What is a money laundering typology?
A typology is a recognised pattern of behaviour associated with money laundering or other financial crime. In traditional financial investigation, typologies include things like structuring cash deposits just below reporting thresholds, rapid movement of funds through multiple accounts, and use of shell companies to obscure beneficial ownership.
Cryptocurrency has its own distinct typologies, many of which are highly visible on the public blockchain. Recognising them during a trace provides both evidential value — demonstrating deliberate intent to conceal — and investigative intelligence about the nature of the operation under scrutiny.
Peel chains
A peel chain is one of the most recognisable and common Bitcoin laundering patterns. It works by sending the bulk of funds forward to a new address while "peeling off" a smaller amount to a separate address at each step. The pattern continues through many iterations, creating a long chain of transactions.
Visually, the pattern looks like a tail unwinding from a spool — hence the name. The technique is designed to make automated chain analysis tools lose track of the primary flow of funds. However, to a trained investigator, peel chains are immediately recognisable and actually make tracing easier — the primary flow is identifiable at each hop.
Peel chains are a strong indicator of deliberate money laundering intent, as they serve no legitimate transactional purpose.
Fan-out (structuring)
Fan-out occurs when funds from a single address are distributed to a large number of recipient addresses simultaneously. This is the cryptocurrency equivalent of structuring — breaking up a large sum into smaller amounts to complicate tracing and potentially evade detection thresholds.
Fan-out is frequently seen in the first stage of laundering, immediately after funds are received from fraud victims. The aggregated victim funds are split across dozens or hundreds of addresses, which are then independently moved forward through the laundering process.
Layering through decentralised exchanges
Decentralised exchanges (DEXs) like Uniswap allow users to swap between cryptocurrencies without any KYC requirements. Laundering operations frequently use DEXs to convert proceeds between currencies — converting Bitcoin to Ethereum, Ethereum to a stablecoin, and so on — in an attempt to complicate tracing and break the investigative chain.
While DEX swaps are visible on the blockchain, they add complexity to a trace and can make it harder to follow a specific sum of money through multiple currency conversions. However, the smart contract interactions leave a clear on-chain record, and the overall flow remains traceable.
Mixing and CoinJoin
Mixing services pool funds from multiple users and redistribute equivalent amounts to new addresses, attempting to break the cryptographic link between input and output. CoinJoin is a Bitcoin-native implementation of this concept where multiple users combine their transactions into a single on-chain transaction.
The use of a mixing service is a significant typological indicator. While it makes tracing harder, it also demonstrates that the wallet's controller was aware of the traceability of their funds and took deliberate steps to conceal their origin — which is itself evidentially significant in criminal and civil proceedings.
Dormant wallet reactivation
Funds are sometimes held in a wallet for months or years before being moved — a strategy designed to allow investigative interest to diminish before the funds are used. A long dormancy period followed by sudden activity is a recognised typological indicator, particularly when the subsequent movement follows other laundering patterns.
Dormant wallet reactivation is particularly common in large-scale fraud operations, where the principals are prepared to wait years for the investigative environment to cool before cashing out proceeds.
Rapid chain-hopping
Chain-hopping involves moving funds rapidly across multiple blockchain networks — Bitcoin to Ethereum, Ethereum to Tron, Tron to Binance Smart Chain — using bridges and cross-chain protocols. This is a relatively recent development in laundering methodology, driven by the growth of the multi-chain DeFi ecosystem.
Chain-hopping significantly complicates tracing because investigators need visibility across multiple blockchains and must understand bridge protocols that transfer assets between them. It is increasingly common in sophisticated laundering operations.
The significance of typological evidence
When a blockchain trace identifies multiple laundering typologies in the same investigation — for example, a peel chain followed by mixer contact, followed by fan-out across multiple exchange deposits — this significantly strengthens the case that the fund movements were deliberate and organised rather than innocent.
Courts and prosecutors are increasingly familiar with these typologies. A well-documented investigation report that clearly identifies and explains each typology present provides powerful supporting evidence for the argument that the defendant knew they were handling criminal proceeds.
| Typology | What it indicates | Tracing difficulty |
|---|---|---|
| Peel chain | Deliberate obfuscation attempt | Low — pattern is recognisable |
| Fan-out | Structuring, distribution of proceeds | Medium — requires following multiple threads |
| DEX layering | Currency conversion to complicate tracing | Medium — visible but adds complexity |
| Mixer use | Active concealment of fund origin | High — intentional trail breaking |
| Dormancy | Waiting out investigative interest | Low — pattern identified by timestamps |
| Chain-hopping | Cross-chain concealment | Very high — requires multi-chain visibility |