Stablecoins

• Some mixers and decentralized protocols accept stablecoins (e.g., USDT, USDC), allowing criminals to maintain a stable value when layering illicit funds.
• By converting illicit proceeds into stablecoins and then depositing them into mixers, they sever straightforward transaction histories, reemerging with assets that no longer appear linked to the original addresses.

• Criminals exploit the widespread DeFi acceptance of stablecoins by depositing them into decentralized mixing contracts, blending them with legitimate users’ funds and concealing the criminal proceeds.
• Because stablecoins maintain a consistent fiat-equivalent value, illicit actors can layer transactions and preserve their holdings’ value, complicating proactive detection or freezing of tainted assets.

• Criminals convert illicit funds into stablecoins and then bridge these stablecoins across multiple chains to maintain consistent value while disrupting transaction continuity.
• Stablecoins are widely supported across different blockchain ecosystems, facilitating quick and repeated chain hops that fragment the transaction trail.
• The stable price component reduces volatility risk when shifting large sums rapidly between networks, further incentivizing their use for obfuscation.

• Criminals burn stablecoins on one chain, removing them from circulation, and re-mint identical stablecoins on another chain.
• The stable value reduces volatility risk while layering funds across blockchains, making suspicious fluctuations less noticeable.
• Immediate swapping of newly minted stablecoins via minimal-KYC or decentralized exchanges further severs transaction history, masking the funds’ true origin.

• Criminals bridge stablecoins across multiple blockchains, taking advantage of low volatility to move high-value sums without attracting price fluctuation risks.
• Lock-and-mint bridging can mask the original chain’s transactional trail, creating a gap in forensic accounting.
• With many decentralized stablecoin bridges lacking rigorous KYC, layering illicit funds becomes easier, as investigators find fewer reference points to correlate incoming and outgoing transfers.

• Criminals exploit Onion over VPN to trade stablecoins on peer-to-peer or decentralized platforms, bypassing conventional IP-based monitoring or geolocation restrictions.
• Because stablecoins maintain a consistent fiat-pegged value, layering such transactions behind multiple encryption points makes it even harder for AML teams to detect suspicious fund flows, as movements appear routine and geographically unlinked.

Bots favour pegged tokens (e.g., USDT, USDC) for speed and low fees, moving chunks between chains or exchanges while price stability masks trade intent and aids rapid re-conversion to fiat.

• Criminals repeatedly convert illicit cryptocurrency into stablecoins to maintain value while conducting multiple layering transactions.
• The stable valuation eliminates volatility concerns, allowing faster movement between platforms without significant loss.
• When combined with minimal KYC exchanges, stablecoins facilitate rapid cross-border asset transfers that evade conventional monitoring.

• Ransomware operators convert ransom proceeds into stablecoins on unregulated exchanges to achieve price stability during the layering process.
• Frequent conversions between stablecoins and other cryptocurrencies complicate analysis, masking the original ransom flow and impeding investigations.

• Criminals leverage stablecoins for cross-border transfers, reducing price volatility that might otherwise draw attention.
• By quickly swapping these stablecoins into other tokens or bridging them to alternate blockchain networks, they evade freezes or enhanced scrutiny.
• Minimal or no KYC on certain platforms allows illicit proceeds to be moved under the veneer of ordinary stablecoin transactions.

• Criminals convert illicit money into stablecoins to avoid market volatility while benefiting from pseudonymous transfers.
• They structure these exchanges in multiple smaller increments (smurfing) below reporting thresholds on weak-KYC platforms, evading detection and identity checks.
• Stablecoins can then be rapidly moved across borders and later reconverted into fiat or other digital assets in staggered transactions, complicating traceability and laundering oversight.

• Criminals convert governance tokens into stablecoins after a hack or exploit to lock in value and avoid market volatility.
• Cross-chain bridging with stablecoins increases transactional steps, further obscuring fund flows and making it difficult to follow the money trail.
• Limited regulatory scrutiny in certain jurisdictions allows adversaries to exploit stablecoins for layering, bypassing stringent AML checks.

• Criminals repeatedly convert illicit funds into stablecoins to avoid price volatility during layering steps.
• They exploit high-liquidity stablecoin pairs on decentralized exchanges, intermixing tainted assets with large volumes of legitimate trades.
• Because stablecoins retain a steady fiat peg, criminals can seamlessly move funds through multiple DeFi protocols without incurring significant value shifts or drawing suspicion.

• Offenders convert volatile crypto holdings into stablecoins to maintain consistent value during rapid sequential transfers, preventing large price fluctuations that might raise suspicion.
• These stablecoins are moved across various platforms and jurisdictions, including Layer 2 or off-chain solutions, making it harder for investigators to track the progression of funds.
• The ability to quickly swap stablecoins into other digital assets or fiat currencies further cements their role in multi-step transaction chaining.

• Criminals convert darknet-derived cryptocurrency into stablecoins to preserve value without exposing themselves to volatile price swings.
• These tokens facilitate rapid cross-chain transfers and swapping on decentralized or peer-to-peer platforms, compounding transaction complexity.
• By cycling proceeds through stablecoins, offenders obscure transaction trails while ensuring liquidity for subsequent layering steps or withdrawal.

• Criminals convert holdings into stablecoins (e.g., USDT or USDC) to maintain value without the risk of volatility, allowing continued layering and movement.
• Rapid cross-exchange transfers of stablecoins obscure transactional patterns, diverting investigative attention across multiple platforms.
• Platforms with lax KYC requirements enable criminals to exploit stablecoins for frequent reinvestment, further concealing beneficial ownership.

• The pegged value allows criminals to maintain stable profits while trafficking funds through P2P channels.
• They rapidly purchase or sell stablecoins across multiple user accounts, effectively layering transactions without triggering large-value alerts.
• Minimal KYC on certain P2P stablecoin platforms facilitates cross-border transfers with reduced exposure to volatility.

• Stablecoins pegged to fiat (e.g., USDT, USDC) offer a low-volatility means to hold and transfer value outside regulated banking channels, sidestepping sanctions checks.
• Adversaries convert funds from or to sanctioned entities into stablecoins, then transact globally via unregulated platforms.
• Because stablecoin transactions can occur peer-to-peer, limited oversight allows sanctioned users to shift value, bypassing official watchlists or blocklists.

• Criminals frequently accept stablecoins (e.g., USDT, USDC) during token sales, allowing contributors to pay with minimal price volatility.
• Once received, stablecoins can be quickly transferred across multiple wallets or converted on decentralized exchanges, making it difficult to trace the source and movement of illicit funds.

After mining, criminals may quickly exchange proceeds into stablecoins using decentralized or lightly regulated platforms, preserving value and reducing exposure to volatility. This rapid conversion, especially when combined with intermediary wallets, helps mask the original source and movement trail.