Dirty Crypto: How To Check If Your Funds Are Clean

Dirty crypto refers to funds whose transaction history is linked to illicit or high-risk activity. According to the Chainalysis Crypto Crime Report 2026, illicit cryptocurrency addresses received at least $154 billion in 2025, up 162% from the previous year. Stablecoins accounted for 84% of that volume: criminals use them for many of the same reasons as everyone else — fast transfers, low fees, and limited price volatility.

Illicit activity still represents less than 1% of overall crypto transaction volume. For regular users, however, the problem is not the percentage itself. Risky funds move through exchangers, P2P trades, and exchanges, and they can eventually reach a wallet whose owner had nothing to do with the original activity. You can receive high-risk crypto in an otherwise ordinary transaction — for example, as payment for goods, repayment of a debt, or USDT purchased through a service with weak AML controls.

In this guide, we explain what dirty crypto means, how AML services assess the origin of funds, how to check a wallet address or a specific transaction before sending funds to an exchange, and what to do if coins with a risky history have already reached your wallet.

What is dirty crypto?

The term usually describes cryptocurrency that is directly or indirectly linked to illicit activity, including theft, darknet markets, fraud, money laundering, sanctioned services, or terrorist financing. The token itself is technically no different from any other token; what matters is its transaction history.

Public blockchains preserve transaction history, while analytics companies label addresses and clusters associated with exchanges, mixers, darknet services, stolen funds, and other categories. If coins have passed through a known high-risk source, that connection may still be visible several transfers later. In compliance terminology, this is known as indirect exposure.

Common high-risk sources include:

These categories are only a general guide: different AML platforms and exchanges apply their own risk models. A critical label such as sanctions exposure or stolen funds can matter more than the overall risk percentage, while a licensed service and an illegal platform may receive very different classifications even if both fall under a broad category such as gambling.

How big is the problem? Cases from 2025–2026

The scale becomes easier to understand through a few concrete examples:

• Bybit hack, February 2025. Lazarus Group, which is linked to North Korea, stole roughly $1.5 billion in ETH. The funds then moved through numerous addresses, cross-chain bridges, and other services. Across 2025, DPRK-linked hackers stole more than $2 billion in cryptocurrency.
• Scams and fraud — about $17 billion. Fake investment platforms, pig-butchering operations, and romance scams increasingly function as organized businesses. Stablecoins taken from victims move through large networks of addresses, P2P venues, and exchangers before some of that liquidity returns to the wider market.
• Ransomware — more than $820 million. Addresses controlled by ransomware operators are often identified quickly by blockchain analytics firms, so even indirect exposure to those funds can materially affect a risk assessment.

For an ordinary user, the important point is not the headline size of these crimes. Stolen or fraudulently obtained assets eventually have to be moved, exchanged, or spent. As a result, high-risk coins can pass through the same channels that legitimate users rely on every day.

How dirty crypto can reach a regular user

The most common scenarios are straightforward:

• P2P trades. You sell crypto or goods to someone you do not know and receive coins that were previously linked to theft or fraud. The payer may not know their history either. We cover counterparty checks and other P2P risks in more detail in our guide to withdrawing crypto to a card through Binance, OKX, and Bybit.
• Exchangers with weak AML controls. If a service does not screen incoming funds properly, high-risk coins can be passed on to the next customer as part of an otherwise routine payout.
• Debt repayments and transfers from people you know. Someone may have received coins from a risky source earlier and forwarded them to you without realizing there was an issue.
• Payments from questionable projects. Illegal casinos, Ponzi schemes, and fraudulent investment projects may mix funds from many users in the same payment flows.
• Unexpected incoming transfers. Small amounts are sometimes sent to large numbers of addresses as part of dusting attacks or other schemes. An unsolicited transfer does not automatically make an entire wallet “dirty,” but you should check its origin before moving it further. Unknown tokens and NFTs can also be part of phishing campaigns; our guide to avoiding crypto scams explains how these schemes work.

Stablecoins introduce another risk: the issuer can freeze tokens directly at the address level. According to Tether, by April 2026 the company had helped freeze more than $4.4 billion in assets across over 2,300 cases and had worked with law-enforcement agencies in 65 countries. A self-custody wallet does not bypass such a freeze: the tokens remain visible at the address, but they cannot be transferred.

Who decides whether funds are “clean”? How AML analytics works

The origin of funds is analyzed by specialist companies and services such as Chainalysis, Elliptic, Crystal, Scorechain, and AMLBot. They combine labels for known addresses with clustering of related wallets to estimate which services or risk categories funds have interacted with.

Exchanges and payment platforms can integrate these tools through APIs and screen incoming transactions before a deposit is fully credited. Depending on the platform, the model may consider direct and indirect exposure, the type of source, how recent the connection is, the amount involved, and other factors.

Consumer-facing AML checkers often summarize the result as a Risk Score — an overall percentage accompanied by a breakdown of the underlying categories. In practice, that breakdown is usually more useful than the headline number alone.

These thresholds are not an industry-wide standard. Each provider uses its own model, and a critical label — such as direct sanctions exposure or stolen funds — can outweigh a relatively low overall percentage.

How to check whether your crypto is clean

For a basic check, you only need a wallet address or the TXID of a specific transaction. The process is simple:

1. Choose what you want to check. An address shows the broader profile of a wallet, while a TXID helps you analyze a specific transfer. Before a trade, it makes sense to check the counterparty’s address; after receiving a payment, check the transaction itself.
2. Run the check through an AML service. Many consumer tools work through a website or Telegram bot and support BTC, ETH, USDT, and other popular assets.
3. Read the source breakdown, not just the percentage. A low overall score with a critical label can be more concerning than a higher score made up mostly of ordinary exchange or P2P exposure.
4. For a significant amount, compare results from two services. Their databases differ, so one checker cannot tell you exactly how a particular exchange will classify the same transaction.
5. Save the report or a dated screenshot. It does not guarantee that an exchange will accept the funds, but it can help show that you screened the counterparty or transaction before a dispute arose.

It is better to check before a transaction than after it. If a counterparty is willing to provide an address in advance, a quick AML check can reveal obvious high-risk labels before the funds reach your wallet. The same principle applies before sending a significant amount to an unfamiliar address.

What to do if you receive dirty crypto

Your first steps depend on where the funds are:

If an exchange places a deposit under compliance review, it mainly wants to know where the funds came from and why they were sent to you. Useful evidence may include screenshots of your agreement with the counterparty, their contact details, invoices or receipts, your wallet transaction history, and the AML report you saved at the time. The more consistently those records explain the transaction, the fewer gaps the compliance team has to resolve.

Answer the questions directly and do not invent details you cannot support. Review times vary by exchange, amount, risk category, and the quality of the documentation. If the platform refuses to release the funds and the amount is material to you, the next steps are best discussed with a lawyer who can account for the exchange’s jurisdiction and the circumstances of the transaction.

Several actions usually make the situation worse:

• Do not route the funds through a mixer. It does not erase the earlier history, but it adds another high-risk connection and can make the source of funds harder to explain.
• Do not split the amount into dozens of transfers to avoid screening. Analytics systems may interpret that pattern as an attempt to make the movement of funds harder to trace.
• Do not mix questionable funds with your main balance unless necessary. Doing so makes later transaction analysis and documentation more complicated.
• Do not pass risky coins to someone else while hiding their history. That only transfers the problem to a new recipient and can make your own position worse.
• Do not ignore an exchange’s requests. Failing to respond can delay the review, lead to a refusal, or result in further escalation.

Can you “clean” dirty crypto?

If by “cleaning” you mean erasing the history of where the funds came from, there is no technically reliable way to do that. Mixers, cross-chain bridges, swaps between networks, and long chains of intermediary addresses do not remove earlier transactions from the analytical graph; modern analytics systems attempt to connect those movements across services and networks.

Accidentally receiving risky coins and deliberately trying to conceal their origin can have very different consequences. The safer approach is therefore to document how you received the funds, avoid adding unnecessary transactions, and resolve the issue through the exchange’s compliance team or a lawyer when the situation calls for it.

Prevention: how to reduce the risk

• Check the counterparty before a significant transaction. Pay particular attention to critical labels such as sanctions, stolen funds, darknet exposure, or other categories your exchange may consider unacceptable.
• Use services with AML/KYC procedures. This does not eliminate the risk, but it reduces the chance of receiving assets with an obviously problematic history.
• Keep records of P2P and OTC transactions. Screenshots of agreements, counterparty details, invoices, and payment information can make a later review much easier.
• Use separate receiving addresses for new counterparties when your wallet supports it. This makes it easier to trace the source of individual payments and avoids combining unrelated flows unnecessarily.
• For large OTC trades, agree on AML criteria in advance. The parties can define acceptable risk categories and the screening method before settlement takes place.
• Before making a large exchange deposit, check your address or transaction again. Analytics databases change over time, so a result from several months ago may no longer be the result you receive today.

Why AML checks are becoming more common

Crypto services increasingly exchange information about senders and recipients under the Travel Rule. According to FATF, 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule by 2026, so these checks are becoming a routine part of compliance at regulated platforms.

In the EU, the AMLR will apply from July 10, 2027, tightening requirements for crypto service providers, including rules around anonymous accounts, anonymity-enhancing assets, and transactions involving self-hosted addresses. For users, the direction is clear: the source of funds will be scrutinized more often, making transaction records and basic AML screening increasingly useful when dealing with significant amounts.

Conclusion

Dirty crypto is ultimately about the history of funds and how that history is interpreted by exchanges and blockchain analytics providers. Even a legitimate user can receive coins with unwanted exposure through a P2P trade, an exchanger, a debt repayment, or an ordinary payment.

The best protection is to screen significant transfers before a transaction, keep supporting records, and avoid mixing suspicious funds into your main balance unless necessary. If a deposit is already under compliance review, trying to “clean” its history is not the answer. Clear documentation, a consistent explanation of the source of funds, and — when the amount or circumstances justify it — advice from a qualified lawyer are far more useful.