What has changed in AML infrastructure that financial institutions and VASPs should be aware of? How did laundering routes shift in 2025? And what major challenge must compliance teams address fast?
In this live session industry experts examine how stolen crypto is moved and why compliance teams might fail to face the challenge. The speakers of the panel were:
Their discussion focused on where response workflows fail, why speed and automation matter, and which control points in the AML system now shape the outcome of most incidents.
Key Panel Insights
Year 2025 as a step-change in both the scale and the mechanics of crypto laundering. What used to be just a mild nuisance is gradually becoming an independently operating sub-system of stealing funds.
- Laundering volume and turnout increased sharply.
Based on the Global Ledger analysis, over $4 billion were stolen in 2025. In 2024 this amount would only reach $1.4 billion. This showcases the growing pressure on AML programs and teams by both higher incident frequency and larger loss size.
- Bridges became a primary routing layer for stolen-asset movement.
Cited figures indicate roughly 50% of stolen funds (about $2 billion) moved through bridges in 2025, with bridges used about three times more often than mixers, shifting AML focus toward bridge monitoring and cross-chain tracing.
- Time-to-action is a decisive variable
Attackers are now able to make the first move of funds before public disclosure — within about 17 hours on average, while public disclosure follows in about 2.1 times later. Stolen funds then typically reach the first mixer/VASP in roughly 5.2 days. Noteworthy is that cash-out is intentionally delayed, with portions of funds being left inactive until monitoring intensity declines.
The trends that reshape the crypto industry also signal about compliance gaps and the necessity to pay attention to the evolving changes.
AML Systems Are Not Ready for The Challenge
Even small operational delays can be decisive: a 10–15 minute gap while some’s drafting an email to a cyberpolice department and while the department takes time to read it — this time can be enough for funds to exit an exchange.
Email-based workflows are too slow for urgent blocking unless they’re supported by automated blocks and real-time alerts at deposit and withdrawal.
What Compliance Can Do Right Now
Controls are most effective when they prevent exposure early and reduce decision time. The operational focus is on stopping high-risk flows before they cross systems, and on automating actions that otherwise depend on slow, manual escalation.
The common requirement across these steps is speed. Faster labeling and automated blocking determine whether it is possible to stop funds before hackers move them further. And downstream analysis mainly improves understanding of what happened.
Watch the full session
The full session walks through how stolen funds move from the initial exploit to cash-out, and where AML controls break under real-time pressure. It also covers what compliance teams can do right now, what usually works (and what doesn’t), and what results are realistically on the table.
Fill out the form below to get the full live session recording.
Laundering Speed: Lessons from 255 Hacks for VASPs