Follow the Money · 12 — The Cash-Out: The Exchange Built for Criminals

Follow the Money — Case 12. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Eleven cases in, a pattern has become impossible to miss: no matter how the money is stolen, laundered, mixed, or hopped across chains, it all needs the same thing at the end. Crypto is not groceries. A ransomware crew, a scam network, a darknet operator — none of them can pay rent or buy a car with a wallet balance. At some point the illicit cryptocurrency has to become spendable money: fiat, in a bank account or a stack of cash. That final step is the cash-out, and this case is about the machine that performs it for criminals — the deliberately non-compliant exchange whose entire business model is turning dirty crypto into clean money while looking the other way.

These are sometimes called bulletproof exchanges, by analogy to the bulletproof hosting that shields criminal websites, and their defining feature is not a technology but an attitude: they do not ask who you are, where the coins came from, or what you did to get them. FinCEN's ransomware advisory describes the type in dry officialese — criminals cash out through exchanges with lax compliance controls, operating in jurisdictions with little regulatory oversight that do not share information with other countries. Strip the officialese and it says: there are exchanges that exist to launder, and their weak identity checks are not a flaw they are struggling to fix. They are the product.

This is the letter about the last mile, and the disposition is CONVERTED — the point where illicit value stops being cryptocurrency and becomes usable cash. But it is also the letter about a strategic discovery the state has made: that because every criminal in this register needs the cash-out, the cash-out is where they are all most exposed — a chokepoint the government has learned to strike by sanctioning and seizing the exchanges themselves.

1. The Last Mile: why the cash-out is unavoidable

Start with why this stage cannot be skipped, because its unavoidability is the whole strategic insight of the case. Every technique the register has documented — the mixer, the bridge, the chain-hop, the nested laundering chain — is about obscuring the origin of illicit crypto. None of them produces spendable money. At the end of the most sophisticated laundering pipeline, the criminal still holds cryptocurrency, and cryptocurrency, for most real-world purposes, is not yet money. To buy a house, pay a supplier, bribe an official, or simply live, the value must cross the boundary from the crypto economy into the fiat economy. That crossing is the cash-out, and it is the one step no launderer can engineer away, because the goal of the entire exercise is spendable wealth.

FinCEN's financial-trend analysis lists cashing out at centralized exchanges as one of the standard ransomware money-laundering typologies, sitting right alongside anonymity-enhanced coins, chain-hopping, and mixers. That placement is telling: the cash-out is not an alternative to the other techniques but their necessary terminus. You mix and hop and swap to obscure the trail, and then you cash out to enjoy the money. And the cash-out demands an exchange — a service that will accept your crypto and give you fiat — which means it demands a counterparty who is willing to take crypto that may be dirty and turn it into money that is clean. For a compliant exchange, that willingness is exactly what its know-your-customer and anti-money-laundering controls are designed to withhold. So the criminal needs a non-compliant one.

This is why the bulletproof exchange exists, and why it is such a lucrative business. It sells the one service the entire illicit crypto economy cannot function without: conversion without questions. Where a legitimate exchange screens deposits, files suspicious-activity reports, and freezes tainted funds, the bulletproof exchange does none of it — and charges a premium for the privilege, taking its cut of flows that no honest platform would touch. The register frames the disposition as CONVERTED precisely here: this is the machine that changes the money's form, from crypto to cash, and it is the last thing that happens to the money before it disappears into the ordinary economy as clean-looking wealth.

2. The Business of Looking Away

It is worth being precise about what these exchanges are selling, because the popular framing — 'an exchange with bad compliance' — misunderstands the crime. A struggling startup with weak controls is a compliance problem. A bulletproof exchange is a business decision. The absence of identity checks is not a deficiency these operators are working to remedy; it is the value proposition they market, implicitly or explicitly, to a criminal clientele that chooses them precisely because they will not ask.

The tell is in the numbers, whenever investigators can see them. When OFAC and blockchain analysts examined Suex, the exchange that became the first cryptocurrency exchange OFAC ever sanctioned, the finding was not that a few bad transactions had slipped through an honest filter; it was that a large share of the exchange's known activity traced to illicit or high-risk sources. An exchange where most of the money is dirty is not failing to keep criminals out. It is a criminal utility with a thin veneer of legitimate activity, if that. The same shape recurs across the archetypes: an exchange whose customer base is, to a striking degree, the very actors every compliance regime is built to exclude.

This reframes the moral question, and the register states it plainly. The operators of a bulletproof exchange are not negligent; they are participants. They know — the composition of their own flows tells them — that they are converting the proceeds of ransomware, fraud, and drug sales into usable cash, and they do it anyway, for a fee, because that is the enterprise. The weak KYC is not a bug in an otherwise-legitimate business; it is the business. And that is what makes the cash-out exchange a legitimate target for the kind of enforcement usually reserved for the criminals themselves — because the exchange is not an unwitting conduit but a knowing, paid partner in the conversion, the indispensable last link that lets every upstream crime finally pay off.

3. The Roll Call of the Sanctioned

The record here is a sequence of enforcement firsts, and walking through it shows both the strategy maturing and the displacement dynamic that limits it. The archetypes are on the sanctions and prosecution rolls, and each marks a step in the state's learning.

BTC-e is the ancestor. Europol's tracing report references the 2017 US case in which a Russian national and the widely-used exchange BTC-e were charged in a 21-count indictment, alleged to have laundered vast sums — including proceeds tied to major thefts — while operating with minimal identity controls. BTC-e predates the modern sanctions wave and shows the phenomenon in its early form: a large, popular exchange functioning, in practice, as a criminal cash-out utility, pursued through ordinary prosecution.

Suex is the turning point. In September 2021, OFAC designated Suex — the first time it had ever sanctioned a cryptocurrency exchange itself, for facilitating transactions for ransomware actors. That was a strategic innovation: instead of only chasing the criminals who used the exchange, the state sanctioned the exchange they all depended on, cutting it off from the legitimate financial system. Garantex followed in 2022, a Russia-connected exchange designated for processing illicit transactions for ransomware operators and darknet markets — and, on public analysis, a venue that absorbed cash-out flows displaced by the April 2022 takedown of the Hydra darknet market from Case 08. Then Bitzlato, in January 2023, showed the model extending from sanctions to physical takedown: a coordinated US-French action disrupted the platform and arrested its founder, with authorities calling it a haven for illicit funds that enforced no meaningful controls.

Read as a sequence, the roll call tells two stories at once. The first is capability: the state moved from prosecuting an exchange (BTC-e) to sanctioning one (Suex) to seizing one and arresting its founder (Bitzlato) — a steadily sharpening toolkit aimed at the cash-out node. The second is futility's shadow: Garantex rose partly because Hydra fell, which means each success created the demand its successor met. The state is getting better at killing cash-out nodes, and the cash-out nodes keep reappearing, because the thing driving them — the criminals' unavoidable need to convert — does not go away when one exchange does.

4. Nesting and Concentration: why the chokepoint works at all

For the strike-the-cash-out strategy to work, the illicit flows have to be findable and concentrated, and two structural facts about the cash-out layer are what make the chokepoint a real chokepoint rather than a needle in a haystack. Understanding them explains why the state can hit this layer effectively even though crypto is global and pseudonymous.

The first is concentration. Blockchain analysis has repeatedly found that a disproportionate share of illicit crypto flows cash out through a small number of high-risk exchanges and even a small number of deposit addresses. The criminal economy does not spread its cash-out evenly across thousands of venues; it funnels, because the criminals need exchanges that will take dirty money, and there are only so many willing to. That funneling is the strategy's gift: the very scarcity of no-questions-asked cash-out means that designating a handful of the biggest offenders disrupts a large fraction of the total illicit conversion. The second is nesting. 'Nested' exchanges operate on top of a larger, legitimate exchange's infrastructure — using the big platform's liquidity and accounts while offering their own laxer sign-up — so that illicit flows can ride inside a legitimate-looking host. Nesting complicates the picture, because the dirty money is traveling through a compliant platform's rails, but it also creates leverage: pressure on the large host to police its nested services can flush out the bad actors riding on it.

Together, concentration and nesting explain why the cash-out layer is the register's clearest example of a place where the state can genuinely act. Most of this series has documented techniques that scatter, hide, and disperse — the mixer that severs the link, the bridge that fractures the trail. The cash-out reverses that dispersal: after all the scattering, the money has to re-converge on a willing exchange to become cash, and that re-convergence is a chokepoint. The launderer's whole pipeline is designed to make the money hard to follow; the cash-out is the one point where it has to stop being hard to reach, because the criminal needs a specific, real counterparty to hand them fiat. That is why, after a decade of losing the tracing war in the middle of the pipeline, the state found its footing at the end of it.

5. The Honest Limit: displacement and the haven

The register will not oversell the chokepoint, because the cash-out strategy has a hard limit, and it is the same limit that shadowed the darknet takedowns in Case 08: you can destroy the node, but you cannot destroy the demand, and the demand rebuilds the node somewhere you cannot reach. Naming that limit honestly is what keeps this case from being a victory lap.

The limit has two parts. The first is displacement: because the driver is the criminals' unavoidable need to convert, sanctioning one cash-out exchange does not reduce the need — it relocates it. Garantex absorbing Hydra's flows is the pattern in miniature; take down the integrated cash-out of one platform and the demand reconstitutes at the next willing exchange. The second, deeper part is jurisdiction. The 2024 NMLRA states plainly that ransomware frequently stems from jurisdictions with elevated sanctions risk, that Russia is a haven for ransomware actors, and that FinCEN linked roughly 75 percent of ransomware-related incidents in the second half of 2021 to Russia, its proxies, or persons acting on its behalf. When the exchanges and their operators sit in a state that will not cooperate, arrest is off the table, and even sanctions have limits: a designation cuts the exchange off from the US financial system and warns compliant institutions away, which is real and costly, but it does not shut down an operation whose customers and correspondent relationships live in the same non-cooperating jurisdiction.

So the honest picture is a chokepoint that is genuinely effective and genuinely porous at once. Effective, because concentration means designating the biggest cash-out nodes disrupts a large share of illicit conversion, raises costs, severs access to clean banking, and — where jurisdiction allows — enables arrests and seizures. Porous, because a haven can host a successor beyond reach, and the unkillable demand ensures a successor will appear. The register holds both. The cash-out is the best chokepoint the state has found in the whole illicit-crypto economy, and it is not a kill switch — it is a tax and a disruption and, in cooperating jurisdictions, a genuine takedown, applied over and over to a layer that keeps regenerating because the crime upstream keeps producing crypto that has to become cash.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that its 'chokepoint' optimism overstates a strategy that mostly just plays whack-a-mole with Russian exchanges, and it deserves a fair hearing.

The argument runs like this. Sanctioning Suex, Garantex, and the rest is theater with limited real effect, because the operators sit in Russia, keep running, and simply lose some access to Western banking they may not have needed much; the flows displaced to a successor within months, so the 'chokepoint the state has learned to strike' is a chokepoint that reforms behind the strike every time. Worse, the argument continues, the framing risks tarring the whole exchange industry: the line between a 'bulletproof exchange' and a merely under-resourced one is blurrier than the register admits, and aggressive designation can sweep in exchanges that are trying, chilling legitimate businesses and pushing users toward truly unregulated venues. And leaning on concentration statistics, the objection concludes, ignores that illicit flows are a small fraction of total crypto volume, so 'the criminals all funnel through a few exchanges' overstates how neatly the bad actors separate from the good.

The register grants the force of all of it and holds its ground. Yes, the strategy is porous and displacement is real — Section 5 exists to say exactly that, calling the cash-out a tax and a disruption rather than a kill switch and naming the haven jurisdiction as the hard limit; nothing here claims the sanctions end the conversion. Yes, the good-versus-bad-exchange line can blur, which is why the register is careful to define the bulletproof exchange by the composition of its flows and the operators' knowledge — an exchange where most of the money is demonstrably dirty is not an under-resourced startup, and the distinction matters precisely so that enforcement targets the knowing participant, not the struggling one. And yes, illicit flows are a minority of total volume — but the point was never that most crypto is criminal; it is that the criminal minority, which must convert, funnels through a narrow enough set of willing venues that hitting them disrupts a disproportionate share of illicit conversion, which the concentration analysis supports. What the register will not concede is that the chokepoint is therefore illusory. After a decade of the state losing the tracing war in the middle of the laundering pipeline, the cash-out is the one place it reliably wins ground — imperfectly, repeatedly, against a regenerating target — and naming it as the strategic chokepoint is not optimism. It is the honest observation that the criminals' unavoidable need to convert is also their unavoidable exposure.

7. Disposition — CONVERTED

Case 12 followed the money to the end of every laundering pipeline in this register — the moment when illicit cryptocurrency finally has to become spendable cash, and the machine that performs that conversion for criminals: the bulletproof exchange, whose product is looking away, whose customers are the actors every compliance regime exists to exclude, and whose weak KYC is not a failure but the whole enterprise. Suex, Garantex, Bitzlato, BTC-e — the roll call of the sanctioned and the seized — are all the same business: conversion without questions, for a fee.

The disposition — the money's fate — is CONVERTED. Not laundered-in-transit, not frozen, not vanished, but changed in form: crypto into fiat, the last mile where illicit value stops being a wallet balance and becomes clean-looking money in the ordinary economy. This is the step the mixer and the bridge and the chain-hop all serve, and it is the step none of them can replace, because the goal of laundering is spendable wealth and only the cash-out delivers it. The exchange is the machine that delivers it, and that is why the register marks the money CONVERTED at the moment it crosses the counter.

Hold the strategic truth this case exists to deliver. Because every crime in this series needs the cash-out, the cash-out is where they are all most exposed — and after years of losing the tracing war in the tangled middle of the pipeline, the state found its footing at the end of it, learning to sanction and seize the exchange itself rather than only the criminals who use it. It is the best chokepoint in the whole illicit economy, and it is not a kill switch: the operators shelter in havens, the demand is unkillable, and each downed node grows a successor, so the strike is a tax and a disruption applied forever to a layer that keeps regenerating. The honeypot beneath these words watches attackers who will, eventually, need to spend what they take; the cash-out exchange is where they must go to do it. The vectors do not lie: the crypto came in dirty and the cash went out clean, through a business that knew exactly what it was converting. Judge the operators who sold the last mile to the criminal economy. Then hold the register's hardest-won strategic finding — that the thing the criminal cannot do without is also the thing that exposes them, and that the cash-out, the one step no launderer can skip, is where the money is most followable and the state most able to strike.

Follow the Money continues. Case 12 disposition: CONVERTED. Confidence: HIGH on the mechanism — cashing out through non-compliant/high-risk-jurisdiction CVC exchanges is documented as a core ransomware money-laundering typology by FinCEN's ransomware advisory and financial-trend analysis. The enforcement record is public: OFAC's September 2021 Suex designation (its first exchange sanction), the 2022 Garantex designation, the January 2023 US-French Bitzlato takedown and founder arrest, and the 2017 BTC-e DOJ case (per Europol) are matters of record; the Garantex/Hydra flow-displacement and the composition-of-flows findings are characterized per public blockchain analysis. Russia as a ransomware haven and the ~75% H2-2021 figure are from the 2024 NMLRA. Concentration and nesting are presented as documented structural features; specific transaction shares are characterized rather than pinned. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the operators, the conversion, and the chokepoint the criminal cannot avoid.