Crypto Money Laundering Red Flags: Mixers, Bridges, Hops
The main crypto money laundering red flags are exposure to mixers and CoinJoin, fast movement across chains through bridges (chain hopping), peel chains, deposits structured just under reporting thresholds, transfers at suspiciously regular intervals, and funds that pass through fresh wallets in minutes. None of these proves laundering on its own. Together, and backed by on-chain evidence, they are what turns a routine deposit into a case.
This guide is for compliance officers, MLROs and founders of exchanges, OTC desks and payment companies. It explains each pattern, why it matters, how investigators follow funds across hops, and what you should keep in the file when you decide to hold, reject or report.
Why red flags work better as combinations
FATF published a report on red flag indicators for virtual assets in 2020. Its general message holds up: single indicators are weak, and context matters. A privacy-minded user may use a CoinJoin wallet. A trader may bridge to another chain for cheaper fees. A business may send round amounts because invoices are round.
Risk rises when indicators stack. A fresh wallet that receives mixer output, bridges it to another chain within ten minutes and then deposits $9,800 at your exchange is a different story from any one of those steps alone. Your monitoring rules and your analysts should both think in combinations.
Mixers and CoinJoin
A custodial mixer takes coins in from many users and pays out different coins later, often with random delays and amounts. The on-chain link between deposit and withdrawal is cut by design. Direct or one-hop exposure to a known mixer is a standard crypto mixer AML trigger, and some mixers are on sanctions lists, which turns a risk signal into a legal prohibition.
CoinJoin is different. Several users sign one Bitcoin transaction together, each contributing inputs and receiving equal-sized outputs. Nobody holds anyone else's coins, but the result looks similar from outside: many inputs, many identical outputs, no clear mapping between them.
Why CoinJoin breaks naive clustering
Most Bitcoin attribution relies on the common-input-ownership heuristic: if several addresses sign inputs in the same transaction, one entity probably controls them all. CoinJoin breaks that assumption on purpose. A tool that applies the heuristic blindly will merge dozens of unrelated users into one cluster. One bad CoinJoin can link a retail customer to a ransomware wallet that happened to join the same round.
Exchange batch payouts cause a similar problem in reverse. Good clustering detects CoinJoin structure (many equal outputs, many inputs from distinct histories) and batch payouts, and stops merging at those points. When you review a vendor's cluster, ask how it handles both.
Bridges and chain hopping
Chain hopping means moving value across blockchains, usually through bridges or swap services, to break the trail. Funds leave Ethereum as USDT, arrive on Tron, swap to another token, bridge again and land at an exchange. Each hop sits on a different ledger, and a tool that only reads one chain sees the trail end at the bridge contract.
Red flags around bridges include:
- Several hops within minutes with no trading purpose, especially through assets the customer never holds for long.
- Bridging into chains or tokens that have no link to the customer's stated business.
- Hops that begin shortly after a hack, scam or sanctioned address appears upstream.
- Round trips: funds leave a chain and come back to it through a different route.
Following a bridge means matching the lock or burn event on the source chain with the mint or release on the destination: same amount minus fees, matching timestamps, and where possible the bridge's own message or transfer ID. That match is evidence. Write it down with both transaction hashes.
Peel chains
A peel chain starts with a large balance in one address. Each transaction sends a small amount to a destination (often an exchange deposit address) and the rest to a new change address, which repeats the process. Over dozens of steps the original sum is peeled off into many small deposits across several services.
Peel chains are easy to spot once you look for them: long sequences of one-input, two-output transactions where one output is much smaller and the larger one keeps moving. If your customer's deposit is one peel from a chain that started at a hack or darknet wallet, that link should appear in your review, even when it is five or ten hops upstream.
Structuring, timing and amounts
Structuring crypto deposits looks the same as structuring cash: splitting a sum to stay under thresholds that trigger reporting, enhanced checks or Travel Rule data collection. In crypto, common reference points are $10,000, $3,000 and $1,000, depending on jurisdiction and the firm's own rules.
| Pattern | What it looks like | Why it matters |
|---|---|---|
| Just under thresholds | Repeated deposits of $9,700 to $9,950, or $2,900 to $2,990 | Suggests the sender knows where your controls start |
| Evenly spaced transfers | Transfers every 15 minutes, or at the same hour every day | Points to scripts or a coordinated operation, not personal use |
| High share of round amounts | Most transfers are exactly 1,000 or 5,000 USDT | Common in OTC settlement and cash-out operations |
| Rapid in-and-out | Funds arrive and leave a fresh wallet within minutes | Typical of pass-through and money mule wallets |
| Odd activity hours | Activity clustered at hours unusual for the customer's stated location | May indicate the account is operated by someone else |
Each one is a soft signal. A wallet that shows three or four of them at once deserves a closer look.
Fresh wallets and nested services
Fresh wallets with no history, funded once and emptied quickly, act as buffers between a source and your platform. They add a hop and remove context. Watch for deposits where the immediate sender is new but the address two or three hops back is not.
Nested services are a harder problem. An OTC desk, payment processor or smaller exchange may run its customers' funds through an account at your platform. On-chain, you see one customer. Behind it may be hundreds of end users you never onboarded. Red flags include volumes that do not match the stated business, many counterparties with unrelated risk profiles, and a customer who will not explain the source of deposits. Treat these accounts as correspondent-style relationships, with due diligence on their own AML controls.
How investigators follow funds across hops
A practical investigation runs roughly like this:
- Start from the deposit or withdrawal transaction and identify the immediate counterparty.
- Trace backward (for deposits) or forward (for withdrawals) hop by hop, noting each entity identified along the way.
- At each bridge or swap, match the transfer on the other chain and continue there.
- Cross-check attributions from more than one data source. Providers disagree, and a single label can be wrong or stale.
- Check sanctions lists and open sources for the addresses and entities found.
- Run behavioral checks on the customer's wallet: timing, amounts, thresholds, activity hours.
- Decide, and record the reasoning.
This is where Cryptic AI KYT fits. An AI agent runs that investigation on a wallet itself, follows the money across hops, cross-checks several blockchain data providers plus its own attribution database, uses real-time Bitcoin clustering with safeguards against CoinJoin and exchange batch payouts, and checks OFAC sanctions data and open sources. The output is a deterministic 0 to 100 risk score, and every risk factor comes with a transaction, a source and a timestamp.
What evidence to keep
A decision you cannot explain later is a weak decision. For each case, keep:
- Transaction hashes for every hop you relied on, including both sides of each bridge.
- The source of each attribution (which provider or open source) and when you checked it.
- The behavioral findings, with the specific transfers that show the pattern.
- Screenshots or exports of the fund flow graph as it looked at decision time.
- The analyst's reasoning and the final action: credit, hold, reject, exit or report.
Cryptic AI reports export to PDF with the link graph, fund flows and a transaction appendix, so the file regulators or auditors see matches what the analyst saw. If you want a quick first look before setting anything up, the free AML wallet check screens a single address.
FAQ
Is using a CoinJoin wallet a reason to reject a customer?
Not automatically. It is a risk factor to weigh with everything else: what came before the CoinJoin, what the customer says, and your own risk appetite. Some firms set a policy of enhanced review for any recent mixing exposure.
How many hops back should we trace?
There is no fixed rule. Direct and one-hop exposure carry the most weight, but indirect exposure to a hack or sanctioned address several hops back still matters, especially when the path between them is fast and has no economic purpose.
Can chain hopping be followed reliably?
Often, yes. Most bridges leave matching events on both chains. It becomes harder with privacy-focused swaps and when amounts are split, which is why matching on amount, time and transfer ID together is important.
Do we need to file a report for every red flag?
No. Reporting obligations depend on your jurisdiction and on whether you know or suspect laundering. Red flags start a review. The review decides whether a suspicious activity report is warranted.
Red flags are only useful if someone can trace them to the transactions that raised them. If your team spends hours rebuilding fund flows by hand, see how Cryptic AI KYT investigates a wallet and hands you the evidence alongside the score.