Pattern recognition, not a glossary to memorise
Parts 1 and 2 covered what actually counts as regulated activity and the timeline you're working against. This part is different in kind: it's about pattern recognition. Crypto laundering typologies borrow the same underlying logic as traditional money laundering, placement, layering, integration, but the mechanics look different enough on-chain that an analyst trained purely on fiat red flags will miss them.
Layering: how crypto's version actually works
In fiat laundering, layering means moving funds through multiple accounts and jurisdictions to obscure the trail. On-chain, the same goal is achieved differently, and faster.
Mixing and tumbling
Mixing and tumbling services pool funds from many users and redistribute them, breaking the direct on-chain link between a deposit and a withdrawal address. The mechanics vary, some use smart contract pools, others coordinate off-chain, but the effect is the same: a clean address that received funds from a mixer has no verifiable on-chain link back to the original source, even though the mixer itself may be entirely legitimate infrastructure used by both privacy-conscious ordinary users and launderers alike. That dual-use nature is exactly why a screening approach based on "did this address touch a mixer" needs nuance, not a blanket reject.
Chain-hopping
Chain-hopping moves value across multiple blockchains via bridges or cross-chain swaps. Each hop can reset the assumptions a monitoring tool has built up about an address's history, and bridge protocols vary enormously in the transaction data they preserve versus discard. An address history that looks clean on one chain may simply mean the funds arrived via a bridge from a chain your tooling doesn't have visibility into.
Peel chains
Peel chains are the on-chain equivalent of structuring. A large sum moves through a sequence of addresses, peeling off a smaller amount at each hop while the bulk continues onward, mimicking normal transactional behaviour rather than one large, conspicuous transfer. The individual peeled amounts often sit comfortably under whatever threshold triggers automated review, which is precisely the point.
Rug pulls: the typology, not just the headline
A rug pull is a scheme where a token's creators build apparent legitimacy, a project, a website, a community, liquidity on a decentralised exchange, then withdraw that liquidity or dump their own holdings, leaving other holders with a worthless token. It's fraud with a laundering dimension: the funds extracted often move immediately into layering techniques before victims have finished realising what happened.
Red flags an analyst can actually check
Rather than relying on hindsight:
- Concentrated token ownership. A small number of wallets holding a large percentage of total supply is a structural risk regardless of what the project claims about its tokenomics.
- Unlocked or short-locked liquidity. Legitimate projects typically lock liquidity for a meaningful period, verifiable on-chain. Liquidity that can be withdrawn immediately, or that unlocks unusually soon after launch, is a genuine structural red flag, not paranoia.
- Anonymous team with no verifiable history. Anonymity alone isn't disqualifying in crypto generally, but combined with the two factors above it meaningfully raises risk.
- Contract permissions that allow minting new supply or blocking specific wallets from selling. Both are checkable directly in the smart contract code, and both have been used in documented rug pull cases to trap holders while the team exits.
NFT wash trading as a laundering vector
Less discussed than mixers, but a real, documented pattern: an individual or coordinated group buys and sells the same NFT between wallets they control, artificially inflating its apparent trading volume and price history. Once a fabricated price history exists, a genuine third-party sale at that inflated price becomes a plausible-looking vehicle for moving value, the "profit" is really just laundered funds dressed as a legitimate art or collectibles transaction. The giveaway is usually in the wallet graph: a small, tightly connected cluster of addresses trading exclusively with each other before a single external sale.
What this actually means for onboarding and monitoring
None of these patterns are individually proof of anything. Mixer usage, cross-chain activity, and even holding a token that later turns out to be a rug pull are all things that happen to entirely legitimate users too. The skill this guide is actually teaching is the same one running through Scenario Lab's cases: don't treat any single indicator as automatically dispositive, and don't treat a clean-looking transaction history as automatically clean either. Ask what the pattern of behaviour is consistent with, not just whether one box got ticked.
Practical checklist
For a KYC or transaction monitoring team building this into an actual process, four things worth actioning:
- Flag mixer interaction as a risk factor requiring further review, not an automatic reject.
- Build cross-chain visibility into monitoring tooling deliberately. Don't assume a clean single-chain history means a clean overall history.
- For any token-related onboarding or business relationship, check ownership concentration and liquidity lock status directly on-chain before relying on the project's own claims.
- Watch for tightly clustered wallet graphs on NFT-related activity specifically. That's the wash trading tell.