Understanding crypto recovery scams: how they work and how to avoid falling into these fraudulent schemes.
Statistically, 2 out of 3 crypto businesses are exposed to sanctioned funds, often linked to jurisdictions like Russia or Iran, and based on our data, most don't even know it yet.
These numbers aren't hypothetical. They reflect where the industry actually stands today, and the Global Ledger team was at Paris Blockchain Week to discuss exactly this.
On April 15, our CEO Lex Fisun joined the Regulation Track panel "The Global Playbook: Operating Across EU, US & Asia" at the Mona Lisa Stage alongside experts from the European Commission, HashKey Group Europe, Crypto Council for Innovation, and BANXA.
Below are the key insights from that conversation and why they matter for every compliance team in crypto right now.
Lex Fisun, CEO at Global Ledger, at Paris Blockchain Week 2026 — pictured center
Paris Blockchain Week 2026: What Came Out of the Panel
The conversation touched on enforcement, AML infrastructure, and where compliance is falling short. Here is what matters most.
The $13B reality check the industry needs to sit with
As Lex mentioned, licensed centralized exchanges have processed around $13 billion in sanctioned funds over the past two years. And it’s hard to blame them for this, since the actual risk is simply invisible.
In crypto, exposure is rarely direct. Indirect exposure accumulates quietly, often without anyone realising it's there — and the numbers show how easily it happens. In 2024 alone, $6.51 billion of Garantex-linked funds were linked to VASPs with EU licenses. When Garantex was sanctioned and reborn as Grinex, the “machine” barely paused: $733 million more moved through licensed exchanges in under three months after the OFAC designation.
The speed gap: why illicit money keeps getting through
The core of the problem isn't intent — it's architecture. The speed at which bad actors move simply outpaces the speed at which compliance processes are built to respond, and that gap is where billions disappear.
DPRK-linked cases illustrate the scale of the problem: $1.89 billion stolen in 2025, reusing the same self-hosted wallets to launder money from different hacks, according to the Global Ledger Laundering Race report. Funds moved on average within 54 minutes after the hack, while it takes around 1.5 days for the industry to publicly report an incident.
On the compliance side, mid-size exchanges can need up to 20 officers handling roughly 1,000 alerts per month. At around $8,000/month each, that's about $160,000+ monthly just to keep pace with alerts. In this regard, compliance turns out to be slow and expensive.
Depth matters as much as speed
Even well-resourced compliance teams can miss exposure when their tools don't look deep enough. Illicit funds can sit as close as 2 hops away or go well beyond 5 — yet most standard AML tools in the industry only see up to 5 hops. That's exactly the range where indirect exposure tends to hide.
As Lex mentioned in the LinkedIn post, nearly 7 out of 10 licensed entities the Global Ledger team researched had exposure to Iran. About 70% of entities were exposed for precisely the following reasons:
What Compliance Teams Can Do Right Now
Exposure comes in many forms, and knowing where to look is the first step. The most common categories seen across the industry include:
- Iranian sanctioned flows — often sitting within 2 to 5 hops via USDT on TRON or BNB Chain.
- Russian hidden economy — including Grinex, A7A5, and Garantex wallets that remain operational despite the shutdown.
- Stolen funds from hacks and scams — frequently laundered through DEXs and cross-chain bridges within minutes of the incident.
- Terrorist financing — regardless of transaction volume, it carries the highest regulatory consequence and often moves through wallets with no prior flagged activity.
- Darknet-linked transactions — funds that passed through darknet markets at some point in the chain, even if the direct counterparty appears legitimate.
- Mixer activity — transactions routed through mixing services to obscure the original source, a common step in multi-hop laundering patterns. This has become especially relevant since sanctions on Tornado Cash were lifted in March 2025, making it the #1 mixer in H2 2025.
Conclusion
The panel highlighted one clear conclusion: despite sanctions and enforcement, illicit flows continue to move. The main reason for this gap is that compliance remains slow and expensive, while laundering is fast and cheap. The gap between the two isn't closing on its own.
The good news is that exposure, even when indirect and multi-hop, is visible when the right tools are in place. The industry already has regulatory frameworks. What it needs now is the speed and depth to implement them effectively. The exchanges that invest in that now will be the ones that remain operational, trusted, and competitive as enforcement tightens across the EU, US, and Asia.
