NFT Money Laundering: What the Data Actually Shows
NFTs are widely assumed to be a haven for money laundering. Elliptic's research, covering the period from Q4 2017 through Q2 2022, tests that assumption with on-chain data and reaches a conclusion that surprises many compliance practitioners: direct laundering via NFT platforms is small in absolute terms, but the route criminals actually prefer, running funds through mixing services first, creates a real and measurable exposure that NFT marketplaces and their accounting advisers cannot ignore.
The Scale of Direct NFT Money Laundering
Elliptic identified just over $8 million in illicit funds flowing into NFT platforms across the roughly five-year window studied. Set against more than $40 billion in total NFT-related trade activity over the same period, that figure is a small fraction of overall volume. The finding challenges the narrative that NFT markets are routinely exploited by large-scale launderers.
Where the Illicit Funds Originated
Almost all of the $8.1 million traced to illicit origins came from thefts, scams, phishing operations, and Ponzi schemes rather than, say, drug trafficking or sanctions evasion through direct transfers. That source mix matters for risk classification. It means the typical NFT money-laundering case begins with the theft of NFTs themselves, and the subsequent marketplace transactions serve as the cash-out mechanism for stolen assets, not as a primary channel for laundering proceeds from unrelated serious crime.
Why Low Volume Does Not Mean Low Risk
A small absolute figure can still carry disproportionate compliance weight. NFT prices are structurally opaque: a token from a lesser-known collection could sell for one dollar or one hundred thousand dollars with no objective benchmark to trigger suspicion either way. That price ambiguity is precisely what makes NFTs theoretically attractive for value transfer. Rarity, community sentiment, and speculative demand all influence price, but none of these factors produces a reliable fair-value anchor, particularly for illiquid collections. For compliance teams and auditors assessing NFT-related transactions, this means standard market-price comparisons that work for fungible tokens offer far less traction here.
Blockchain Transparency as a Deterrent
One reason direct laundering via NFT platforms remains low is the transparency built into the underlying infrastructure. Every NFT on a public blockchain carries a complete, immutable history: sales, transfers, bids, listings, and wallet interactions are all visible to anyone with a blockchain explorer. Investigators can trace ownership chains and connect wallet addresses to broader transaction graphs without needing a subpoena. That traceability is uncomfortable for launderers, for whom anonymity is the primary operational requirement.
Implications for Transaction Monitoring in Crypto Accounting Software
For accounting firms and CFOs using digital asset accounting software to manage client portfolios that include NFTs, this transparency is a double-edged asset. On-chain data can be rich and auditable, but interpreting it correctly, linking wallet addresses to entities, identifying mixer exposure, and flagging sanctioned counterparties, requires tooling and expertise beyond standard bookkeeping workflows. Teams that rely on crypto bookkeeping software without integrated blockchain analytics risk producing financial statements that are technically complete but compliance-blind.
The Mixer Problem: Where the Real Exposure Lives
The more significant finding from Elliptic's research is not the $8 million in direct laundering but the $137.6 million in funds that reached NFT platforms after passing through mixing services. That figure represents 0.34% of all identified transactions, which sounds small until you consider that virtually all of it was deliberately obfuscated before reaching a marketplace.
Tornado Cash and NFT Scammer Proceeds
Tornado Cash, the Ethereum-based mixer that has since been subject to US Treasury sanctions, dominated this exposure. Among scammer wallets, Elliptic traced $67.1 million in Ether originating from 323 identified wallets tied to NFT fraud. Of that total, 52.4%, or $35.2 million, was laundered specifically through Tornado Cash before the proceeds moved onward. That majority preference for a single mixing service underscores why sanctions screening has become an operational necessity for NFT platforms, not an optional compliance upgrade.
Other Obfuscation Routes
Beyond mixers, the research identifies a wider toolkit that bad actors use before approaching NFT marketplaces: no-KYC coin swap exchanges, crypto ATMs, and gambling platforms. Each of these services can break the transaction trail between an initial theft or fraud and subsequent NFT trades. For compliance purposes, the presence of any of these as an intermediate step in a client's transaction history should elevate the risk rating of the overall position, even if the NFT trade itself appears unremarkable.
Understanding how blockchain analytics tools are being applied to detect exactly these kinds of layered flows is directly relevant here. Our earlier piece on how blockchain analytics is reshaping AML investigations covers the investigative methodology in more detail.
Accounting and Audit Implications for B2B Practitioners
For accounting firms, auditors, and CFOs advising clients with NFT holdings or operating NFT-related businesses, the Elliptic data reframes the compliance conversation in several practical ways.
Risk Tiering NFT Clients and Counterparties
Not all NFT exposure is equal. A client holding blue-chip collection NFTs purchased through a regulated marketplace with full KYC sits in a materially different risk category from one whose wallet history shows interactions with no-KYC swap services or addresses flagged in OFAC's Specially Designated Nationals list. Firms should be building or updating their client risk assessment templates to reflect this distinction, rather than applying a blanket "high risk: digital assets" label to all NFT positions.
Fair Value and Valuation Challenges
The price opacity that makes NFTs attractive to bad actors also creates genuine accounting headaches for legitimate holders. Under IFRS and US GAAP, fair value measurement requires reference to observable market data where available. For NFTs, particularly from smaller collections with thin secondary market activity, "observable market" is a contested concept. Auditors signing off on financial statements that include significant NFT holdings need documented valuation methodologies that acknowledge illiquidity discounts, the absence of active markets, and the potential for wash trading to distort reported prices.
Wash Trading: The Market Manipulation Layer
Elliptic's report also touches on market manipulation risks, notably wash trading, where the same party or coordinated group trades an NFT back and forth to inflate apparent price and volume. For an auditor or CFO, a client's NFT portfolio valued at carrying cost derived from recent transaction prices may be materially overstated if those prices were wash trades. Digital asset accounting software that ingests raw transaction data without applying wash-trade detection logic will not catch this. It is an area where the bookkeeping layer and the compliance layer need to be joined up.
Sanctions Screening: No Longer Optional
The concentration of mixer-linked funds flowing through NFT platforms, combined with the OFAC designation of Tornado Cash, means that any NFT marketplace or institutional buyer that has not implemented sanctions screening is carrying identifiable regulatory risk. For accounting firms advising these clients, the question is no longer whether sanctions screening is required but how granular it needs to be. Screening wallet addresses at the point of transaction is the baseline; ongoing monitoring of counterparty wallets for subsequent designations is the more demanding standard that regulators are increasingly signalling they expect.
This connects directly to the broader regulatory direction being set at the international level. Our coverage of EU rules targeting terrorist use of digital currencies illustrates how quickly AML obligations for digital asset platforms are evolving across major jurisdictions.
What NFT Platforms Should Be Doing Now
Elliptic's conclusion is pointed: NFT marketplaces need to be proactive on risk management rather than reactive. The reputational damage from even a small number of high-profile money-laundering cases involving NFTs is disproportionate to the underlying statistical frequency, precisely because the narrative of "crypto as a criminal tool" amplifies every incident. For platforms, three operational priorities stand out from the research findings.
Implement Transaction Monitoring with Mixer Detection
Given that the dominant illicit flow into NFT platforms arrives after mixer obfuscation rather than directly from crime wallets, transaction monitoring needs to be configured to flag mixer-tainted funds, not just direct exposure to known illicit addresses. This requires blockchain analytics integration that can trace funds through multiple hops and assign risk scores based on indirect exposure.
Apply KYC to High-Value Transactions
The research period predates many of the Travel Rule and VASP-licensing frameworks now being rolled out across the EU under MiCA, in the UK, and across Asia-Pacific. Platforms that have not yet aligned their KYC thresholds with the applicable VASP regulations in their operating jurisdictions are exposed to both regulatory sanction and the reputational risk the report identifies. For accounting advisers, helping clients map their KYC obligations under the relevant VASP regime is increasingly a core advisory service, not a side note.
Document Valuation Methodology for Every Significant NFT Position
For any client holding NFTs at a value material to their financial statements, auditors and CFOs should insist on documented valuation methodology that accounts for illiquidity, potential wash trading distortion, and the absence of reliable market benchmarks for many collections. Relying on the last sale price without qualification is not defensible for audit purposes.
Frequently Asked Questions
How much money was laundered through NFT platforms according to Elliptic's research?
Elliptic identified just over $8.1 million in illicit funds flowing into NFT platforms between Q4 2017 and Q2 2022. Almost all of this originated from thefts, scams, phishing, and Ponzi schemes rather than proceeds of serious organised crime transferred directly to NFT marketplaces.
Why are mixers the bigger compliance concern for NFT platforms than direct laundering?
Because criminals typically obfuscate funds before bringing them onto a marketplace, not during the NFT trade itself. Elliptic found $137.6 million in mixer-linked funds reaching NFT platforms, dwarfing the $8.1 million in direct illicit inflows. Over half of proceeds from identified NFT scammer wallets passed through Tornado Cash specifically.
What does NFT price opacity mean for auditors and CFOs?
NFTs from illiquid collections lack reliable market benchmarks, making fair value measurement under IFRS and US GAAP genuinely difficult. Auditors need documented valuation methodologies that acknowledge illiquidity discounts and the risk that reported prices have been distorted by wash trading. Simply using the last observed sale price is not sufficient without qualification.
Are NFT platforms required to conduct sanctions screening?
In most major jurisdictions, any platform facilitating the transfer of digital assets is subject to applicable sanctions laws, including obligations to screen against OFAC's SDN list and equivalent lists under EU, UK, and other regimes. The OFAC designation of Tornado Cash means that platforms with identifiable exposure to mixer-tainted funds face direct sanctions risk, not just AML risk.
How should accounting firms classify NFT-related AML risk for client onboarding?
Firms should avoid applying a blanket high-risk label to all NFT exposure and instead tier risk based on the specific NFT type, the marketplace used, KYC standards applied at that marketplace, and any identifiable mixer or sanctioned-address exposure in the client's transaction history. A documented, evidence-based risk assessment is stronger both for regulatory review and for audit file purposes.
Source: Elliptic