Behind the top darknet markets in 2026: BTC flows, the most active dark web platforms, and what crypto businesses should know to prevent darknet exposure.
In 2024, hackers stole $1.94 billion across 265 crypto scams and hacks, according to Global Ledger research. In 2025, that number more than doubled: $4.04 billion across 255 incidents. Fewer attacks, greater damage, and laundering operations that get harder to trace.
The challenge for compliance teams is not just that controls lag behind the threat.
Hackers treat every new preventive measure as a signal — new blacklists, tighter monitoring, updated screening logic force them to reimagine how illicit funds move next. The tactics that defined previous years have already changed significantly.
By 2026, the laundering infrastructure looks structurally different. This article breaks down the five trends redefining that shift and what this means for your AML framework today.
5 Trends Redefining Global Financial Crime in 2026
1. The Bridge Takeover
Cross-chain bridges have replaced mixers as the primary laundering tool, creating new “blind spots” in the risk detection process.
According to Global Ledger research, in 2025, bridges handled $2.01 billion — nearly 50% of all stolen funds and over 3x more than mixers and privacy protocols combined. The North Korea Bybit crypto hack alone contributed to the numbers: of the $1.38 billion stolen, 94.91% moved through bridges.
In 2024, the picture looked different. Mixers processed around 50% of stolen funds across the 25 largest hacks ($763.48 million). They offered lower visibility risk and remained the go-to tool before regulatory scrutiny caught up.
Top destinations of stolen funds from the 25 largest hacks of 2024. Source: Global Ledger.
The shift from mixers to bridges happened for a structural reason. Bridges break the linear transaction trail in a way mixers simply cannot, enabling chain hopping across incompatible ledger architectures.
Most bridges operate as permissionless smart contracts that are not designed to detect or freeze illicit flows, allowing attackers to move massive volumes while evading KYC and sanctions screening. A single cross-chain bridge exploit — one of the most dangerous crypto scams targeting protocol infrastructure — can disperse funds across dozens of chains before any alert is triggered.
Bridges also serve as a gateway into DeFi, where laundering volume grew 4.3× in H2 2025. Once cross-chain, attackers swap assets, fragment funds into micro-transfers across multiple chains, and make investigations far more resource-intensive than tracing a traditional mixer.
With the Global Ledger KYT solution, you can monitor suspicious transactions in real time, flag cross-chain flows as higher risk by default, and have updated risk models with bridge- and mixer-specific patterns before exposure reaches your platform.
2. The Staging Evolution
Simple, direct transfers of illicit funds to exchanges are a thing of the past. Hackers are increasingly using fragmented, multistage laundering to move stolen funds before using an exchange as one of their cash-out points.
The Global Ledger study shows that multistage laundering was used in 99% of hacks across 255 cases in 2025. In H1’2025, just 2.5% of cases moved funds straight to a VASP or mixer within the first move. In H2, that number dropped to zero. This means that hackers don't rush to move the illicit funds right away to regulated exchanges; instead, they choose more complex and cautious methods where they're more likely to go unnoticed.
With such a laundering approach, hackers break balances into smaller transfers distributed across multiple unhosted wallets, then route them through mixers, cross-chain bridges, DEXs, and instant swap services. This pattern is especially common following flash loan attacks and smart contract exploits — among the most common types of crypto scams targeting protocol infrastructure.
In the Global Ledger visual tracing tool, clustering algorithms can surface hidden links between wallets by combining behavioural patterns, smart contract interactions, and fund origin analysis to associate activity with specific entities or events.
3. DeFi Migration
Attackers are fleeing CEXs due to better security, leading to an increase in funds being laundered through decentralized protocols.
The Global Ledger research team found that laundering volumes through decentralized protocols grew more than 4.3× between H1 and H2 2025 — from $170 million to $732 million — making DeFi the second most used laundering route by year-end.
DeFi platforms have become the second-largest inflow point for stolen funds, surpassing CEXs. Source: Global Ledger.
DeFi protocols operate without KYC or sanctions screening, execute transactions through permissionless smart contracts, and offer near-instant asset swaps across chains. There is no compliance layer to flag suspicious flows, no account to freeze, and no operator to serve a court order on. For attackers looking to obscure their trail and break the transaction path, that architecture is exactly what they need. DeFi has also become an environment where different types of crypto scams — from liquidity drain schemes to governance exploits — originate and escalate.
With the Global Ledger KYT solution, you can generate DeFi exposure reports covering on-chain activity across a specified token set and time window, including smart contract data, transaction flows, sources or destinations of funds linked to the contract.
4. The Speed Gap
Laundering has become a game of extremes: while the total laundering "marathon" has slowed down to over 10 days, the absolute maximum speed for a first fund movement reached a record 2 seconds in H2 '25.
The average time from a crypto exchange hack to the first fund movement was around 17 hours in 2025 — well before public disclosure, which followed 2.1× later. In the fastest recorded case, funds moved in just 2 seconds — twice as fast as in H1 2025. That means by the time anyone knows a hack happened, the money is already gone.
However, after that first move, attackers deliberately slow down. Stolen funds typically reach the first mixer or VASP around 5.2 days after the incident. The logic is simple: quickly make the first move, then wait for monitoring intensity to decline before the next step.
With the Global Ledger KYT tool, you can monitor addresses of interest in real time using a system that performs 500,000 AML checks each day. Instant alerts notify you about deposits from known entities and suspicious fund movements, helping your team act early and demonstrate reasonable efforts to regulators and partners.
5. Tornado’s Return
The dramatic surge in Tornado Cash usage from 42.9% to 74.3% of cases by late 2025, following the lifting of sanctions, signals a failure of blacklist-only compliance.
Mixers and privacy protocols remain the step after bridges, used in 45.1% of all hacks in 2025.
Mixers remain the step after bridges — a pattern visible across known crypto scams and large-scale hacks alike — used in 45.1% of 255 cases in 2025. Tornado Cash leads among crypto mixers, used in 41.57% of all hacks (115 of 255) in 2025, according to the Global Ledger study. Its usage jumped sharply in H2 after sanctions were lifted in March 2025. The lifting of sanctions immediately removed the primary compliance hurdles that previously triggered automated alerts at centralized exchanges.
The use of mixers and privacy protocols by hackers in 2025. Source: Global Ledger.
With Global Ledger KYT, you can set alerts based on transaction behaviour — amounts, timing, and inflow-outflow patterns — to catch cryptocurrency mixer exposure early. For cases where direct attribution is not possible, probabilistic tracing helps surface likely links between deposits and withdrawals after the fact.
One More Upcoming Trend for 2026: Stricter Regulation Catches Up
By mid-2026, MiCA will reach full implementation in Europe and transitional arrangements for VASPs will expire across multiple jurisdictions.
Stricter Travel Rule enforcement is the most immediate pressure point. No-KYC and unregulated exchanges are becoming harder to operate as regulators close the gaps that previously allowed “lighter-touch” oversight.
Stricter oversight is not limited to VASPs. Investment scams, Ponzi schemes, and pump and dump schemes targeting retail users are also coming under closer scrutiny. More broadly, regulatory compliance in 2026 is evolving alongside new approaches to combating global financial crime both at the business and user level. Authorities are moving away from checking whether a VASP has an AML program toward asking whether that program is actually working.
With the Global Ledger KYB solution, you can perform enhanced due diligence on counterparties to check their risk exposure, as required under the Travel Rule and MiCA's VASP onboarding obligations. You’ll get full visibility into fund sources, destinations, and entity exposure data that helps your team build the documentation needed to support SAR filings when required.
Conclusion
Crypto laundering has become a structured, multi-layered process. Bridges replaced mixers. Staging replaced direct transfers. Speed and patience are now used together as a cautious yet consistently effective strategy.
The tools and frameworks built for previous years are not equipped for what is happening in 2026. To operate in this new environment, compliance teams need approaches that put them ahead in the laundering race — not reacting after the fact. Multi-chain monitoring, AI-powered alerts, time-based triggers, cluster analytics, and updated risk models with bridge- and mixer-specific patterns are the baseline your compliance framework needs in 2026.
Global Ledger provides tools for real-time monitoring, cross-chain visibility, and enhanced due diligence that cover the full picture behind transactions and entities. Quiet risk is harder to spot. Preparation helps — and you don’t have to do it alone. Schedule a demo to see how we can help support your compliance workflows.
FAQ
Laundering Speed: Lessons from 255 Hacks for VASPs
See how attackers move and launder stolen funds — and what compliance teams need to watch for to stay prepared. Bonus checklist included.