A crown jewel for crypto money laundering is emerging, but no one is paying attention

Using a mining pool to clean “dirty” crypto is one of the least popular methods for dark-net-market vendors, according to data from blockchain intelligence firm Chainalysis, but it might be one of the most effective for professional crypto launderers. 

In a confidential May 2019 compliance report authored by Chainalysis competitor Elliptic and obtained exclusively by The Block, the blockchain forensics firm identified professional crypto laundering as a growing threat. As such, some experts believe mining pools may offer these sophisticated adversaries the most undetectable method for laundering crypto assets of illicit origin.

For law enforcement, understanding obscure and emerging crypto-laundering schemes like mining pools is becoming a priority, as organized criminal groups capable of leveraging vast economies of scale seek out new ways to evade financial surveillance. 

Speaking broadly about crypto money laundering, the Drug Enforcement Administration’s (DEA) acting financial investigations section chief, David Olesky, told The Block that Latin American drug cartels are becoming “increasingly comfortable” using crypto to transfer large sums of money around the world.

Olesky said the cartels’ illicit cryptocurrency flows dwarf the value of digital assets exchanged by DNM vendors. This is significant, considering that a June 2019 Chainalysis webinar pegged year-to-date crypto-spending on DNMs at $515 million. 

While Olesky did not speak specifically about mining pools in cartel crypto laundering, a highly respected blockchain engineer, who spoke to The Block on the condition of anonymity, said mining pools don’t “have any law enforcement mechanics or any kind of real risk-mitigation techniques because the proceeds look exactly the same as with the creation of normal transactions.”

How it Works

Mining-pool laundering entails the collusion of criminals and miners. The key to this laundering technique is the transfer of illicit funds via custom transaction fees paid to the miner, who then wires laundered funds back to the criminal after confirming the transaction and taking their cut of the inflated fees. This scheme generally requires the use of virtual currency wallets like Mycelium, Ledger Nano S, Trezor or Coinomi, for example, which allow users to customize their transaction fees.

If miner-launderers want to operate more inconspicuously, they could make arrangements with their criminal clients to structure the rinse into multiple transfers with numerous, smaller transaction fees, confirming those payments and including them into their blocks. On the bitcoin network, blocks are generally one megabyte in size and contain a batch of over 500 transactions.

In some instances, the miner could be acting alone to launder their own funds, setting high transaction fees and ensuring that their laundering trades go straight into their own block templates for confirmation. This scheme is enabled by bitcoin’s free-market cryptoeconomic model, which gives miners complete discretion over the transactions they want to confirm, with higher-fee transfers offering block creators obvious monetary incentive to process them first.  

But for money laundering purposes, it doesn’t make sense for criminals to release their transactions “into the wild,” as they would with a normal payment, where there is a chance that an unaffiliated miner could capture the transaction fee, according to the engineer.

Instead, the engineer said it’s more logical for criminals to hand the unconfirmed transaction to their miner associates in some “offline or peer-to-peer method, where it’s not getting broadcast to the bitcoin network,” the person said.

“It’s just getting handed to the miner and the miner attempts to build it into a block. If he’s successful, the fees are paid to him and him only, and he reimburses the criminal from those fees in legitimate money.”

The Mempool Paradox

Furthermore, unlike normal cryptocurrency transactions, which are publicly broadcast across the blockchain as soon as the payment is sent, proprietary mining pools enable miners to limit the publishing of those transfers to their own local memory pools (mempool). This means transactions can remain completely concealed from the network until they are confirmed and added to a block.  

According to an explainer published by Coin Bureau, the mempool is a holding area for unconfirmed transactions awaiting verification by miners. However, because this database is not part of the blockchain ledger, there is no central mempool repository. Instead, each bitcoin node, or computer running bitcoin mining software, has its own mempool with its own memory capacity. 

Thus, the bitcoin network’s proof-of-work mechanism design inherently enables miner-launderers to keep illicit unconfirmed transactions concealed from other bitcoin network nodes, according to the engineer.

The engineer also said that “the slightly more efficient version of this money laundering is to only broadcast the money laundering transaction and incorporate it in just the miner’s block. In the end, the money has no taint anymore because it’s new money. It’s literally recreated.”

A Costly Attack  

Still, this isn't a scheme that can be carried out by the average crypto Joe, as it requires high-powered mining capacity. 

“It’s an extremely costly attack. You either need to coordinate with a pool or coordinate with a miner. Any meaningful percentage of hash power makes it possible, it’s just the coordination costs for it are high,” he added. Of course, these mining costs are directly proportional to the price of electricity and mining technology at any given time. 

Blockchain sleuth Kim Nilsson, widely credited for helping solve the infamous Mt. Gox bitcoin theft, and who identified mining-transaction fees as a laundering vehicle exploited by Mt. Gox hackers, agreed with the engineer about the relative difficulty of cleaning dirty crypto this way. 

“In practice this is awkward and inefficient; for one, if you have enough hash power to reliably mine blocks you could be collecting other people's transaction fees rather than your own,” said Nilsson.

A New Indicator for Suspicious Activity Reporting in Crypto Transactions? 

According to Pawel Kuskowski, CEO of Coinfirm, a blockchain anti-money-laundering (AML) service that has unique expertise in the risks posed by mining pools, “the transfer of large percentage of funds to miners is an anomaly, with third parties generating unusual profits from transactions between peers. This behavior should be flagged and monitored under AML regulations as a suspicious transaction.”

The Coinfirm team generated a sample AML Risk Enhanced Report for The Block to demonstrate how they flag suspicious transactions involving miners. In the report below, Coinfirm flagged one ethereum (ETH) address as high-risk because it transferred 96 percent of all funds to miners in the form of transaction fees.

“Considering that many of the companies in blockchain analytics wouldn’t catch this type of transfer and flag it,” said Kuskowski, “adversaries are aware of this and may be taking advantage of that loophole in other providers to try and hide the real beneficiary of the transaction.”

Coinfirm provided The Block with various examples of mining transactions that their forensics tool marked as suspicious, including a Litecoin payment that passed over 200 LTC to miners and three Dash transactions that generated over 500 DASH in mining fees.

Coinfirm chief marketing officer Grant Blaisdell said that mining pools are not that significant as “a percentage of overall laundering,” but still facilitate tens of millions of dollars in illicit crypto transactions per year.

Other Illicit Mining Schemes

Beyond the dark web, crypto-exchange hacks and more professional laundering use-cases, Itsik Levy, CEO of Israeli blockchain intelligence firm Whitestream, highlighted the use of mining pools in ransomware cash-out schemes. “There are a lot of cases where miners sell fresh coins in exchange for dirty ransomware coins,” he said.

Levy pointed to one high-profile ransomware case, the attack on the Davidson County government in North Carolina, where he believes a significant amount of hacking funds were passed to miners via transaction fees generated by 66 different payments. 

In addition to the ransomware typologies cited by Levy, some users on Dread, a Reddit-like forum for DNM users, have highlighted mining-pool laundering schemes involving Ethereum (ETH).

One Dread user posting as “Hushmoney” responded to a thread on the site’s “Laundromat” sub-Dread last week, advising an aspiring crypto-launderer to rent ETH mining rigs on “MRR” (miningrigrentals.com). Hushmoney advised the user who started the thread to mine only on Ethermine.org because its customer identification processes are virtually non-existent.

Similar to this Dread-promoted scheme,  the confidential Elliptic report said that large-scale crypto-launderers may even conceal their criminal proceeds by “using illicit funds to buy mining equipment that can be used to obtain newly minted cryptocurrencies.” 

The Macro View

Dovetailing with growing mining-pool laundering concerns, the Elliptic report cautioned that hostile nation-states are beginning to experiment with “cryptocurrency mining to generate newly minted coins that do not have a tainted history.” 

The Elliptic report highlighted South Korean intelligence assessments about North Korea’s “difficult to detect” crypto-mining capabilities, as well as how bitcoin mining helped Russia fund the hack of the 2016 U.S. presidential election.

In light of emerging mining-pool risks, Chainalysis’ chief strategy officer Jonathan Levin told The Block through a company spokesperson, “investigators are aware of incidences of money laundering through mining” and that “many members of the cryptocurrency community believe that any investigation into illicit activity – related to mining or otherwise – will lead to the labeling of clean and dirty coins. In reality, analysis is based on greater context, including intents, actions, and outcomes.”

Additionally, Shaun MaGruder, the founder of crypto-forensics firm Blocktrace, said “laundering bitcoins by paying excessively high transaction fees through cooperative mining pools provides a unique opportunity to clean dirty funds, however it’s not overly difficult to identify participants who engage in this type of activity.”

Meanwhile, Nilsson conceded that “forensic analysts don't tend to look too closely at fees, and the ephemeral nature of the mempool makes it hard to know for sure whether a transaction was broadcast normally or passed secretly to the miner.”

“It could be going on to some degree, but for the time being there are better ways to launder funds,” said Nilsson.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.