No later than October 2023, a criminal enterprise began stealing cryptocurrency through social engineering. It ran through at least May 2025 and took more than $263 million in crypto, according to IRS Criminal Investigation.
On 8 December 2025, Evan Tangeman pleaded guilty to a RICO conspiracy. Tangeman was a money launderer for the group and admitted helping to launder at least $3.5 million. A federal court in Washington, D.C. imposed 70 months in prison on 24 April 2026.
Tangeman turned the stolen crypto into fiat cash and worked with real estate agents in Los Angeles to get mansions for members. The homes rented for $40,000 to $80,000 a month. The members, often under 20, had no legitimate income.
The theft was digital from the start, and the money still ended as cash and rent. Cyber proceeds often skip placement, the stage where cash first enters the system in most money laundering methods and typologies. They arrive digital, yet they still need a way out.
What is cyber laundering?
Cyber laundering is the laundering of proceeds from cybercrime, or of any criminal money moved through online channels. It's also called cyberlaundering, cyber money laundering, or online, digital or electronic money laundering. Like any money laundering, it makes criminal property look lawful.
The term covers two shapes. In the first, the crime itself is digital: a ransom, stolen crypto, or the proceeds of cyber fraud such as a taken over bank account. In the second, the crime can be anything, and the laundering runs through payment apps, online accounts and crypto wallets.
FinCEN puts both under one term. Its 2016 cyber events advisory defines cyber enabled crime as illegal activities "carried out or facilitated by electronic systems and devices, such as networks and computers". Its examples are fraud, money laundering and identity theft, so laundering done online is itself cyber enabled crime in FinCEN's terms.
The difference sits at the start. A ransom or a stolen coin arrives already in a wallet or an account, so there's no cash to deposit. The work is moving the money and getting it out.
Crypto doesn't hide that work. FinCEN's ransomware trend analysis, released on 4 December 2025, includes findings from its own blockchain analysis. The 2016 advisory lists "seemingly anonymous virtual currency addresses" among the data that can help identify those behind a cyber event. So you can treat a wallet address as a lead.
Where does cybercrime money come from, and how is each kind laundered?
Table 1. Cybercrime proceeds and where they leave the system
| Source of proceeds | Form the money arrives in | Laundering route | Cash out point | Who sees it | Red flag |
|---|---|---|---|---|---|
| Ransomware payment | crypto: Bitcoin in 97% of reported ransomware transactions, Monero cited in 2% of reports (FinCEN, 2022 to 2024) | collected in unhosted wallets, then moved to exchanges | crypto exchange | the victim's bank or exchange when the ransom is bought, then the exchange that receives it | a customer with little crypto knowledge buying a large amount in a rush |
| Stolen crypto from a hack or social engineering | crypto taken from victims' wallets | conversion into fiat cash | cash, rent, cars | whoever converts the crypto, then agents and landlords paid with it | spending far above any legitimate income |
| Cyber enabled fraud transfer | a bank transfer from a taken over account or a bogus payment email | rapid transfers through mule accounts, often across borders | cash withdrawal or a transfer abroad | the bank that receives the transfer | a new account that takes funds from unrelated senders and moves them on fast |
| Sale of stolen data or network access | a payment from the buyer, or a share of a later ransom in crypto | the seller's own wallets or accounts | for a ransom share, the exchanges ransoms use | the exchange or the seller's bank | an address connected to ransomware activity |
All four start digital and move fast. FATF's report on illicit flows from cyber enabled fraud says the proceeds are "often rapidly transferred to different jurisdictions".
On the fraud row, the exit is often a money mule account, which receives the stolen transfer and passes it on. Card payments have a merchant version. In transaction laundering, an approved merchant puts a hidden business's card sales through its own merchant account.
Stolen data earns money of its own. FinCEN's 2016 advisory names the sale of stolen proprietary information and credit card numbers as a source of illicit proceeds.
For ransoms, the exit FinCEN describes is an exchange. Exchanges need a license or registration and carry due diligence and reporting duties as crypto firms, so this is where a ransom meets an AML program.
If you run monitoring, the exit is where you look. Transaction monitoring software reads the flows around it: crypto bought in a rush, a new account that pays straight out, cash taken out soon after a crypto sale.
How are ransomware payments laundered?
On 23 March 2026, a federal court in the Southern District of Indiana sentenced Aleksei Volkov, a Russian citizen, to 81 months in prison, the Justice Department reported. Volkov had helped cybercrime groups, including the Yanluowang ransomware group, attack US companies and other organizations. Volkov was an initial access broker: someone who breaks into company networks and sells that access to ransomware groups.
The laundering sat inside the plea. On 25 November 2025, Volkov pleaded guilty to six counts, among them conspiracy to commit computer fraud and conspiracy to commit money laundering. Volkov and the others in the scheme demanded ransoms in cryptocurrency and divided the payments among themselves. When a victim paid, Volkov got a share. Actual losses passed $9 million.
FinCEN's December 2025 analysis of Bank Secrecy Act reports shows where ransom money goes next. Threat actors "overwhelmingly collected payments in unhosted" crypto wallets, then used exchanges to launder the money. Several groups shared the same initial access vendors. Bitcoin accounted for 97 percent of reported ransomware transactions, while Monero was cited in 2 percent of reports.
Over 2022 to 2024, FinCEN counted 7,395 such reports on 4,194 incidents, with more than $2.1 billion in payments. Among the fraud trends of 2026, ransomware is the one where payments fell. Chainalysis, a blockchain analytics firm, estimates that ransomware actors received more than $820 million on chain in 2025. That is 8 percent below its updated $892 million for 2024. It's a vendor estimate.
FATF's March 2023 report on countering ransomware financing found that criminals are "almost exclusively using crypto, or virtual assets". They have easy access to virtual asset service providers worldwide.
Between the first wallet and the exchange sit the layering steps, such as swaps between coins and mixing services. At an exchange, you look for those steps with AML checks built for crypto, from wallet screening to monitoring rules.
If your firm processes a ransom for a client, it carries its own risk. OFAC's advisory of 21 September 2021 says the US government "strongly discourages" paying ransom or extortion demands. The risk is sanctions. Under OFAC rules, US persons generally may not transact with people or entities on the SDN List, and OFAC has designated ransomware actors. Firms that facilitate payments for victims, financial institutions included, may risk violating OFAC regulations. Liability is strict. A person subject to US jurisdiction can be held civilly liable without knowing the transaction was prohibited. Where a payment may have a sanctions nexus, OFAC counts a complete report to law enforcement as a significant mitigating factor. The report has to come on the firm's own initiative, as soon as possible after it discovers the attack.
Which laws make cyber laundering a crime?
Table 2. Is cyber laundering a crime? Four rulebooks (as of 11 November 2026)
| Rulebook | Where cybercrime enters | The words | Status |
|---|---|---|---|
| US, 18 U.S.C. 1956 | (c)(7)(D) names computer fraud and abuse, and (c)(7)(A) adds wire fraud through section 1961(1) | "section 1030 (relating to computer fraud and abuse)" | in force. Penalty under (a)(1): up to 20 years in prison, a $500,000 fine or twice the property's value if higher, or both |
| EU, Directive (EU) 2018/1673, Art. 2(1)(v) | cybercrime is a listed category of criminal activity | "cybercrime, including any offence set out in Directive 2013/40/EU" | transposition deadline for member states: 3 December 2020 |
| UK, Proceeds of Crime Act 2002, s.340 | POCA counts any UK offense as criminal conduct, and conduct abroad that would be one in the UK, so computer misuse offenses qualify | "constitutes an offence in any part of the United Kingdom" | in force |
| UN, Convention against Cybercrime, Art. 17(2)(a) | the convention's own offenses, from illegal access to theft or fraud, become predicates | "relevant offences established in accordance with articles 7 to 16" | adopted 24 December 2024, not in force, 96 signatories, 3 parties on the UN treaty status page |
In these rulebooks, money laundering is a separate offense, and cybercrime is one of the crimes whose proceeds it launders. Each one also asks what the launderer knew.
The US bar has three parts. Under section 1956(a)(1), the launderer must know the property comes from some form of unlawful activity, and it must in fact come from a specified unlawful activity. The launderer must also intend to promote that activity or know the transaction is designed to conceal the proceeds, among other routes. UK law asks whether the person knows or suspects the property is a benefit from crime. The EU directive requires intent and knowledge that the property derives from criminal activity, the same pair the UN text asks for. Member states may go further. They can also punish an offender who only suspected, or ought to have known, where the property came from.
In the EU, the 6AMLD names cybercrime as predicate category (v) . Fraud and extortion count too. They are categories (i) and (r), so one ransom can fall under more than one.
The Council of Europe calls its 2001 Budapest Convention "the first international treaty on crimes committed via the Internet and other computer networks". It deals with computer fraud and network security offenses, among others. The 2024 UN convention makes laundering an offense in its own Article 17. It enters into force on the 90th day after the 40th instrument of ratification, acceptance, approval or accession is deposited.
Where do cybersecurity and AML meet?
They meet in the suspicious activity report. FinCEN's advisory FIN-2016-A005 of 25 October 2016 gives the test. A cyber event should be treated as part of an attempted suspicious transaction if it was intended, in whole or in part, to conduct, facilitate or affect a transaction. What counts is whether the institution knows or suspects that intent, or has reason to suspect it. The advisory cites the $5,000 SAR threshold. To reach it, you count the funds and assets involved in or put at risk by the event.
In FinCEN's Example 1, malware gives criminals access to a bank's systems and puts $500,000 of customer funds at risk. The bank must file a SAR. It has reason to suspect the intruders meant to conduct, or could have conducted, unauthorized transactions of at least $5,000.
In Example 3, a DDoS attack distracts staff at a money services business from stopping an unauthorized $2,000 wire. FinCEN says that wire meets the filing threshold for the business. It files one SAR on both. FinCEN's reason is that the attack was carried out to conceal the transfer.
FinCEN's 2016 FAQ on cyber event reporting adds that an otherwise reportable cyber event is reported even when it fails. An attack that needs no SAR on its own may still be worth one: FinCEN encourages, but does not require, reports on significant or damaging cyber events.
The SAR then carries the cyber data FinCEN asks for: IP addresses with timestamps, virtual wallet information, device identifiers and cyber event information. The April 2026 SAR filing instructions give it fields of its own. Item 42 says whether the event hit the institution or its customer, and item 43 holds the IP address with date and UTC time. Item 44 holds indicators such as command and control addresses and malware hashes. Fields 42 to 44 are optional, and FinCEN encourages filers with the capacity to complete them. The filing itself may still be required. IP address and indicator data must also be explained in the narrative.
Your fraud team often sees the event first, as a taken over account or a payment the customer never made. The account that received the money is the lead fraud should pass to AML the same day.
How do banks get cyber data into the AML file?
Through internal sharing first. FinCEN encourages institutions to share relevant information across BSA/AML staff, cybersecurity personnel and fraud prevention teams. Between institutions, the safe harbor in Section 314(b) of the USA PATRIOT Act covers those that share after notifying FinCEN.
For the cyber fields, the April 2026 instructions name "a principal source of cyber related information": the institution's internal technology department or external technology contractor. FinCEN's 2016 FAQ says AML staff face no new requirement to know cybersecurity. The institution's obligations stay as they were. Cyber events too numerous to report one by one can go in a single cumulative SAR, when they're similar or related.
What red flags point to cyber laundering?
Eight flags follow. The first four are FinCEN's, shortened from its 2021 ransomware advisory, FIN-2021-A004. The other four come from the cases, the 2016 advisory and Table 1 above. FinCEN adds that no single flag is indicative of illicit activity on its own, so each one is weighed against the facts of the transaction.
- A wallet tied to ransomware. The customer's address, or one it deals with, is connected to ransomware variants, payments or related activity. Why: the address alone can tie your customer's funds to a ransom.
- Little crypto knowledge, a large or rushed purchase. FinCEN says this may mean the customer is a ransomware victim. Why: onboarding questions on how the customer acquired their crypto, as in a crypto exchange KYC form, give you the baseline.
- External wallet, rapid swaps between coins, then off the platform. Why: FinCEN reads this as a possible attempt to break the chain of custody on the blockchain.
- A mixing service in the transfer. Why: a mixer is built to break the connection between the sending and the receiving address.
- Crypto turned into cash with no income behind it. Why: this is where the Tangeman money entered the real economy.
- An attack just before a transfer. A DDoS or an account takeover shortly before a large wire. Why: in FinCEN's Example 3, the DDoS was carried out to conceal an unauthorized $2,000 wire from the staff who could have stopped it.
- IP addresses and devices that don't fit the customer's history. Why: FinCEN asks for this data in the SAR, so the flag is also your evidence.
- Fast in, fast out from unrelated senders. A new account takes money from several unrelated senders and moves it on quickly. Why: this is how the mule exit on the fraud row of Table 1 looks from the receiving bank. In complead, formerly Sanction Scanner, incoming transfers are scored as they arrive. An account that collects from unrelated senders and pays straight out is flagged before the money moves on.
How is terrorist financing done online?
Terrorist financing can use the same online channels: payment apps, online accounts and crypto wallets. The direction differs. Laundering conceals the origin of money. Terrorist financing conceals its destination, and the money may be clean when it starts.
So the weight of your check moves from the source of funds to the recipient and the purpose. FinCEN's 2016 advisory treats terrorism financing beside money laundering in the same cyber guidance, and Section 314(b) sharing covers terrorist activities as well.
Which cyber laundering dates mattered in 2026?
- 4 February: Qatar became the first party to the UN Convention against Cybercrime.
- 26 February: Chainalysis put 2025 ransomware receipts at more than $820 million, 8 percent down on 2024 (vendor estimate).
- 23 March: Volkov was sentenced to 81 months. The plea included conspiracy to commit money laundering.
- 15 and 17 April: Azerbaijan and Viet Nam became parties, bringing the count to three.
- April: The SAR filing instructions FinCEN released that month, version 1.0, mark cyber fields 42 to 44 as optional and encouraged.
- 24 April: Tangeman was sentenced to 70 months for laundering money from a crypto theft scheme that took more than $263 million.
- 11 November: The convention has 96 signatories and 3 parties. Signature stays open until 31 December 2026.
Before the year began, FinCEN published its ransomware analysis of 4 December 2025, the source of the 2022 to 2024 counts above. Next to watch: the convention enters into force 90 days after the 40th ratification or accession.
Three things to do this week:
- Ask the security team for last quarter's cyber events and check which ones reached a SAR, with fields 42 to 44 filled.
- Screen wallet addresses at the fiat off ramp, before funds leave for a bank account.
- Send new accounts with fast in and out flows from unrelated senders to the mule review queue.
