Chainalysis: Mining Pools Used for Money Laundering

Cybercriminals are increasingly diverting illicit proceeds to cryptocurrency mining pools to obfuscate the origin of their funds, according to blockchain analysis firm Chainalysis. The company reports that these pools, which typically allow miners to combine resources, are being utilized as de facto mixers by malicious actors to create the illusion that funds come from legitimate mining rather than criminal activity [2].

Key takeaways

• Mining pools combine the computational resources of individual miners to compete with large operations, splitting rewards based on contributed work [1].
• Chainalysis reports that bad actors are using these pools as mixers to hide that funds originate from ransomware or scams [2].
• Since 2018, 372 exchange addresses with heavy mining pool exposure received $158 million from ransomware addresses [2].
• The firm suggests rigorous wallet screening by mining pools and exchanges could solve the problem [2].

How mining pools are exploited for laundering

Mining pools are groups of miners who work together to solve cryptographic problems required by blockchains, a structure created because mining difficulty often became too high for individuals to compete alone [1]. While the primary purpose is to release new cryptocurrency and verify transactions, the process holds appeal for bad actors because it provides a means to acquire money with a clean on-chain original source [3]. Chainalysis notes that in this scenario, the mining pool acts similarly to a mixer, creating the illusion that funds are proceeds from mining rather than from ransomware [2].

Not only ransomware actors but also crypto scammers are using mining pools to launder their funds [2]. The blockchain analysis firm explained that it is possible for ransomware actors to try to pass off their own funds as mining proceeds, even in cases where they are not first moving the funds through a mining pool, by sending them to exchange deposit addresses that receive significant funds from mining pools [2].

Ransomware flows and exchange exposure

Data indicates that tens of millions of dollars’ worth of cryptocurrency have been sent from ransomware addresses to mining pools each quarter over the past year [2]. This flow of funds represents a significant vector for laundering criminal proceeds. Since the start of 2018, 372 specific exchange addresses with heavy exposure to mining pools have received $158 million from ransomware addresses [2]. Chainalysis claims this figure constitutes a large share of the total value sent to all exchanges by all ransomware addresses over that period [2].

Why it matters

This trend highlights a growing challenge for cryptocurrency compliance, as illicit actors seek new methods to bypass traditional detection mechanisms. Chainalysis argues that this is a solvable problem if mining pools and hashing services implement rigorous wallet screening to reject crypto coming from addresses linked to criminal activity [2]. Additionally, the firm suggests that exchanges should more carefully consider the full exposure profile of wallets sending funds to them using publicly available "know your transaction" tools [2].