This summer, Roman Storm, co-founder of popular cryptocurrency mixer Tornado Cash, was convicted in New York federal court of conspiring to operate an unlicensed money transfer business.
Prosecutors celebrated Storm’s conviction as a major victory in the fight against crypto money laundering, but the reality is more complicated.
For years, regulators have treated mixers like Tornado Cash as the ultimate money laundering threat. Anonymous, opaque, and seemingly tailor-made for criminals, it’s easy to believe that these tools are behind the majority of crypto money laundering. But the numbers tell a different story.
The most popular crypto money laundering engines aren’t money mixers, they are centralized exchanges: large, branded trading platforms that are licensed, regulated, and openly connected to the global banking system. These exchanges appear highly regulated and well supervised, touting compliance teams and “Know Your Customer” (KYC) verification checks; however, in practice, they allow criminal activity to fester, functioning as the primary entry and exit route for dirty cryptocurrencies.
To truly combat crypto money laundering, regulators must focus their efforts on strengthening KYC requirements and controlling centralized exchanges where most money laundering takes place.
Centralized exchanges are laundering centers
Throughout 2024, according to a 2025 Chainalysis report, the majority of illicit crypto funds were funneled to centralized exchanges.
Centralized exchanges are where criminals turn to convert their dirty cryptocurrencies into usable cash. They constitute the final stage of most laundering schemes: the point where illicit funds are exchanged for dollars, euros or yen and transferred to real banks.
Criminals are attracted to these platforms for the same reasons as legitimate traders: liquidity, speed and global reach. A mixer like Tornado Cash can hide funds on-chain, but it cannot turn them into cash and transfer them to a bank account – only an exchange with significant liquidity and fiat connections can do that. Often, centralized exchanges rely on compliance programs that are under-resourced, poorly enforced, or compromised by permissive jurisdictional rules, allowing illicit transactions to slip through the cracks.
High-profile enforcement cases have revealed how systemic this problem is. The US Department of Justice’s 2023 settlement with Binance revealed that the major exchange processed transactions related to ransomware, darknet markets and sanctioned entities. The exchange has since ramped up its compliance efforts, spending $213 million on the division in 2023. BitMEX was also fined $100 million after pleading guilty to Bank Secrecy Act violations (BitMEX founders and former executives Arthur Hayes, Ben Delo and Samuel Reed pleaded guilty to related charges and were later pardoned by US President Donald Trump.).
Focusing regulatory energy on mixers while letting exchanges remain the primary fiat gateways for illicit funds is like locking the windows while leaving the front door wide open.
KYC is not the silver bullet we make it out to be
Know Your Customer (KYC) rules are the cornerstone of crypto compliance. On paper, they promise to keep bad actors away by verifying identities, monitoring transactions, and reporting suspicious activity. In reality, it is often a simple box-ticking exercise, a thin veneer of diligence that gives regulators the illusion of security while sophisticated criminals find ways to circumvent that illusion.
Weak KYC processes are a problem. Some exchanges accept low-quality identity documents or rely on automated systems that can be fooled by deepfakes or stolen data. Others outsource their compliance entirely, turning it into a contractual checkbox rather than an active guarantee. Even when the process works, it can’t stop determined money launderers from using money mules, straw accounts or shell companies to get past initial checks.
But the biggest flaw is structural. KYC is designed to monitor individual accounts, not to detect large-scale money laundering patterns. A sanctioned entity might never open an account in its own name. Instead, it will spread transactions among dozens of intermediaries, funneling funds through layers of seemingly legitimate accounts until they land on an exchange that converts them into fiat currency. By the time funds hit the compliance team’s radar, they have often passed through so many hands that the paper trail appears clean.
This is why enforcement actions against major exchanges continue to reveal the same uncomfortable truth: compliance does not fail because the rules do not exist; it fails because the systems that enforce them are reactive, under-resourced, and easy to game.
Strengthening centralized exchanges against money laundering
Centralized exchanges will always be attractive targets for launderers because they sit at the intersection of cryptocurrencies and fiat currencies. This makes enforcement not just a matter of policy, but also of design. Real progress means moving beyond token KYC checks to systems that detect money laundering patterns in real time, across accounts and across jurisdictions.
This starts with equipping compliance teams with the resources to match the scale of the platforms they monitor. This means closing legal loopholes that allow exchanges to operate from permissive jurisdictions while serving high-risk markets, and holding executives personally responsible for fraud when controls fail. Regulators must require and verify that exchanges share actionable intelligence with each other and with law enforcement, so that criminals cannot simply move from one platform to another without being detected.
This is much more difficult than targeting fraudsters.
None of this will be easy, but it is the only way to combat whitening where it actually happens. Until trade is strengthened at the structural level, coercive measures will remain reactive and billions in illicit funds will continue to flow through the doors.
