For as long as financial systems have existed, criminals have found ways to exploit them. In today’s digital age, cryptocurrency represents the new frontier, bringing innovation, excitement, and, unfortunately, a host of criminal activity.[1] What started as a unique decentralized alternative to traditional banking has become a double-edged sword. It is an instrument of financial inclusion, but also a tool for money launderers, cybercriminals, and rogue nation-states.[2] The law can barely keep up. Without coordinated international action, cryptocurrencies risk becoming a primary vehicle for criminals, threatening financial stability and security worldwide.[3]
Cryptocurrencies have transitioned from niche markets to mainstream financial instruments.[4] They are increasingly used for legitimate transactions, including cross-border payments, investments, and decentralized finance (“DeFi”) applications.[5] Countries like El Salvador have embraced Bitcoin as its nation’s currency.[6] Additionally, cryptocurrencies facilitate low-cost, rapid international transactions, reducing reliance on traditional banking systems and expanding financial access for “unbanked” populations, such as individuals in developing nations without access to formal financial institutions.[7]
Beyond individual use, major corporations have begun integrating cryptocurrency payments, with companies such as Tesla, PayPal, and Visa now supporting digital asset transactions.[8] Cryptocurrencies also empower small businesses by allowing them to bypass expensive international transfer fees and reach global customers without relying on traditional banking and exchange infrastructure.[9] However, these benefits come with challenges, as the decentralized structure of cryptocurrencies makes it difficult to implement consumer protections and prevent fraud.[10]
Cryptocurrencies operate in a largely unregulated financial space, creating vulnerabilities that criminal enterprises are quick to exploit.[11] These include the use of mixing services, privacy coins, and peer-to-peer transactions to launder money and evade detection.[12] The very characteristics that make digital assets attractive like decentralization, anonymity, and “borderless” transactions also present significant regulatory challenges.[13] Without proper oversight, the expansion of cryptocurrency markets risks fueling illicit financial flows that could destabilize economies and undermine international financial institutions.[14]
The decentralized nature of cryptocurrencies allows them to bypass traditional financial monitoring systems, such as Know Your Customer (“KYC”) protocols and Suspicious Activity Reports (“SARs”), that are mandatory in regulated banks and financial institutions. See Subashi, Roland, Cryptocurrencies and Money Laundering.[15] Many jurisdictions have conflicting or unclear regulations, making it difficult to enforce compliance across international borders.[16] The European Union has implemented anti-money laundering (“AML”) regulations for crypto assets through the Fifth and Sixth Anti-Money Laundering Directives, requiring crypto service providers to register and conduct customer due diligence. However, other nations lag behind, resulting in inconsistent enforcement globally.[17]
For example, while the United States (“U.S.”) has taken steps to regulate cryptocurrency exchanges, it’s individual states have differing rules regarding the classification and taxation of digital assets.[18] In contrast, China has outright banned cryptocurrency transactions, citing the risks they pose to financial stability.[19] This mixed bag of regulations has led to regulatory arbitrage (the practice of exploiting differing regulations amongst jurisdictions to circumvent the rules), with crypto businesses relocating operations to jurisdictions with weaker oversight, further complicating enforcement efforts.[20] For instance, Tornado Cash—a decentralized mixing protocol—was sanctioned by the U.S. Treasury for its role in laundering over $455 million in stolen crypto assets by North Korea’s Lazarus Group.[21] Without a standardized regulatory approach, illicit actors continue to exploit gaps in oversight, funneling illicit funds through exchanges that fail to adhere to strict AML and consumer protection policies.[22]
Additionally, regulatory inconsistencies have created confusion among investors and businesses.[23] Many financial institutions hesitate to engage with cryptocurrency firms due to the uncertainty surrounding compliance requirements.[24] The lack of clarity in regulatory frameworks discourages mainstream financial adoption, preventing digital assets from achieving full integration into global economies.[25]
Matthias Lehmann argues that a fragmented regulatory landscape creates inefficiencies and incentivizes regulatory arbitrage.[26] His research suggests that establishing a unified global regulatory framework for cryptocurrencies would help prevent financial crime while providing legal clarity for businesses and investors.[27] Without cohesive global standards, jurisdictions will compete by lowering regulatory requirements, creating a “race to the bottom” in financial oversight.[28] Lehmann proposes the creation of a Financial Stability and Innovation Board (“FSIB”) to oversee and enforce international cryptocurrency regulations, modeled after the Financial Stability Board.[29] This approach would strengthen global oversight and ensure uniform compliance measures across borders.[30]
A global regulatory framework would also facilitate international cooperation in tracking and prosecuting illicit financial activities. Currently, law enforcement agencies face challenges in investigating cross-border cryptocurrency crimes due to jurisdictional conflicts.[31] With standardized regulations and international agreements, authorities could more effectively combat financial crime and prevent illicit actors from exploiting loopholes in the financial system by using crypto.
A key example of the risks posed by unregulated cryptocurrency environments is the case of Tornado Cash and its use by North Korea’s Lazarus Group.[32] Tornado Cash, an Ethereum-based cryptocurrency mixer, has been implicated in laundering millions of dollars stolen by North Korean hackers.[33] In 2022, the U.S. Treasury Department sanctioned Tornado Cash after determining that it had facilitated money laundering for cybercriminals, including state-sponsored actors from North Korea.[34] The Lazarus Group, a well-known North Korean hacking collective, used Tornado Cash to obfuscate the origins of stolen funds, bypass international sanctions, and finance illicit state activities—including North Korea’s nuclear weapons program.[35]
The failure of regulatory authorities to prevent such misuse highlights the dangers posed by unregulated decentralized financial platforms. Unlike traditional financial institutions, which are required to implement AML and consumer protection policies, decentralized finance services like Tornado Cash operate with minimal oversight, providing a haven for money launderers and cybercriminals.[36] This case underscores the urgent need for stronger global regulations to prevent the misuse of financial technologies by nation-states and criminal organizations. The Wagner Group, a Russian private military company, has similarly leveraged digital assets to sustain its operations despite global sanctions. The group reportedly used cryptocurrencies to bypass financial restrictions and maintain funding streams.[37]
Darknet markets—hidden services accessible through anonymizing networks like Tor—heavily rely on cryptocurrencies for illegal transactions, including drug trafficking, weapons sales, and human trafficking. These platforms often use Bitcoin and Monero to mask buyer and seller identities, making enforcement difficult.[38] The anonymous nature of Bitcoin and privacy-focused coins like Monero has made it easier for criminals to move illicit funds undetected.[39] While blockchain analysis tools have improved enhanced authorities’ ability to track illicit transactions, many criminals continue to find ways to obscure their activities through mixing services and decentralized exchanges.[40]
While cryptocurrencies offer undeniable economic benefits and anonymity, their unregulated nature poses significant risks to financial security and global stability. The international community must take decisive action to strengthen oversight, enforce compliance, and close the loopholes that allow criminals to exploit these digital assets. Establishing a unified framework for cryptocurrency governance is essential to preventing illicit activities while fostering a safer, more transparent global financial system. Without coordinated international efforts, the risks associated with cryptocurrency will continue to grow, posing a significant threat to economic stability and global security.[41]
[1] Breitman, Ariel, Decoding Cryptocurrency Regulation, The Regulatory Review (2024).
[2] Sanchez, Edgar Crypto-Currencies: The 21st Century’s Money Laundering and Tax Haven, 30 University of Florida Journal of Law & Public Policy (2017).
[3] Adrian, Tobia, The Changing Landscape of Crypto Assets—Considerations for Regulatory and Supervisory Authorities, International Monetary Fund (2024).
[4] Id.
[5] Id.
[6] Id.
[7] See Galasso, Joseph, A Comparative Analysis of Crypto Regulation in the United States and European Union, 39 Touro Law Review (2023).
[8] Id.
[9] Id.
[10] Breitman, supra note 1.
[11] Id.
[12] Sanchez, supra note 2.
[13] Adrian, supra note 3.
[14] Id.
[15] Subashi, Roland, Cryptocurrencies and Money Laundering, 12 Balkan Journal of Interdisciplinary Research (2024).
[16] Sanchez, supra note 2.
[17] See Financial Action Task Force (FATF), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (2021).
[18] Portilla, Juan, A Global Standard Setter for Virtual Currencies, 45 Harvard International Law Journal (2024).
[19] China Declares All Crypto-Currency Transactions Illegal, BBC News (Sept. 24, 2021), https://www.bbc.com/news/technology-58678907.
[20] Subashi, supra note 15.
[21] See U.S. Department of the Treasury, Press Release on Tornado Cash Sanctions (2022); Zellers, Kole, Hacked! North Korea’s Billion-Dollar Crypto Heisting Scheme, Journal of Law and International Affairs (2024).
[22] Salikhov, Rashid, International Legal Aspects of Countering the Laundering of Criminal Proceeds Using Cryptocurrencies, SSRN (2024).
[23] Digital Asset Regulation: The State Perspective, Brookings Institution (Nov. 15, 2022), https://www.brookings.edu/events/digital-asset-regulation-the-state-perspective/.
[24] Id.
[25] Id.
[26] Lehmann, Matthias, Global Rules for a Global Marketplace? – Regulation and Supervision of FinTech Providers, 38 B.U. Int’l L.J. (2020).
[27] Id.
[28] Id.
[29] Portilla, supra note 12.
[30] See Id.
[31] Supra note 23.
[32] Zellers, Kole, Hacked! North Korea’s Billion-Dollar Crypto Heisting Scheme, Journal of Law and International Affairs (2024).
[33] U.S. Department of the Treasury, Press Release on Tornado Cash Sanctions (2022).
[34] Id.
[35] Zellers, supra note 24.
[36] Royal United Services Institute (RUSI), Upholding North Korea Sanctions in the Age of Decentralized Finance (2024).
[37] Nathan Emery & Mariya Golotyuk, Decentralized Warfare: Russia’s Use of Cryptocurrencies to Fund Private Military Companies, Civil Affairs Ass’n (2024).
[38] Salikhov, supra note 22.
[39] Id.
[40] Brookings Institution, supra note 23.
[41] Portilla, supra note 12.
