Where's My Crypto, Dude? The Ultimate Guide to Crypto Money Laundering

Where's My Crypto, Dude? The Ultimate Guide to Crypto Money Laundering

Speakers: Thomas Roccia

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=1uNneo9L_jU

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Thomas%20Roccia%20%E2%80%93%20Where%27s%20My%20Crypto%2C%20Dude%20The%20Ultimate%20Guide%20to%20Crypto%20Money%20Laundering%20%28and%20How%20to%20Track%20It%29.pdf

Overview

In February 2025, North Korean threat actors stole $1.4 billion from the Bybit cryptocurrency exchange — the largest single theft in the history of cryptocurrency — and then laundered the money with breathtaking speed and sophistication, moving it through thousands of wallets in the space of minutes using a combination of six distinct obfuscation techniques. Thomas Roccia, a threat researcher at Microsoft with 15 years of threat intelligence experience, built a set of tools including an AI agent to follow the money, and used the Bybit case as the foundation for a comprehensive technical breakdown of modern cryptocurrency money laundering methodology.

The talk has two interleaved components: a 101-level technical explanation of each laundering technique with corresponding tracking opportunities, and a demonstration of an AI-powered blockchain analysis agent that Roccia built using the Model Context Protocol (MCP) to automate the investigation workflow. The agent connects to the Etherscan API, a blockchain intelligence platform, and custom detection modules for money laundering pattern identification, stores findings in a Neo4j graph database, and generates HTML investigation reports with transaction flow visualizations.

The practical framing: Bybit has an open bounty for information contributing to the recovery of stolen funds. With the tools and methodology presented in this talk, an analyst could — in theory — contribute to that bounty.

Background

▶ Watch: Case study: the $1.4 billion Bybit theft and North Korean laundering (6:44)

The Bybit Theft

The Bybit theft is technically sophisticated at every stage. The attack chain:

1. Supply chain compromise of Safe Wallet: Bybit used Safe (formerly Gnosis Safe) for its Ethereum cold wallet multi-signature management. One Safe Wallet developer downloaded a compromised Docker project in early February 2025, infecting their development environment.

1. Reconnaissance phase (February 5–17): Over nearly two weeks, the attackers mapped Safe Wallet's AWS infrastructure and identified the web interface used by Safe Wallet clients — specifically the web application that Bybit operators used to manage multi-signature transactions.

1. JavaScript injection (February 20): The attackers injected malicious JavaScript into Safe Wallet's web application. This code was specifically crafted to activate only when a Bybit wallet address connected to the Safe interface — meaning it sat dormant and undetected for any other user.

1. Theft execution (February 21): When Bybit operators connected to perform a legitimate transaction, the injected JavaScript manipulated the web interface to show them a legitimate-looking transaction screen while actually submitting a different transaction. The signers performed a blind signing — approving a transaction whose actual destination they could not verify through the compromised interface. The signed transaction activated a delegatecall to an attacker-controlled smart contract, which executed sweepETH() and sweepERC20() functions, draining approximately 400,000 ETH (worth $1.4–1.5 billion at the time) to attacker-controlled wallets.

Blockchain investigator ZachXBT (a Twitter-based on-chain analyst) was the first public discoverer, noticing the abnormal transaction pattern on-chain. Bybit officially disclosed the breach the following day.

North Korea (DPRK) has been systematically targeting cryptocurrency exchanges and DeFi protocols to fund their state operations, circumventing international financial sanctions. The FBI has attributed the Bybit theft to the Lazarus Group / TraderTraitor cluster.

Key Findings

▶ Watch: Technique 1: blockchain analysis methods - gas patterns and temporal clustering (15:37)

Six-technique laundering framework with tracking countermeasures for each:

1. Immediate asset conversion (token swapping for diversification)
2. Money dispersal (fan-out to many wallets with varying amounts)
3. Cross-chain bridging (Ethereum to Bitcoin conversion)
4. No-KYC exchange usage (converting via unregulated platforms)
5. Mixers and CoinJoin (obfuscating transaction graphs)
6. OTC cash-out (converting to fiat via regional brokers)

AI agent for automated blockchain investigation: A working proof-of-concept AI agent that uses Model Context Protocol (MCP) to orchestrate Etherscan queries, blockchain intelligence lookups, pattern detection, Neo4j graph construction, and HTML report generation — all via natural language prompts from an analyst.

North Korea's laundering preference for Bitcoin: Despite the Bybit theft being denominated in ETH and ERC-20 tokens, DPRK consistently converts to Bitcoin for final custody. Cross-chain bridging tools (Chain Flip, MultiChain, and others) were used to move the value from Ethereum to Bitcoin.

No-KYC exchange temporary overwhelm: DPRK used a no-KYC exchange platform (not named, but identifiable from reporting) that does not require identity verification. The volume of transactions was so large that the platform was temporarily overwhelmed — an unusual operational security failure that left additional attribution evidence.

Tracking opportunities exist at every stage: Despite the sophistication of the laundering, each technique leaves characteristic footprints: timing correlations for scripted transactions, volume patterns for large movements, known mixer/bridge contract addresses, and wallet clustering from previous investigations.

Technical Deep Dive

▶ Watch: Scale: theft so large it temporarily overwhelmed the exchange infrastructure (20:21)

Technique 1: Immediate Asset Conversion

Immediately after the initial theft, the stolen ETH and ERC-20 tokens were converted across multiple token types (ETH, stETH, USDT, and others) via decentralized exchange (DEX) transactions. This serves two obfuscation goals: breaking simple transaction-amount correlation and distributing the value across different asset classes that may have different monitoring coverage.

Tracking opportunities:

• Timing correlation: Scripted bulk transactions execute with near-identical inter-transaction timing. Statistical analysis of transaction timestamps can identify batches of related transactions even when wallet addresses are not directly linked.
• DEX monitoring: Uniswap, SushiSwap, and other DEX protocols record all swaps on-chain. Monitoring DEX volume spikes correlated with known theft wallets can catch conversion attempts.
• Volume pattern analysis: A single entity moving hundreds of millions of dollars through swaps creates anomalous volume patterns.
• Wallet clustering: Once a cluster of attacker-controlled wallets is identified, all subsequent transactions from those wallets can be attributed even as they diversify into new addresses.

Technique 2: Money Dispersal

The initial theft value was distributed first to approximately 50 wallets in tranches of 10,000 ETH each, then further subdivided to create thousands of wallets with smaller amounts. This fan-out pattern creates a wide, shallow transaction tree that is computationally expensive to traverse manually.

Tracking opportunities:

• Token flow analysis: Following the directed graph of ETH transfers from the initial theft wallet through all subsequent hops, even when amounts are split and recombined.
• Gas usage uniformity: Scripted mass transfers use the same gas parameters, creating detectable uniformity in gas prices and gas limits across related transactions.
• Temporal clustering: All dispersal transactions in a single wave execute within a compressed time window.
• Multi-hop analysis: Blockchain analytics tools can perform multi-hop traversal to identify the "taint" of a known theft address propagating through multiple generations of transfers.
• Graph visualization: Neo4j or similar graph databases allow visual inspection of the transaction tree, making patterns visible that are invisible in tabular data.

Technique 3: Cross-Chain Bridging

Converting ETH to BTC requires moving value across different blockchain networks. DPRK used several cross-chain bridge protocols (Chain Flip, MultiChain, and wrapped token approaches) to convert ETH positions to Bitcoin.

Tracking opportunities:

• Bridge inflow/outflow correlation: Cross-chain bridges publish both inflow events (ETH deposited) and outflow events (BTC released). By monitoring bridge smart contracts for inflows from known DPRK-associated addresses, the corresponding BTC output wallets can be identified on the Bitcoin side.
• Known DPRK wallet labels: Prior investigations (ZachXBT, Chainalysis, Elliptic, TRM Labs, and government advisories) have identified and labeled hundreds of DPRK-associated wallet addresses. These labels allow automated flagging when known addresses interact with bridges.
• Token flow pattern matching: The combination of ETH-to-wrapped-token, wrapped-token-to-BTC bridge, and resulting BTC withdrawal amounts creates a detectable signature.

Technique 4: No-KYC Exchange Usage

Know Your Customer (KYC) compliance requirements at regulated exchanges force identity verification for large transactions. DPRK used no-KYC exchange platforms to convert crypto assets without leaving identity trails. In the Bybit case, the volume was apparently large enough to temporarily overwhelm the platform's processing capacity.

Tracking opportunities:

• Deposit wallet flagging: All wallets that deposit to a specific no-KYC exchange are identifiable on-chain. Flagging these deposit addresses creates a heuristic for identifying future movements.
• Outflow Bitcoin monitoring: If DPRK is converting ETH via no-KYC exchanges to BTC, the BTC withdrawal wallets from those exchanges can be correlated to the input ETH amounts.
• Exchange operational indicators: Platform overwhelm events (publicly visible through user complaints, platform status pages, or on-chain congestion at the exchange's contract addresses) create temporal anchors for attribution.

Technique 5: Mixers and CoinJoin

CoinJoin protocols (JoinMarket, Wasabi Wallet, Samourai Whirlpool) merge multiple users' Bitcoin transactions into a single joint transaction, making it difficult to trace which input corresponds to which output. Mixers (Tornado Cash for Ethereum, various Bitcoin tumblers) go further: they pool funds internally and issue new coins from a fresh address, severing the on-chain link between input and output.

Tracking opportunities:

• Heuristic analysis: Statistical methods (common-input-ownership heuristic, change address identification, equal-output detection) can partially de-anonymize CoinJoin transactions. Research has shown that naive CoinJoin implementations leave detectable patterns.
• Known mixer contract/address flagging: Tornado Cash's smart contract addresses are publicly known. Any funds entering or exiting Tornado Cash can be flagged. OFAC has sanctioned specific Tornado Cash addresses, creating legal obligations for exchanges to refuse transactions from mixer outputs.
• Taint analysis: Following the "taint" of funds through mixing operations using probabilistic methods — assigning fractional taint values to outputs proportional to the probability that they received funds from a known-tainted input.
• Pre/post mixer wallet behavior: Behavioral analysis of wallets immediately before sending to a mixer and immediately after receiving from a mixer can identify the same entity even when addresses differ.

Technique 6: OTC Cash-Out

Over-the-counter (OTC) crypto brokers operating in Southeast Asia, Eastern Europe, and Latin America act as informal money service businesses, converting crypto to fiat without the monitoring infrastructure of regulated exchanges. DPRK routes final cash-out through small businesses and OTC brokers in these regions.

Tracking opportunities:

• Regional OTC broker identification: Known broker addresses and OSINT about OTC operations can be used to flag wallets interacting with these entities.
• Known wallet correlation: Published DPRK-associated OTC broker wallet addresses from prior cases allow pattern matching.
• Fiat off-ramp visibility: Once funds exit the blockchain, tracking becomes dependent on traditional financial intelligence (FinCEN, bank SARs, SWIFT monitoring) rather than on-chain analytics — the point of no return for blockchain-only investigators.

AI Agent Architecture

Roccia built his investigation agent using a standard ReAct (Reasoning + Acting) loop:

1. Reasoning: The LLM receives the analyst's natural language query plus all prior context (stored via a context management module) and reasons about which tool to call next.
2. Acting: The LLM selects a tool from the available MCP toolset and provides parameters.
3. Observation: The tool executes and returns results to the LLM's context.
4. Repeat until the task is complete or the analyst asks for a report.

MCP Servers implemented:

• mcp-etherscan: Wraps the Etherscan API to fetch transaction history, token balances, internal transactions, and event logs for any Ethereum address.
• mcp-blockchain-intelligence: Connects to a blockchain intelligence platform (similar to Chainalysis or TRM Labs APIs) to fetch wallet labels, risk scores, and known-entity tags for addresses.
• mcp-money-laundering-detector: Custom module implementing pattern detection heuristics: money dispersal detection (fan-out patterns), gas usage uniformity scoring, temporal clustering analysis, and wallet behavior classification (pre-mixer, post-mixer, exchange deposit, etc.).

Graph database: A Neo4j instance stores all discovered wallet addresses, transaction relationships, and metadata. The agent dynamically updates the graph as it discovers new wallets, enabling visual exploration of the evolving transaction tree.

Report generation: A final MCP tool generates an HTML report with embedded D3.js transaction graph visualization, executive summary, transaction analysis table (transaction type, amounts, counterparties), money laundering indicator assessment, and recommendations.

Limitations of the Proof of Concept

Roccia is explicit about the tool's limitations:

• Context window limits: For a theft of $1.5 billion, the transaction tree is too large to load entirely into an LLM context window. The agent must be guided to specific wallet subsets rather than attempting a global traversal.
• Resource constraints: The Neo4j graph for even a partial analysis of the Bybit tree consumed enough RAM to crash Roccia's machine.
• Cross-chain coverage: The current implementation covers only Ethereum; Bitcoin-side tracking requires a separate toolchain.
• Dormant wallets: Funds that have not moved since the theft are invisible to a "follow the money now" approach; periodic re-analysis is required.
• API rate limits and costs: Etherscan and blockchain intelligence APIs are rate-limited and can be expensive at scale. The cost model for comprehensive blockchain analysis is non-trivial.

Demo / Proof of Concept

▶ Watch: Technique 2: cross-chain bridging and mixer usage to break the trail (24:42)

A live demonstration of the AI agent:

1. Query 1: "Can you investigate this wallet?" (providing the first hop address from the Bybit theft). The agent calls mcp-etherscan, retrieves transaction history, and reports the wallet's activity.

1. Query 2: "Identify the 10 biggest transactions from this wallet." The agent calls the tool, returns the 10 largest outbound transactions with amounts (all ~10,000 ETH — consistent with the initial fan-out to 50 wallets), and timestamps (all within the February 21 theft window).

1. Query 3: "Tell me if these wallets are already known." The agent calls mcp-blockchain-intelligence; since this analysis was run after substantial community investigation, several wallets already carried labels such as "Bybit Exploiter" from prior reporting.

1. Query 4: "Follow the money for the wallet to the five biggest transactions." The agent traverses the next hop and updates the Neo4j graph with the new nodes and edges.

1. Query 5: "Store the top 10 transactions from this wallet into your database." The Neo4j graph is updated visually, showing a growing transaction tree with wallet nodes and ETH transfer edges.

1. Query 6: "Tell me if there are any money laundering patterns in the data." The mcp-money-laundering-detector module returns indicators: "temporal transaction indicator — medium risk of money laundering activity," "volume spike," "mixer usage," "exchange hopping," "advanced placement," with specific wallet references.

1. Query 7: "Write a full report." The agent generates an HTML report with executive summary, D3.js transaction graph, transaction analysis table with type classification, money laundering indicator section, and recommendations.

Defensive Implications

▶ Watch: Demo: Neo4j graph database + AI agent for crypto laundering visualization (33:47)

For cryptocurrency exchanges and DeFi protocols:

• Cold wallet management via web-based multi-signature interfaces is a systemic supply chain risk when the web application can be compromised to display false transaction details. Hardware wallet displays that show the actual transaction parameters (not the web application's rendering) should be mandatory for high-value transactions.
• Blind signing — approving a transaction without verifying its actual parameters on a trusted device — is the single most dangerous practice in institutional crypto custody.
• Safe (the multi-sig platform) has released post-incident mitigations including enhanced transaction verification features; adoption should be prioritized.

For blockchain investigators and law enforcement:

• Each of the six laundering techniques described leaves characteristic on-chain footprints that can be exploited with appropriate tooling. The combination of graph traversal, statistical pattern detection, and known-address labeling is more powerful than any single approach.
• AI-assisted investigation is viable today for structured blockchain queries but is limited by context window size for large theft cases — plan for human-guided, iterative analysis rather than fully automated traversal.
• The Bybit bounty remains open; the methodology presented provides a concrete starting framework for contributing.

Key Takeaways

• The $1.4 billion Bybit theft used a supply-chain attack (compromised Safe Wallet developer → JavaScript injection → blind signing bypass) combined with six layered laundering techniques, making it the most technically sophisticated cryptocurrency theft on record.
• North Korea's cryptocurrency theft and laundering operations are a mature, institutionalized capability with dedicated infrastructure and multi-technique obfuscation that systematically targets the weakest link at each stage.
• Each laundering technique — asset conversion, dispersal, cross-chain bridging, no-KYC exchange, mixing, OTC cash-out — leaves tracking opportunities; combining timing analysis, volume pattern detection, known-address labeling, and graph traversal provides the best chance of following the money.
• A working AI agent using Model Context Protocol can automate blockchain investigation workflows, reducing the time from "here's a wallet address" to "here's a report with transaction graph and laundering indicators" from hours to minutes — though current LLM context limits and API costs constrain full-scale application to the Bybit-sized theft.
• The Bybit bounty demonstrates a market mechanism for incentivizing civilian blockchain investigation; the tools presented provide a viable technical foundation for participation.

About the Speaker(s)

▶ Watch: Scale challenge: billion-dollar transaction graph crashes analysis tools (38:19)

Thomas Roccia is a threat researcher at Microsoft with 15 years of experience in threat intelligence, specializing in AI-assisted investigation and threat analysis workflows. He is the creator of SecurityBreak.io, a security research blog, and has been at the forefront of applying LLM and AI agent technologies to threat intelligence problems. He has been a returning speaker at DEF CON's main stage, with this being his second presentation at the mid-stage event. His work bridges traditional malware analysis, blockchain forensics, and AI-augmented investigation tooling.