Bitfinex Hack: How $7 Billion in Bitcoin Is Being Laundered
In August 2016, attackers drained 119,756 bitcoin from the Bitfinex exchange. At the time, those coins were worth a fraction of their eventual value. By the time blockchain analytics firm Elliptic published its tracing analysis, the same holdings had grown to nearly $7 billion. What makes this case uniquely instructive for compliance professionals is not the scale of the theft alone, but the detailed picture of how sophisticated actors launder bitcoin over years, and what that means for firms relying on crypto accounting software to screen digital asset flows today.
The Stolen Bitcoin: Still Mostly Sitting There
All 119,756 stolen coins were consolidated into a single wallet immediately after the breach. That single-wallet concentration is itself a red flag that automated screening tools are designed to catch. What is striking, years later, is how much of the balance has stayed put.
The 79% That Has Not Moved
As of Elliptic's analysis, 79% of the stolen coins remained in the original receiving wallet. The thief moved relatively little in the early months, then showed a pattern of periodic outflows that accelerated as Bitcoin's price climbed sharply. A notable example: in April 2021, 12,241 BTC valued at roughly $774 million at the time was shifted in a single episode. The timing correlates with a bitcoin price rise exceeding 700% over the prior year, suggesting that rising asset values create a real pressure on criminals to accept laundering risk they might otherwise defer.
For accounting and compliance teams, this dynamic is important. A long-dormant wallet containing tainted funds can suddenly become active when market conditions shift. Static watchlisting is not enough; continuous, automated monitoring of known theft addresses is the baseline expectation under most AML frameworks.
The 21% That Has Been Moved
Of the coins that did leave the original wallet, the movement has been deliberate and incremental. Elliptic identified two principal techniques: peeling chains and layering. A peeling chain describes a pattern where a large balance is moved through a sequence of addresses, with a small slice redirected to a destination at each step. Layering adds further complexity by routing funds through numerous intermediate addresses across different transaction chains. Both techniques are designed to exhaust manual investigators. Automated tracing, by contrast, can follow these chains to their ultimate destination in milliseconds regardless of the number of hops, a capability that has fundamentally changed the risk calculus for crypto criminals.
Where the Laundered Funds Have Gone
Elliptic's analysis categorises the destination of the moved coins into three buckets: darknet markets, privacy wallets, and exchanges. The proportions are revealing.
Darknet Markets: 84% of Laundered Funds
The dominant channel has been darknet marketplaces. Laundering activity started in 2017 through Alphabay, then the largest active darknet market. When law enforcement shut Alphabay down that same year, the operators pivoted to Hydra, a Russian-language marketplace that had by 2020 grown into the largest darknet market in operation globally, recording $1.4 billion in bitcoin payments in that year alone.
Hydra's appeal in this context is its cash-out infrastructure. Beyond narcotics and illicit services, the platform offered conversion services allowing bitcoin to be exchanged for gift vouchers, prepaid cards, or physical cash in rubles, collected at dead-drop locations. For a cybercriminal operating in Russia or nearby jurisdictions, this pathway avoids any interaction with a regulated exchange that might run blockchain analytics screening. Approximately $72 million of the stolen bitcoin had been routed through Hydra at the time of Elliptic's analysis, with deposits running at roughly $3 million per month.
The Russia angle matters for compliance teams with global exposure. Firms onboarding counterparties or clients with Russian nexus should treat any unexplained cryptocurrency wealth with heightened scrutiny, particularly given the documented use of Russian-language darknet infrastructure in high-value laundering cases. This connects directly to the broader enforcement picture around sanctioned Russian crypto infrastructure that regulators across multiple jurisdictions have been targeting.
Privacy Wallets: 12% of Laundered Funds
The second most significant destination is privacy wallets, specifically those using coinjoin transaction protocols. Coinjoin works by combining multiple users' inputs into a single transaction, breaking the one-to-one traceability that standard bitcoin transactions allow. JoinMarket and Wasabi Wallet are the two tools identified in Elliptic's analysis.
In 2019, around 612 of the stolen coins found their way into JoinMarket, valued at just over $4 million on receipt. By 2020 the preferred tool had shifted to Wasabi Wallet, with $5.3 million of stolen bitcoin processed through it and a further $1 million per month still flowing through at the time of the report. The migration from one tool to the other reflects an active, adaptive laundering operation, not opportunistic one-off activity.
For compliance teams, coinjoin outputs present a specific screening challenge. Coins that have passed through a coinjoin round carry reduced traceability for standard tools. Modern automated analytics address this by analysing statistical patterns across coinjoin clusters, but firms whose crypto bookkeeping software does not integrate real-time risk-scoring may not catch coinjoin-tainted inflows at the point of receipt.
Exchanges: 4% of Laundered Funds, but Critical Intelligence
Exchanges represent the smallest share of laundered funds, and the analysis explains why. Regulated exchanges increasingly run automated blockchain screening, and law enforcement can compel them to disclose account holder identities when suspicious deposits are flagged. That combination has made compliant exchanges a high-risk channel for criminals handling known-stolen bitcoin.
The exchanges that did receive stolen Bitfinex coins were predominantly based in jurisdictions with limited or nascent crypto regulation, precisely because AML obligations there are weaker or unenforced. A small but meaningful share did reach well-regulated platforms. Each of those deposits is a potential investigative lead because KYC data collected at onboarding can connect a transaction to a real identity.
From a compliance standpoint, this is the argument for rigorous source-of-funds checks and real-time taint screening at deposit. Your digital asset accounting software workflow should flag any inbound transaction that traces back to a known theft wallet, even if it has passed through multiple intermediate hops.
AML and Accounting Implications for Compliance Teams
The Bitfinex laundering pattern is not just a historical curiosity. It illustrates techniques that appear repeatedly in current enforcement actions and that directly affect how firms should configure their screening and recordkeeping.
Taint Propagation and the Multi-Hop Problem
The peeling chain and layering techniques described above are designed to exploit a gap that exists when screening is purely rule-based and shallow in its tracing depth. A transaction that is three or four hops removed from a known theft wallet will not trigger simple address-matching. Firms that rely on manual review or first-generation screening tools are therefore systematically underexposed to this risk.
Best practice is to adopt tracing that follows funds through an unlimited number of hops and returns a risk score for the ultimate source rather than just the immediate sender. That output should feed directly into the firm's crypto accounting software so that tainted assets are flagged before they are recorded as clean receipts on the balance sheet.
Dormant Wallet Monitoring
The decade-long dormancy of most of the Bitfinex coins, punctuated by large sudden movements, creates a specific obligation for compliance teams. Major known theft addresses should be on a permanent watchlist with automated alerts configured for any outflow. When those coins move, firms receiving downstream transactions need to know immediately. This is not a theoretical risk; Elliptic's data shows those coins are still actively being dispersed.
Jurisdictional Exposure and Russian Nexus
The heavy routing of Bitfinex stolen funds through a Russian-language darknet market, combined with ruble cash-out services, reinforces why Russian-nexus transactions carry elevated AML risk. Firms operating globally should ensure their customer risk scoring reflects jurisdictional exposure, and that enhanced due diligence is applied systematically where counterparties have direct or indirect links to high-risk geographies. For context on how Russia's own regulated crypto infrastructure is evolving in parallel, see our coverage of Russia's first registered crypto custodians.
At-a-Glance: Destination Breakdown of Laundered Bitfinex Bitcoin
| Destination Type | Share of Laundered Funds | Primary Mechanism | Key Compliance Risk |
|---|---|---|---|
| Darknet markets (Hydra) | 84% | Ruble cash-out, gift cards, prepaid cards | No KYC; ruble conversion evades reporting |
| Privacy wallets (coinjoin) | 12% | JoinMarket, Wasabi coinjoin transactions | Breaks transaction traceability; taint obscured |
| Exchanges | 4% | Deposit and conversion to fiat or other assets | KYC data creates investigative leads; regulated exchanges can freeze |
What Firms Need to Do Right Now
The Bitfinex case shows that the laundering of major theft proceeds is a long-running, adaptive process that does not expire. Compliance teams cannot treat it as a closed file. Three practical actions follow from Elliptic's analysis.
Review Your Screening Depth
Confirm that your transaction screening covers indirect exposure to known theft addresses through multi-hop tracing, not just direct address matching. If your crypto accounting software does not integrate risk scores from automated blockchain analytics, that gap needs to close. The EU's AML Authority framework, the UK's JMLSG guidance, and FATF's updated virtual asset recommendations all point toward a risk-based approach that implicitly requires source-of-funds tracing beyond the immediate counterparty. For further context on how AI is being applied to this problem at scale, see our earlier piece on AI-powered blockchain analytics for AML detection.
Build Coinjoin Detection Into Inbound Screening
Privacy wallet outputs should be treated as elevated risk by default. A coinjoin output is not necessarily criminal, but it indicates an active attempt to obscure transaction history. Your firm's policy should specify how coinjoin-origin deposits are handled: enhanced due diligence, source-of-funds requests, or outright rejection depending on your risk appetite and regulatory obligations.
Maintain Permanent Watchlists for Known Theft Addresses
Static onboarding checks do not catch dormant wallets that reactivate years later. Continuous monitoring of known high-risk address clusters is the only way to ensure that a sudden movement of long-held stolen funds triggers the right alerts before a downstream deposit reaches your books. Ensuring that your digital asset accounting software flags these alerts in real time, rather than in a batch process, reduces the window between receipt and detection.
Frequently Asked Questions
What is a peeling chain and why does it matter for compliance?
A peeling chain is a laundering technique where a large bitcoin balance is moved through a sequence of addresses, with a small portion sent to an end destination at each step. The rest is "peeled" forward to the next address in the chain. It matters for compliance because it can make manual tracing impractical, and because shallow screening tools that only check the immediate sender will not detect the original tainted source.
How does coinjoin obscure stolen funds, and can it be detected?
Coinjoin combines multiple users' inputs into a single transaction, breaking the direct link between sender and recipient. Coins that have passed through a coinjoin round are harder to trace to their origin. Advanced analytics platforms address this by analysing cluster-level patterns across coinjoin rounds, but firms need to ensure their screening integrates those capabilities rather than relying on simple address matching.
Why are darknet markets the dominant laundering channel for these funds?
Darknet markets like Hydra offered cash-out services that convert bitcoin to physical cash or prepaid instruments without any identity verification. For a criminal seeking to avoid regulated exchanges with blockchain analytics screening, this route bypasses the KYC and AML controls that would otherwise flag tainted deposits. The ruble cash-out format is particularly attractive for actors operating in Russian-speaking jurisdictions.
What accounting treatment applies when a firm unknowingly receives tainted bitcoin?
This is a complex area that depends on jurisdiction, but the general principle is that if a firm receives tainted assets and subsequently freezes or surrenders them following a law enforcement request, those assets cannot be recognised as revenue or a clean balance sheet holding. Firms should document the screening result at receipt, the freeze action, and any regulatory notification. Your crypto bookkeeping software records may need to be amended to remove or re-classify the asset. Legal counsel and your AML compliance officer should be involved immediately.
Does the Bitfinex case affect firms that have never handled BTC directly?
Yes, indirectly. The laundering techniques documented here, including peeling chains, coinjoin, and routing through darknet markets, are not unique to the Bitfinex case. They appear across many enforcement actions involving other stolen or illicit digital assets. Any firm handling bitcoin or wrapped bitcoin derivatives should treat these patterns as live risk indicators, not historical artefacts.
Source: Elliptic