Crypto Money Laundering: How Stablecoins Move Scam Money

Victims ask the same question in the same words: where did the money go? The answer, for most large scams run against Indians today, is that it stopped being rupees within a day. It passed through a chain of rented bank accounts, became a dollar stablecoin, and left the country on a blockchain. Crypto money laundering is the plumbing under digital arrest, fake trading apps and task scams alike, and understanding it explains both why 1930 matters so much and why recovery stalls after the first few hours.

This explainer follows the money in three legs, names the people and businesses at each stage, and sets out honestly what can and cannot be frozen. It uses no invented figures. The official totals for complaints, reported losses and lien-marked amounts are in our statistics hub.

Leg 1: mule accounts inside India

A victim never pays the scammer directly. The transfer goes to a bank account or UPI ID belonging to someone else: a student who rented out their account for a few thousand rupees a month, a labourer whose KYC documents were used, a shell firm's current account, or an account opened with a stolen identity. These are mule accounts, and the networks hold hundreds of them.

Within hours the money is split and forwarded through two or three more layers of mules, each transfer small enough to avoid attention. This is the leg the CFCFRMS is built to attack: a 1930 complaint pushes the transaction chain to every bank involved, and any balance still sitting in a mule account can be put on lien. The MHA's July 2026 reply to the Lok Sabha gives the cumulative figures for what has been lien-marked since 2021, and they are a fraction of what was reported, because the next leg usually begins before the complaint is filed.

Leg 2: from rupees to stablecoins

Stablecoins are tokens pegged to the US dollar and issued on public blockchains. The scam networks use them because they hold value for the days a transfer takes, move in minutes for a fee of cents on the cheapest networks, and can be sold for cash or local currency in Dubai, Phnom Penh or Yangon without a bank. Two routes take rupees into them.

P2P trading

Crypto exchanges run peer-to-peer markets where a seller lists USDT for rupees and a buyer pays by UPI or bank transfer, after which the exchange releases the tokens. The networks use mule accounts to buy from ordinary sellers, dozens of trades a day across many sellers. The seller receives tainted rupees without knowing it; the network receives clean USDT in a wallet it controls. When the victim's complaint traces the funds, the seller's account is frozen. Genuine P2P traders are the laundering layer's weak point and its collateral damage.

OTC desks and cash

Larger sums go through informal over-the-counter desks: a person or shop that takes cash or a bank transfer and sends USDT to a wallet, for a margin, with no questions. Some are the crypto face of old hawala networks. UNODC's regional office for Southeast Asia has described how such desks and underground banking in the region service the scam compounds that target India, among other countries; the UNODC page summarises its reports.

Leg 3: chain hopping, mixers and cash-out

Once the money is a stablecoin, it is moved to break the trail. Chain hopping converts it across different blockchains through bridges or exchanges. Swaps turn it into other tokens and back. Mixers pool many users' coins and pay them out to fresh addresses. Funds are spread across many wallets and consolidated abroad, then sold at an exchange with loose checks, converted to cash at an OTC desk, or used to buy property and goods. Each hop adds a jurisdiction and a company that would need to be asked for records. This is the stage of crypto money laundering where tracing still works but recovery usually does not.

Public blockchains make this traceable in principle, and investigators do trace it. What tracing cannot do is compel a foreign exchange or a cash desk to give the money back. That takes a law-enforcement request through the right channel, which is where the Interpol and mutual legal assistance machinery comes in, and it is slow.

Crypto money laundering: what can be frozen, and by whom

Indian exchanges and other virtual digital asset service providers must register with FIU-IND as reporting entities under the Prevention of Money Laundering Act, which is why they respond to freeze requests and file suspicious transaction reports. The gap is everything after the funds leave a registered platform.

What this means for a victim

Three practical conclusions follow from the plumbing.

First, speed on the bank leg is everything. Call 1930 before anything else; it is the only step that can act before conversion. The realistic timeline for what comes after is in how to get money back after online fraud.

Second, "frozen" is not "returned". Lien-marked money is released by a magistrate's order, which takes weeks to months and a police file that connects the funds to your complaint. Keep every acknowledgement.

Third, the person who calls offering to "trace and recover" your crypto for an advance fee, or who asks you to pay "gas fees" or "taxes" to unlock a balance you can see on a screen, is running the follow-up scam. The fake trading apps described in our Telegram tips-group explainer and the long-con described in pig butchering both end this way. For a case that involves an exchange account or a wallet, our investment and crypto scam response service handles the complaints and the exchange correspondence on a fixed fee.

For investigators and compliance staff

The skills that matter are unglamorous: reading a bank statement chain quickly, requesting KYC and device data from exchanges in the format they accept, following a stablecoin across a block explorer, and knowing which issuers and exchanges respond to Indian requests and how. The investigation fundamentals and OSINT programmes cover the bank and open-source legs; the crypto-tracing tools are a layer on top. Europol and UNODC both publish accessible primers, and the broader picture of how AI-assisted scam compounds feed this pipeline is in AI and cyber crime: what changed.