In a groundbreaking chapter of its 2026 Crypto Crime Report (released January 27, 2026), Chainalysis revealed that Chinese-language money laundering networks (CMLNs) have become the dominant engine of the global illicit on-chain economy.
Since emerging during the 2020 pandemic, these networks have expanded at an astronomical rate, growing 7,325 times faster than illicit inflows to centralized exchanges. In 2025 alone, CMLNs processed a staggering $16.1 billion in illicit funds—roughly $44 million every single day.
The Ecosystem: Telegram & “Guarantee Platforms”
The shift to Telegram has professionalized money laundering, moving it from the “dark web” into an easily accessible, encrypted social marketplace.
Marketing Hubs: CMLNs operate through massive Telegram channels that act as “guarantee platforms.” These function like an illicit version of eBay or Amazon, where laundering vendors advertise their services to criminals, including “pig butchering” scammers and drug traffickers.
Escrow Services: These platforms provide escrow protection, ensuring that neither the criminal nor the launderer gets cheated during the transaction. This “trust-as-a-service” model has made the underground economy highly resilient.
Stablecoin Dominance: To avoid the volatility of Bitcoin, these networks primarily use Tether (USDT). As Chainalysis experts noted, “If you’re laundering money, the last thing you want is a bad week on Bitcoin to cost you another 10% of your funds.”
The Six Pillars of CMLN Services
Chainalysis identified six distinct “service types” that make up this $16.1 billion ecosystem, each with its own “on-chain fingerprint.”
| Service Type | Role in the Network |
| Guarantee Platforms | The escrow hubs connecting buyers and sellers. |
| “Black U” Services | Focused on laundering USDT (Tether) from high-risk sources. |
| Money Mule Motorcades | Large groups of individuals providing bank accounts to move funds. |
| Informal OTCs | Over-the-counter brokers who swap crypto for local fiat currency. |
| Running Point Brokers | Mid-level coordinators who manage the flow of funds. |
| Money Movement Services | Pure logistics for moving assets across borders undetected. |
Law Enforcement Challenges
The professionalization of these networks presents a “national security threat,” according to Andrew Fierman, Head of National Security Intelligence at Chainalysis.
Encrypted Obstacles: The use of Telegram’s encrypted messaging makes it difficult for authorities to intercept “command and control” communications.
Global Reach: While the language is Chinese, the operations are global. Significant activity has been traced to Southeast Asian scam centers (specifically Cambodia and Myanmar) and even linked to North Korean state-sponsored hackers (DPRK).
Speed of Evolution: CMLNs are highly adaptive, frequently moving funds through 1,799 identified wallets to stay one step ahead of sanctions and freezes.
“This is not opportunistic crime. These are professional, cross-border operations that openly advertise services… operating with a level of sophistication comparable to legitimate financial institutions.” — VinciWorks Analysis, Jan 2026
