From Panama Papers to Coin Laundry: Latest ICIJ Probe Targets Crypto Exchanges

Hundreds of millions of dollars linked to organized crime has flowed through crypto exchanges amid governments' efforts to crack down on the abuse. In one situation, Binance was shown to have been used by North Korean hackers, ICIJ reported in a series of articles dubbed The Coin Laundry.

"Binance maintains strict compliance controls and a zero-tolerance approach to illicit activity on our platform," a spokesperson said in an e-mailed response to Sandmark's request for comment on the ICIJ coverage. "We have robust systems in place to flag and investigate suspicious transactions and take action where appropriate, including restricting accounts and freezing funds in line with our regulatory obligations," the spokesperson wrote.

The ICIJ campaign group also mentioned OKX being used to launder the proceeds of drug trafficking and fraud.

"The flows cited in the article represent a very small fraction of overall activity on our platform," a spokesman for OKX told Sandmark. "The vast majority of OKX usage is legitimate and occurs under robust AML/KYC controls that we continue to strengthen in line with evolving regulatory expectations."

While both exchange operators were quick to underscore their current commitments to conduct compliance activities – and willingness to cooperate with regulators – the ICIJ findings may nonetheless deepen concerns that enforcement actions and monitors have not meaningfully curbed illicit flows through some of the largest digital asset trading venues. 

US enforcement

Binance admitted in November 2023 that it had willfully violated the Bank Secrecy Act, operated an unlicensed money transmitting business, and breached US sanctions rules. It agreed to pay more than $4 billion and accept a five-year compliance monitoring programme overseen by the US Treasury and FinCEN.

In February this year, Aux Cayes FinTech, the Seychelles-based operator of OKX, pleaded guilty in New York to violating US anti-money laundering laws, with prosecutors highlighting more than $5bn in suspicious transactions and over $1tn in unlicensed US flows. 

The firm accepted penalties of almost $505mn and a requirement to retain an external compliance consultant until 2027.

ICIJ’s analysis suggests that, despite those settlements and oversight structures, customer accounts at Binance and OKX continued to receive large volumes of Tether's stablecoin from Huione Group, a Cambodia-based financial network FinCEN has now formally labelled a foreign financial institution of primary money laundering concern.

The study also links exchange accounts to flows associated with North Korean cyber heists, Mexican cartel-linked launderers, and Russian networks moving funds for ransomware groups. The journalistic campaign group has mentioned at least six of the top 10 crypto exchanges in the reporting on its website.

Political reversal

The political backdrop has shifted sharply. On 23 Oct, President Donald Trump issued a full and unconditional pardon to Binance founder Changpeng Zhao, who had already served a four-month sentence for failures that allowed money laundering on the platform.

His administration has dropped several civil cases against crypto firms and disbanded a Justice Department unit focused on crypto crime, reinforcing industry perceptions that platforms themselves will face less liability even as individual actors remain in the crosshairs.

Clampdown on Huione

While exchanges argue they cannot block incoming onchain deposits, US authorities have moved aggressively against Huione itself. In May, FinCEN issued a finding and notice of proposed rulemaking under section 311 of the USA Patriot Act that identified Huione Group as a primary money laundering concern and proposed cutting it off from US correspondent banking.

That process culminated last month in a final rule that severs Huione from the US financial system, with Treasury describing the group as a critical node for laundering proceeds of North Korean cyber heists and large-scale online investment scams often dubbed pig-butchering schemes.

The move raises the bar for exchanges that continue to receive flows from wallets associated with the conglomerate, even if routed through stablecoins and intermediary services.

Regulation struggles to close the gap

The ICIJ findings highlight a widening gap between formal standards and on-the-ground practice.

The Financial Action Task Force, a 40-member intergovernmental group, has long required virtual asset service providers to be licensed, supervised, and held to the same core obligations as banks, including customer due diligence, record keeping, and suspicious transaction reporting, as part of its updated standards and guidance on virtual assets. 

Yet FATF’s own reviews show uneven implementation across jurisdictions, with travel rule requirements and cross-border information sharing still patchy.

In Europe, the Markets in Crypto Assets regulation (MiCAR) is now phasing in a single rulebook for exchanges and other providers. 

Unfinished rulemaking

Stablecoin rules took effect in June 2024, and broader conduct, licensing and market abuse provisions began applying from December 2024, with EU institutions emphasizing investor protection and controls against financial crime. 

Supervisory discussions in Brussels and Paris now focus on whether ESMA should directly oversee the largest cross-border platforms, including major crypto exchanges.

In addition to the regulators, ICIJ aims to shock the public and their political representatives with such "investigations". The group has repeated a similar formula of trawling through a large volume of data over months through a network of volunteers and paid actors to produce conclusions that aren't surprising to those who already closely follow the sector that ICIJ has been examining, but that may come as a surprise to others taking an interest for the first time. 

Offshore leaks

The same was true for the 'Panama Papers', the 'Paradise Papers' and the 'Pandora Papers' initiatives of 2016-21 during which data revealing offshore corporate structures placed a spotlight on areas of the financial system that some governments, corporations and wealthy families would prefer not to discuss publicly. These offshore leaks provoked the removal of heads of government, national inquiries in dozens of countries and tax recovery procedures. 

However, much of the theatre concerned actions in the past that weren't illegal and were deliberately ignored or deemed too difficult to tackle by governments at the time. The ICIJ's work has previously thrived on information that journalists can't obtain by openly identifying themselves and asking questions.

Still, for critics of the crypto world, the ICIJ's latest work shows that compliance architectures and high-profile settlements have not changed commercial incentives fast enough.