According to Chainalysis' Crypto Crime Report 2026, released on 27 January, Chinese-language money laundering networks (CMLNs) have become the dominant infrastructure for the movement of illicit cryptocurrency-based funds.
These systems, operating primarily through the messaging platform Telegram, have marked a sea change in transnational crime, processing an incredible $16.1 billion in 2025 alone.
A $44 million a day ecosystem
The data reveals an unprecedented operation: CMLNs handle around 20% of all known cryptocurrency laundering activity globally. With an average of $44 million per day distributed across more than 1,799 active wallets, the growth of these networks has outpaced every other industry metric.
Since 2020, flows to CMLNs have grown 7.325 times faster than to centralised exchanges and 1,810 times faster than to decentralised finance (DeFi).
The six specialisations of crime
The on-chain analysis identified six distinct types of services that make up this criminal ecosystem:
- Running point brokers: They recruit individuals to 'rent' their bank accounts or deposit addresses to receive fraudulent funds.
- Money mule motorcades: They manage the layering phase (layering), obscuring the origin of funds. Some operators have expanded as far as Africa.
- Informal OTC services: They advertise "clean funds" without KYC (Know Your Customer) procedures, but maintain strong links to illicit platforms.
- "Black U" services: Specialise in stablecoins "tainted" by hacking and scams, sold at 10-20% discounts. In just 236 days, they reached $1 billion in inflows.
- Gambling Services: Used to launder large volumes of cash through frequent transactions, often with rigged results.
- Fund Movement Services: Offer mixing and swapping capabilities, actively used by actors in Southeast Asia and North Korea.
Smurfing techniques and speed of execution
The behaviour of CMLNs traces the classic steps of traditional money laundering (placement, layering and integration), but with a digital speed. Black U services, for instance, use an aggressive structuring: transactions under USD 100 have increased by 467% in the transition between entry and exit. The speed is impressive: in the last quarter of 2025, the average clearing time for very large transactions was only 1.6 minutes.
The role of guarantee platforms
At the centre of this universe are guarantee platforms such as Huione and Xinbi, which act as marketplace and escrow infrastructure. Although Telegram has removed some accounts linked to Huione, sellers have shown extreme resilience, quickly migrating to alternative channels.
The challenge for national security
Experts point out that this rise is fuelled by the need to circumvent Chinese capital controls. Tom Keatinge (RUSI) explained that wealthy citizens seeking to move capital out of China unwittingly provide much-needed liquidity to organised crime groups in Europe and North America.
International authorities have begun to react: the US OFAC and UK OFSI have designated groups such as the Prince Group, while FinCEN has identified Huione Group as a 'primary money laundering concern'.
However, as noted by Chris Urben (Nardello & Co), the shift from informal transfer systems to cryptocurrencies makes surveillance extremely complex without proactive public-private collaboration and the use of advanced blockchain analytics.
