cambodia, and Laos.

Across the Greater Mekong region, industrial-scale fraud operations have constructed what amount to modern-day forced labor camps. People are lured by fake job advertisements - promises of tech work or customer service jobs in Thailand or Singapore - then trafficked across borders and imprisoned behind barbed wire in fortified compounds. An estimated 300,000 people are currently working inside these facilities, according to the Global Initiative Against Transnational Organized Crime. They are required to run romance scams, cryptocurrency investment fraud, and wire transfer schemes targeting victims in the United States, Europe, and East Asia.

The money these operations generate is enormous. And it needs to be laundered.

That is where Huione Group enters the picture. The Cambodian financial services conglomerate - which operated a payment processing arm called Huione Pay and ran what amounted to a shadow cryptocurrency exchange - sat at the nexus of this criminal ecosystem. The U.S. Treasury Department's Financial Crimes Enforcement Network, known as FinCEN, singled out Huione Group in May 2025 as a money laundering operation of top concern, describing it as a key financial facilitator for Chinese criminal gangs running scam compounds across Southeast Asia. FinCEN noted that Huione handled proceeds not only from pig butchering and romance fraud operations, but also from North Korean state-sponsored hackers - the Lazarus Group and affiliated actors who steal cryptocurrency to fund Pyongyang's weapons programs.

A March 2025 New York Times investigation traced Huione Group's operations through the notorious Golden Triangle region - the border zone between Thailand, Laos, and Myanmar that has been a narcotics and organized crime hub for decades. The Times found that Huione facilitated money laundering at scale, helping criminal proceeds disappear into the digital financial system.

"Normally that halts everything. If the federal government just told you that this entity is a high risk for money laundering or terrorist financing, you'd be crazy to continue any financial dealings with them." - Ross Delston, lawyer and anti-money laundering specialist, to ICIJ

Yet the tether kept moving. The ICIJ data team used blockchain analytics platforms Arkham Intelligence and Tronscan to trace specific wallet addresses published by Huione Group in its own Chinese-language quarterly financial reports. Those addresses transacted on the TRON blockchain in tether. The flows were unambiguous: Huione funds entered customer deposit accounts at Binance and OKX at a rate of approximately $1 million per day throughout the period under review.

Huione Group's payment services arm, Huione Pay, was eventually shut down by Cambodia's National Bank in December 2025, following a bank run that forced the company to freeze customer withdrawals. By then, the damage had been done - and the money had already moved.

Binance's Broken Pledge

Binance's road to this moment began with what prosecutors described as a deliberate strategy to capture criminal business. Internal communications cited in the November 2023 federal indictment showed Binance executives discussing how to attract customers from sanctioned jurisdictions and how to avoid regulatory scrutiny. A compliance officer wrote, in a message cited by prosecutors, that Binance needed to "let the money go through" and let criminal actors "come from behind" before being removed.

The company eventually agreed to pay $4.3 billion - one of the largest corporate penalties in United States history. Changpeng "CZ" Zhao, Binance's founder and CEO, pleaded guilty personally to failing to maintain an effective anti-money laundering program. He was sentenced to four months in federal prison. As part of the settlement, Binance agreed to operate under two court-appointed compliance monitors who would have access to internal systems and were mandated to verify that the company cleaned up its act.

The monitors were watching. The money kept flowing.

ICIJ's analysis found that customer accounts at Binance received at least $408 million in tether from Huione Group wallet addresses between July 2024 and July 2025 - averaging $1.1 million per day. Every dollar of that flowed during the period of court-ordered compliance oversight. Binance was not just aware of the obligations; it was operating under them in real time as the money arrived.

When ICIJ asked Binance to explain, the exchange said it "works closely with global law enforcement and is an industry leader in identifying and reacting to suspicious deposits." It added that "users who transact with this service are subject to investigation by our compliance department, and appropriate action will be taken if any potential illicit activities are identified." The company also noted that cryptocurrency technology does not allow it to block deposits from entering its system.

Source: Binance statement to ICIJ, published November 2025.

That last point is technically accurate - but it does not explain why Binance did not freeze funds upon receipt, close the implicated accounts, or report the pattern. A bank that receives deposits from a sanctioned entity and takes no action faces severe consequences. The cryptocurrency industry has successfully argued, with regulators' quiet acquiescence, that different rules should apply to them.

Then, in October 2025, Donald Trump pardoned CZ Zhao. The White House press secretary declared that "the Biden administration's war on crypto is over." The compliance monitors' mandate continued - but their political backing had just been dramatically undercut.

OKX and the Pattern That Wouldn't Stop

OKX's story is in some ways more striking than Binance's, because the timeline is compressed. The exchange pleaded guilty in February 2025 to operating an unlicensed money transmitter in the United States, agreeing to pay more than $504 million in penalties. Like Binance, it pledged to retain a court-mandated compliance consultant.

By FinCEN's May 2025 designation of Huione as a primary money laundering concern, customer accounts at OKX had already received at least $65 million from Huione since the February guilty plea. But even after the Treasury Department took the extraordinary step of formally labeling Huione a threat to the financial system - a move that puts every regulated financial institution on notice worldwide - at least $161 million more in tether moved from Huione to OKX customer accounts.

Between February and July 2025 - five months - the total reached at least $226 million. That averages to roughly $1.5 million per day. After the FinCEN designation: $1 million per day.

OKX told ICIJ it "invests heavily in compliance" and that it "took proactive steps to restrict relevant accounts" even before the May designation. The company said it has been working with the U.S. government on the matter, "sometimes initiating engagement." It did not address the specific scale of inflows identified in ICIJ's analysis.

Blockchain analyst Alessio Della Santa, a former employee at two of the largest exchanges, told ICIJ: "The main way to catch criminals would be waiting for them to mess up something." That assessment - from someone who worked inside these systems - suggests the exchanges' compliance infrastructure is reactive at best, and structurally incapable of blocking sophisticated criminal networks at worst.

A Broader Criminal Ecosystem: Cartels, North Korea, and Fentanyl

ICIJ analyzed tens of thousands of cryptocurrency transactions to trace illicit funds across global criminal networks. Photo: Unsplash

The Huione-Binance-OKX nexus is the largest single finding in The Coin Laundry investigation, but it is not the only one. ICIJ traced criminal funds from an array of violent actors moving through brand-name exchanges.

A Binance-hosted wallet address that the U.S. Treasury Department has specifically attributed to a money launderer working for Mexico's Sinaloa drug cartel - one of the world's most violent organized crime groups, responsible for the majority of fentanyl shipments entering the United States - received nearly all its funding from accounts at Coinbase, a U.S.-based exchange that is publicly traded on the Nasdaq. More than $700,000 moved through that pathway. Binance did not respond to specific questions about that account. Coinbase told ICIJ it was aware of the transactions and that "through communications with the U.S. government, it resulted in the wallet address being sanctioned."

Funds from a ring of Chinese traffickers of fentanyl and other synthetic drugs - part of a network that has contributed to more than 100,000 overdose deaths in the United States annually - flowed to various accounts at OKX. OKX said it "proactively worked with law enforcement on this matter, and was privately thanked for our efforts."

A Russian money launderer who specializes in moving cryptocurrency on behalf of North Korea's weapons development program - reportedly maintaining an account at HTX, an exchange affiliated with Justin Sun - was identified. HTX did not respond to ICIJ's questions. Justin Sun, at the time of ICIJ's investigation, owned $75 million worth of equity in World Liberty Financial, the Trump family's own cryptocurrency venture - making him one of its largest investors.

That last data point is not incidental. It illustrates the overlapping layers of financial interest that complicate any serious regulatory crackdown on cryptocurrency exchanges. The largest crypto exchange in the world's founder has been pardoned by the president. The second-largest exchange has financial ties to the president's family. And the regulators who are supposed to oversee all of this have just been cut.

"Crypto offers criminals a financial system that's very efficient compared to the old days when a cartel would have to stuff cash into the back of a Cadillac." - John Griffin, blockchain data expert, University of Texas at Austin, to ICIJ

Trump, DOGE, and the Gutting of Crypto Oversight

The regulatory collapse happened in stages, and each stage made the next one easier.

The critical enforcement architecture depended on three pillars: IRS examiners overseeing anti-money laundering compliance at money service businesses (the category that includes cryptocurrency exchanges), a Justice Department unit dedicated to investigating crypto crimes, and an SEC enforcement posture that treated digital tokens as securities subject to investor protection rules.

All three have been systematically dismantled since January 2025.

In April 2025, the Trump administration disbanded the Justice Department unit that had been dedicated to cryptocurrency-related crime investigations. In the order dissolving the unit, the department specified that it would still pursue crimes committed by individuals using digital assets - but explicitly stated it "will not pursue actions against the platforms that these enterprises utilize to conduct their illegal activities." That is a remarkable statement. It effectively announced that the exchanges themselves are immune from federal criminal prosecution going forward.

The IRS numbers are equally stark. In 2025, the number of federal examiners assigned to review anti-money laundering safeguards at crypto exchanges and other money service businesses fell 33 percent to 139 agents - down from 208 in 2024, and down from 193 in 2021 when the agency was trying to expand oversight. The 2025 figure is the lowest in any year since ICIJ obtained data going back to 2017, through a public records request.

To put that number in context: there are approximately 600 licensed cryptocurrency exchanges operating in the United States. Those 139 agents are also responsible for overseeing thousands of other money service businesses - money transmitters, currency dealers, and check cashers. The math simply does not work. The oversight is a fiction.

"The reduction in supervisory staff at the IRS matches a trend we've seen across anti-money laundering enforcement agencies. This sends the signal that the U.S. is open to dirty money. It undermines our national security and market integrity." - Erica Hanichak, deputy director, FACT Coalition, to ICIJ

The Trump administration also dropped civil enforcement actions against more than a dozen cryptocurrency firms that had been initiated by the Biden administration. The SEC withdrew its lawsuits against Coinbase and Kraken. The Binance civil case was effectively mooted by the pardon of its founder.

And then came the pardon itself - perhaps the clearest signal of where the administration stands. When Trump pardoned CZ Zhao in October 2025, clearing a man who had pleaded guilty to federal money laundering facilitation charges, it sent a message to the entire industry: the rules have changed.

John Griffin, the blockchain expert at the University of Texas, identified the financial logic bluntly: "If they kick criminal actors off the platform, then that's a big revenue source that they lose, so they have an incentive to allow this activity to continue."

Timeline: How the System Failed

The Victims Left Behind

Behind these numbers are real people.

Alona Katz is chief of the Brooklyn District Attorney's Office's Virtual Currency Unit. Her office investigates crypto crime, traces stolen funds, and tries to return money to victims. It is an almost impossible job - not because the criminals are untraceable, but because they are almost always operating from jurisdictions beyond U.S. legal reach, and because the exchanges that hold their funds resist or delay cooperation.

Katz described what it is like to tell a victim that their money is gone.

"It's more devastating than I can even put a word on. I have spoken to people in their 80s who are preparing to file bankruptcy for the first time... young adults who thought they were helping their family and emptied out the family's common bank account. When you are the bearer of the bad news, that everything they have worked for their entire lives - their entire life was gone in the blink of an eye - I mean, there are no good words." - Alona Katz, Brooklyn DA's Virtual Currency Unit, to ICIJ

The FBI estimates Americans alone lost $9.3 billion to crypto-related crimes in 2024 - a 67 percent increase from 2023. That figure, staggering as it is, almost certainly undercounts the true toll. Many victims are too embarrassed to report, or believe reports will lead nowhere. The FBI's own data shows recovery rates for crypto fraud victims are low; once funds have passed through mixers, chain-hoppers, and multiple exchange wallets, the trail cools.

Julia Hardy, co-founder of blockchain investigations firm zeroShadow, who works closely with scam victims and law enforcement globally, told ICIJ: "Law enforcement can't cope with the overwhelming amount of illicit activity in the space. It can't go on like this."

Her warning takes on new weight given the regulatory dismantling underway. The few investigators who developed genuine expertise in tracing cryptocurrency flows are being fired or reassigned. The specialized DOJ unit is gone. The IRS examiners are down by a third. The SEC is walking away from enforcement cases. And the president just pardoned the man who presided over the world's largest compliant-crime-enablement engine in financial history.

The Structural Problem: Who Watches the Watchmen?

As crypto exchanges process trillions in trades, the oversight apparatus that is supposed to catch dirty money has been systematically reduced. Photo: Unsplash

The deeper problem that The Coin Laundry exposes is structural, not merely regulatory. It is about how the architecture of cryptocurrency oversight was designed, who benefits from its weaknesses, and why reform remains so difficult.

U.S. regulators classify cryptocurrency exchanges in the same category as money transmitters like Western Union. That classification means they are overseen by the IRS's Small Business and Self-Employed Division - not by the Office of the Comptroller of the Currency, which oversees major banks, not by the Federal Reserve, and not by the FDIC. Banks receive rigorous, frequent, multi-agency examinations. Crypto exchanges receive occasional IRS check-ins from a shrinking pool of examiners with limited resources and no financial data subpoena power equivalent to what bank regulators possess.

Alison Jimenez, an anti-money laundering expert who advises financial institutions, put it plainly to ICIJ: "These are juggernaut financial institutions. They are larger than a lot of banks but they are not getting the frequency of examinations or the in-depth examinations that banks get. If there are violations found, there is often no formal action taken."

Christina Rea, a compliance specialist who advises crypto firms on IRS examinations, noted that the regulatory contraction is happening precisely as the industry has grown most complex: "Compared to 2017 and 2018, today's firms are larger, more interconnected with traditional financial institutions, and operating far more sophisticated platforms, and yet examiner resources appear to have decreased rather than expanded."

The exchanges themselves have an incentive structure that does not favor compliance. Transaction fees are the primary revenue model. More transactions mean more revenue. Criminal users often trade in volume and at speed. Blocking them costs money in foregone fees. Reporting them costs money in legal resources. The court-appointed compliance monitors at Binance and OKX can flag problems and recommend action - but they cannot compel the exchanges to refuse deposits at the blockchain level, because that is, genuinely, a technical limitation.

What the exchanges can do - and what the monitors can compel - is freeze funds internally once they arrive, close implicated accounts, and file suspicious activity reports with FinCEN. The ICIJ analysis found no evidence that this happened at a scale that would have materially reduced the $634 million in Huione inflows. The pattern of approximately $1 million per day continued without significant interruption.

The ICIJ investigation also identified a troubling pattern in the blockchain analytics industry. Several of the largest analytics firms - companies that position themselves as watchdogs and sell services to exchanges, law enforcement, and governments to identify illicit crypto flows - appeared reluctant to publicly name mainstream exchanges in connection with dirty money. These firms derive revenue from exchange contracts. Naming clients as conduits for criminal proceeds is, at minimum, commercially awkward.

The result is a system in which everyone is technically doing their job - the monitors are monitoring, the analytics firms are analyzing, the examiners are examining - but the money keeps moving, the criminal networks keep operating, and the victims keep losing everything they have.

Jimenez's summary captures the whole: "Cryptocurrency oversight is a very loosely knitted-together safety net. Now it's just getting pulled farther apart."