A report from blockchain intelligence company TRM Labs reveals that Chinese underground banking networks, also known as “shadow bankers”, have become critical conduits for global organized crime by increasingly using crypto casinos and online gaming for money laundering.
TRM Labs is a blockchain intelligence company that helps financial institutions, crypto businesses, and government agencies detect and investigate crypto-related financial crime and fraud.
In its report, it states that these informal banking channels, or “fei qian,” operate outside traditional financial regulations and enable a wide range of illicit activities, including drug trafficking and sanctions evasion.
The report highlights the increasing reliance on cryptocurrency by these networks to facilitate rapid, pseudonymous cross-border transactions for their criminal clients.
According to the TRM Labs researchers, Chinese Triad gangs have aggressively embraced underground banking and cryptocurrency to launder illicit proceeds. These groups historically controlled gambling junkets and extensive smuggling networks in Hong Kong and Macau, which they used to clean cash from activities like drug trafficking.
‘In the modern era, Triad-affiliated networks have extended this model across Southeast Asia, operating both physical and online casinos, as well as scam call centers that function as money laundering hubs’, the report points out.
During the COVID-19 pandemic, many land-based casinos shifted to online operations, and criminal groups repurposed this infrastructure to run cyber-scam centers. These scam compounds, often involved in “pig-butchering” romance and investment frauds, generate massive crypto profits that require laundering.
Gaming and money laundering techniques
Triad gangs have turned the region’s casinos and underground bankers into an “underground banking system”. This system super-charges the illicit economy by allowing criminals to move money freely through casino accounts, betting credits, and cryptocurrency transactions. A common technique is to integrate cryptocurrency into casino-based schemes.
A Triad-linked underground bank might accept criminal funds and issue the equivalent value as gambling credits in a casino or as cryptocurrency that can be gambled online. The funds can then be circulated through high-volume betting, mixing illicit money with legitimate gamblers’ funds, and eventually cashed out as “casino winnings” or business revenues, which obscures their origin.
The UN Office on Drugs and Crime states that these casino-based networks enable Chinese triads to move funds in “much bigger and more untraceable ways than in the past,” making it incredibly difficult for authorities to track the money.
One common method involves integrating crypto into casino and trade-based money laundering.
Criminal proceeds—often from drug trafficking, human trafficking, or fraud—are funneled through underground banks, which convert the money into gambling credits at casinos in special economic zones or into cryptocurrency that can be used in online gambling platforms.
These funds are then cycled through high-volume betting, often mixed with legitimate gamblers’ money, and eventually withdrawn as “winnings” or declared as business income, masking their illegal origins.
Triads also exploit international trade routes to clean money. They use illicit cash to buy high-value goods or commodities, often through front companies. These goods are exported and sold overseas, generating seemingly legitimate profits. Increasingly, crypto is used at various points in this trade cycle—for example, paying suppliers or buying goods—adding further anonymity and complicating enforcement efforts.
Chinese chemical manufacturers, particularly those producing precursor chemicals for fentanyl and methamphetamine, play a critical role in this system. According to TRM Labs, 97 percent of over 120 such firms are willing to accept payment in cryptocurrency.
This enables Triad groups to use crypto to pay for drug precursors, which are then processed into narcotics and sold, with the cash proceeds re-entering the underground banking network to be laundered again.
Mexican cartels, like the Sinaloa Cartel, use the mirror exchange system to launder drug money. In this system, a Chinese underground broker buys a cartel’s U.S. cash from drug sales and, in return, provides the equivalent value in local Mexican pesos to the cartel’s associates in Mexico.
The broker then “sells” the U.S. dollars to a wealthy Chinese client seeking to move money out of China, who pays the broker in yuan in China. This means that the dollars and yuan never physically leave their respective countries, yet the value has been transferred.
Cryptocurrency has added a modern twist to this system, allowing for a “trustless network” where brokers can use digital assets as an intermediary value transfer. Cartel brokers can deposit bulk cash into crypto ATMs or exchanges in the U.S., convert it to Bitcoin, and send it to a Chinese network’s wallet. This value transfer via the blockchain is faster and more obscure than traditional methods.
North Korean crypto heists and laundering
North Korean state-sponsored hackers have stolen billions in cryptocurrency through cyber-heists and exchange hacks. To convert these stolen digital assets into usable funds for its weapons programs, North Korea relies on Chinese underground banking networks and over-the-counter (OTC) crypto brokers.
A 2023 U.S. indictment charged North Korean banker Sim Hyon Sop and three OTC brokers with conspiring to launder stolen cryptocurrency. These brokers funnel the stolen crypto through exchanges and shell companies to convert it into US dollars, which are then used to purchase sanctioned goods for North Korea. The process often involves using mixers and cross-chain “bridges” to obscure the trail before the funds are cashed out by brokers.
TRM said it identified at least $85 million sent since 2021 to crypto wallets linked to Russian and Chinese entities involved in the trade of military and dual-use equipment — effectively a cross-border sanctions evasion pipeline using digital assets .
‘In other cases, North Korean-linked wallets have sent funds to accounts on Russian-run exchanges and mixers, suggesting collaboration — or at least shared facilitators. This makes sense: an exchange like Garantex (or the defunct darknet market Hydra) had an established network to convert crypto into cash with little oversight, which any sanctioned actor would find valuable’, the report alledges.
‘On the flip side, Chinese networks have also helped Russian entities evade sanctions and move funds. A notable example exposed by TRM Labs is the financing of Russia’s war machine through crypto channels. Chinese companies manufacturing military equipment (such as drone and optical tech) have been selling to Russia, and cryptocurrency has been used to pay for these sanctioned transactions’.
