Chinese hackers laundered more than $ 16 billion in cryptocurrency in a year

China’s money laundering networks (CLMNs) have become a key infrastructure for global cryptocurrency laundering, processing about $ 16.1 billion in 2025 through more than 1,799 active wallets. This is stated in the annual Chainalysis Crypto Crime Report 2026. They account for about 20% of all known illegal cryptocurrency laundering activities, which indicates that criminals are moving away from centralized exchanges in favor of decentralized services on Telegram that are resistant to law enforcement intervention.

The growth of these networks has been rapid: since 2020, crypto asset flows to CLMNs have grown thousands of times faster than to centralized exchanges or decentralized finance. Chainalysis has identified six main types of services within such networks: brokers, mullahs, OTC platforms, Black U-services, gambling platforms, and money transfer services.

Black U-services, which specialize in laundering funds from hacker attacks and fraud, stand out. They reached $ 1 billion in volume in just 236 days, processing large transactions in an average of 1.6 minutes — faster than many legal payment systems.

Analysts attribute the development of these networks to currency controls in China. Attempts by wealthy individuals to move funds out of the country have created liquidity that has become the basis for servicing transnational criminal groups in Europe and North America. Despite the efforts of law enforcement, including the removal of Huione’s Telegram accounts, the networks' activity has not stopped. Chainalysis emphasizes that guarantee platforms are only a marketing channel, and real termination of activities requires influence on operators and service providers.

The activities of CLMNs extend far beyond Asia: Telegram mentions operators in Africa, which indicates the globalization of the process. In general, the illegal turnover of crypto assets increased from $ 10 billion in 2020 to more than $ 82 billion in 2025. The latest US measures include the recognition of Huione Group as a major threat under FinCEN legislation and sanctions against the Prince Group. This underscores the growing danger to national security, as such networks are used to launder funds from fraudulent schemes and even cyber operations sponsored by North Korea.