Privacy coins
How are privacy coins used in money laundering?
Privacy coins are cryptocurrencies built to hide transaction details such as the sender, the receiver or the amount. Launderers convert bitcoin or other traceable coins into a privacy coin such as Monero, move it, then convert back at another exchange, so the public trail breaks in the middle. The break only works if the entry and exit points do not identify the customer.
As of September 2026: The EU ban on regulated platforms keeping accounts that use anonymity-enhancing coins is not yet in force: it applies from July 10, 2027. Exchange listings and national rules on these coins are changing, so check the current rules where you are.
What are privacy coins?
Bitcoin’s ledger is public. Anyone can see which address sent how much to which address. That openness is why blockchain investigators can follow stolen coins across years. A privacy coin is a cryptocurrency designed to take some of that visibility away. Monero is the best-known example: its protocol is built to conceal who is sending, who is receiving, and how much. Others, such as Zcash, let users choose between transparent and shielded transfers.
Regulators call these assets anonymity-enhancing coins. The EU’s Anti-Money Laundering Regulation defines them as crypto-assets with built-in features designed to make transfer information anonymous, either systematically or optionally. A US federal complaint used similar wording: coins that endeavor to provide greater anonymity than bitcoin.
Privacy coins are legal and have legitimate users: people who do not want their financial history published to the world. They matter for this site because they give a layering step that a public ledger cannot easily follow. They sit in the same family as mixers and CoinJoin, which also try to cut the link between where coins came from and where they went.
How do privacy coins work in a laundering chain?
The launderer does not usually live in a privacy coin. It is a passage through the middle.
- Start on a traceable chain. The proceeds arrive as bitcoin, ether, or a stablecoin. On those ledgers, an analyst can see the path from a hack, darknet market or scam to the wallet that holds the funds.
- Convert in. An exchange or swap service turns the traceable coins into a privacy coin. The record of that conversion sits at the exchange or on the public ledger of the original coin, but what happens next inside the privacy coin’s ledger is hard to follow.
- Move. The privacy coin travels between wallets. Its design hides the sender, receiver and amount, so an outside observer cannot draw the same clean lines as on bitcoin.
- Convert out. The funds are exchanged back into bitcoin or another mainstream asset, often at a different exchange, and withdrawn or cashed out.
That in-and-out pattern is a form of chain-hopping. In the Bitfinex case, the IRS-CI affidavit listed conversion of stolen bitcoin into anonymity-enhanced virtual currency as one of the laundering techniques the defendants used. It described two accounts at one exchange that were funded entirely by about 13,200 and about 6,870 Monero over about 31 transactions between late 2017 and 2019, after which the Monero was all converted to bitcoin and withdrawn.
Why do privacy coins work?
They remove the ledger as evidence. Most crypto investigations lean on public blockchain data. When the protocol hides the details, the investigator loses the single best source of evidence and has to look elsewhere.
They split the chain in two. A trace that works fine on bitcoin ends at the entry point, and a fresh trace begins at the exit. The launderer hopes the two cannot be joined. This is the same seam that chain-hopping exploits between blockchains, only sharper.
Liquidity and demand. Enough exchanges, brokers and P2P markets accept them that a launderer can find someone to convert into or out of them. Where the market is thin, criminals depend on venues that do not ask questions, which links this technique to the unlicensed exchange problem described in the related pages.
Regulation is uneven. The EU is moving to bar regulated platforms from keeping accounts that use anonymity-enhancing coins. Article 79 of the AMLR does this and applies from July 10, 2027. Its recitals say the prohibition does not reach providers of hardware and software or self-hosted wallets that have no access to or control over the wallets. Other regions have taken different approaches, and until rules line up, a coin that one jurisdiction restricts can still be bought or sold in another.
They are not proof of wrongdoing. Owning or moving a privacy coin is not a red flag by itself, and many users hold them for ordinary privacy reasons. Compliance teams look at the combination: where the value came from, how quickly it moved, whether the account holder can explain it, and whether the pattern repeats. That is why the signs below are about behavior around the coin, not the coin alone.
Real cases: Bitfinex and FireBunny
Bitfinex. In February 2022 IRS-CI agents filed a complaint against Ilya Lichtenstein and Heather Morgan over the laundering of bitcoin stolen from the Bitfinex exchange in 2016. The affidavit listed a set of techniques: fictitious identities, moving funds in thousands of small transactions, automation, layering through exchanges and darknet markets, chain-hopping into anonymity-enhanced coins, and using US business accounts. For the privacy-coin leg, it described two accounts at one exchange (called VCE 4 in the filing) that were funded entirely by Monero. Each was registered in the name of a Russian national with a Russian email address. When the exchange asked one owner for proof of where the funds came from, the owner said the money was from investments, was asked for a bank or investment statement, and never replied. The exchange froze the account, and it was abandoned with about $155,000 in virtual currency in it. The other account was frozen after its owner also did not respond, but it had already been emptied. The Monero in both had been converted to bitcoin and withdrawn, and the affidavit said bitcoin from one of the accounts went on to accounts owned by Morgan and her company. See the case page for the full outcome.
FireBunny. Manhattan prosecutors described a dark web vendor called FireBunnyUSA that shipped more than 10,000 drug packages between January 2019 and August 2022. Some of the money the leader and others received was laundered by converting Monero into bitcoin, which then entered exchange accounts they controlled. Of the laundered money, more than $734,000 was converted into US dollars through US-based exchange accounts. The operator, Nan Wu, pleaded guilty and was sentenced on October 23, 2025 to at least 6.5 years in state prison, with forfeiture of about 20 bitcoin, 3,297 Monero and $12,857 in cash. Investigators relied on undercover purchases, search warrants and phones recovered from the defendants, as well as tracing of the exchange accounts.
What the two cases share. In both, the privacy coin was one step in a longer chain. The value came in from somewhere traceable and went out to somewhere that kept records. A technique that hides the middle of a path does little for a launderer who still has to explain the ends.
How does it get caught?
At the entry and the exit. The privacy coin’s inner ledger may be opaque, but the conversion points are not. An exchange that converts bitcoin into a privacy coin, or the reverse, holds account records. In Bitfinex, the exit exchange asked ordinary know-your-customer questions and the account owner walked away.
Ordinary investigation. The FireBunny case shows the usual toolkit at work: controlled purchases, search warrants and analysis of phones. Cryptocurrency tracing supported that work; it did not replace it.
Exchange controls. Regulated exchanges can screen for privacy-coin exposure, ask for source-of-funds documents, freeze accounts that fail verification, or decline the coins altogether. Under the EU rule, service providers will not be permitted to hold accounts that allow anonymisation from July 2027.
Travel Rule and standards. The FATF standards for virtual asset service providers, including the Travel Rule, push identity data to accompany transfers between regulated firms. That leaves privacy coins outside regulated channels, where their use draws attention. The FATF’s 2026 targeted update on virtual assets continues to track the risks of stablecoins, peer-to-peer transfers through unhosted wallets and offshore providers.
Patience and links to other techniques. Privacy coins rarely stand alone. They are used with peel chains, mixers and fake identities, and any one of those can leave a trace. The broader lesson runs through the whole detection picture: money has to be spent somewhere.
Frequently asked questions
Are privacy coins illegal?
In most places holding or using them is not illegal. The pressure falls on regulated businesses. Under the EU's AMLR, banks, financial institutions and crypto-asset service providers may not keep anonymous accounts, including crypto accounts that allow anonymisation or that use anonymity-enhancing coins, from July 10, 2027. Other countries and exchanges set their own rules, and platforms can drop these coins for compliance reasons.
What is the difference between a mixer and a privacy coin?
A mixer is a service that pools coins from many users on an otherwise transparent blockchain and pays out equivalent amounts. A privacy coin builds its concealment into the protocol itself. The EU definition covers coins whose anonymising features are on by default or optional, so coins with optional shielded transfers can fall within it.
Can law enforcement trace Monero?
Public statements do not claim it can be traced cleanly. What the cases show is that investigators work around it: they follow the money in and out at exchanges that hold identity records, seize phones and devices, and use search warrants. In the Bitfinex case, exchange accounts fed by Monero were frozen when the owners would not verify who they were.
Why would a launderer use a privacy coin only briefly?
Because they need to spend the money eventually. The point of the privacy leg is to break the public link between two visible stretches of the chain. But the money must come back through a place that converts it to something usable, and that place is where identity checks happen.
Cases that used this technique
- The Bitfinex hack laundering · A married couple spent five years laundering 119,754 bitcoin stolen from the Bitfinex exchange, and the blockchain recorded every move.
Related techniques
- Mixers, tumblers, and CoinJoin · Services that pool many users' coins and pay out equivalent amounts from the pool, breaking the on-chain link between where crypto came from and where it went.
- Chain hopping and cross-chain bridges · Swapping illicit crypto across blockchains through bridges and no-KYC swap services so that no single chain's analytics tell the whole story.
- Peel chains · Splitting a large crypto balance into a long series of transactions, each sending a small amount onward and the rest to a new address, so the trail is slow and tedious to follow.
- Unlicensed exchanges and nested services · Crypto exchanges that skip licensing and identity checks, and small services hidden inside big exchanges, that let criminals convert coins to cash without questions.
- Stablecoins and OTC brokers · Moving illicit value through dollar-pegged stablecoins (above all USDT on Tron) and converting it to cash through over-the-counter brokers and guarantee marketplaces with little or no KYC.
Glossary
Sources
- Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering or terrorist financing (AMLR), Articles 2, 79 and 90 (EUR-Lex, Official Journal of the European Union, May 31, 2024).
- United States v. Ilya Lichtenstein and Heather Morgan, Statement of Facts in support of complaint and arrest warrant (Case 1:22-mj-00022) (US Department of Justice / US District Court for the District of Columbia, February 7, 2022).
- D.A. Bragg Announces Guilty Pleas In Dark Web Cryptocurrency Drug Trafficking Ring That Laundered $7.2 Million (Manhattan District Attorney's Office, October 23, 2025).
- Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs (Financial Action Task Force, July 2026).