How Dirty Crypto Passes Through Clean Wallets

The three-stage money laundering cycle in crypto

Traditional AML teaching uses three stages: placement, layering, and integration. Crypto does not change the stages. It changes how fast they happen and how hard they are to trace manually.

Placement. The criminal has cash or crypto from illegal activity. The first move is getting it into the financial system. In crypto, this might mean converting cash to Bitcoin through an unregulated exchanger, or simply using proceeds from a darknet sale directly as Bitcoin.

Layering. This is where the blockchain trace gets complex. The funds move through multiple wallets, mixers, cross-chain bridges, and DEXs. Each hop adds distance between the original dirty source and the eventual recipient. Volume is often split across dozens of addresses. Timing is randomized. Denominations are changed.

Integration. The funds emerge looking clean. They might appear as proceeds from an OTC sale, a freelance payment, a peer-to-peer trade. At this point, a simple address lookup might show nothing suspicious. The history is buried under 10 to 20 hops of transactions.

Why your clean wallet can still carry exposure

You did not participate in any of the above. You just accepted a payment. But the person who paid you received their funds from someone who was two hops removed from a Hydra marketplace wallet. That makes you three hops from the original dirty source.

Blockchain forensics does not care about intent. It traces the on-chain path. And on-chain, your wallet now shows a path that leads back to sanctioned infrastructure within three steps.

In this example, your wallet score is 23 because you are four hops from the original dirty source. The exposure is small but measurable. If your counterparty had been just one hop closer, or if the original exposure had been larger in volume, your score could be 40 or 50.

What "4-hop tracing" means in practice

AML systems commonly trace up to four hops because beyond four, exposure becomes statistically meaningless. The Bitcoin network processes hundreds of thousands of transactions daily. Every address on the network has some path to every other address within a small number of steps. Tracing infinitely far would make every wallet look contaminated.

The weight of exposure decreases sharply with distance. Here is the approximate impact on score from the same sanctioned source at different hop distances:

• Direct (0 hops): score 90 to 100
• 1 hop away: score contribution 40 to 60 points
• 2 hops away: score contribution 20 to 35 points
• 3 hops away: score contribution 10 to 20 points
• 4 hops away: score contribution 5 to 15 points

Transaction volume also matters. If only 5% of your counterparty's incoming funds came from a risky source, your exposure is proportionally smaller than if 100% did.

How exchanges detect this and why they freeze accounts

Binance, Coinbase, Kraken, OKX, and every other regulated exchange runs automated transaction monitoring. When you deposit, the system checks the incoming wallet address against AML databases. If the score is above an internal threshold (typically around 60), the deposit is held for manual review.

The review team then asks you to explain the source. You are given a form to provide: where the funds came from, proof of the relationship with the sender, and any relevant transaction receipts. If you can provide this, the freeze is usually lifted within 5 to 20 business days.

If you cannot, or if the source turns out to be genuinely problematic, the exchange may permanently close your account and confiscate the deposited funds while reporting the transaction to financial intelligence units.

The Hydra case: what exposure actually looked like

Hydra was the world's largest darknet market by revenue until German authorities seized its servers in April 2022. At the time of seizure, Hydra had processed more than $5.2 billion in transactions since 2015. Its wallet infrastructure included thousands of deposit addresses across Bitcoin and TRON.

After the seizure, all known Hydra deposit addresses were published and entered into AML databases. Exchanges then ran retroactive checks. Users who had unknowingly received funds that passed through Hydra wallets, even two or three hops removed, found their accounts flagged months after the original transaction.

This is the long-tail risk of not checking. The source may look clean at the time of payment. It may not be clean retroactively.

How to protect yourself

The only reliable method is checking before the transaction, not after. Once you accept a payment, the history is on-chain and immutable. You cannot undo it. What you can do is document that you ran an AML check before accepting, which provides evidence of due diligence if your exchange later asks.

For any incoming payment above $200 from an unknown source, run the sending wallet address through @scorechain_amlbot before confirming receipt. If the score is above 60, ask the sender to re-source from a clean address or decline the payment.