Cryptocurrency fraud continues to spread worldwide. An international joint investigation has revealed that over €25 billion in illegal assets have been funneled through crypto trading platforms in the past two years alone.
It all started with an inconspicuous internet advertisement. Felix Wandraschek (name changed) came across a seemingly attractive investment opportunity and entered his contact details. The very next day, as he now tells his lawyer, a man contacted him by phone. The man's voice sounded trustworthy. Step by step, Wandraschek eventually invested around twenty million euros – a large portion of which has disappeared.
According to information obtained by WDR, NDR, SZ, and Profil, this extraordinary case is now part of a comprehensive investigation by the Vienna Public Prosecutor's Office for Economic Affairs and Corruption. However, Wandraschek's lawyer, Roman Taudes, does not hold out much hope that he will recover all of his assets.
This case exemplifies a multitude of alleged criminal activities in which cryptocurrencies are playing an increasingly significant role internationally. Süddeutsche Zeitung, NDR, and WDR, together with the International Consortium of Investigative Journalists (ICIJ) and over 30 other international partners, spoke with numerous victims. As part of the "The Coin Laundry" project, the reporters collected hundreds of wallet addresses – digital accounts used to process cryptocurrency transactions.
Tens of thousands of transactions reconstructed
Based on the analyzed digital wallets, reporters were able to trace tens of thousands of transactions through which funds allegedly flowed into criminal channels. Combined with data from the analytics platform Chainalysis, a clear picture emerges: At least €25 billion in illicit funds are believed to have flowed through cryptocurrency exchanges within the past two years.
The Wandraschek case exemplifies how the perpetrators apparently operate. According to documents obtained by WDR, NDR, SZ, and Profil, he initially started with smaller amounts – a few hundred to a few thousand euros. But the sums quickly increased. Accounts were set up for him on cryptocurrency trading platforms, to which he then transferred real euros, which were exchanged there for cryptocurrencies.
According to lawyer Roman Taudes, the suspected fraudster posed as an employee of a supposed cryptocurrency exchange. Wandraschek was able to view deposits and alleged profits on the platform. However, according to the current state of the investigation, the trading site never existed – it was a deceptively realistic fake. The deposited funds were allegedly immediately forwarded and converted into various digital assets. By the time Wandraschek became suspicious, investigators believe the loss had already reached approximately 20 million euros. The perpetrators have not yet been identified.
Criminals benefit from lax controls.
According to international reporters, criminals have an easy time on many cryptocurrency exchanges. Some platforms allowed suspicious transactions to go through multiple times, as conversations with German investigators revealed. In several cases, accounts were reportedly only blocked very late.
Another problem: Many exchanges only cooperate with authorities to a limited extent. Furthermore, numerous cryptocurrencies are not subject to European or American regulation – especially if the providers are registered in third countries.
Wandraschek painstakingly tried to trace his money. But only a few cryptocurrency exchanges even responded to inquiries. However, Austrian investigators reportedly received information from Binance – the world's largest cryptocurrency exchange – on 63 accounts allegedly linked to the fraudulent scheme. From there, the trail leads to nearly 2,000 further accounts to which portions of the money are believed to have been distributed. A vast network that could be analyzed automatically.
Suspected straw man accounts
Computer scientist Bernhard Haslhofer, head of a research group for digital currencies at the Complexity Science Hub in Vienna, analyzed Binance data on behalf of lawyer Taudes. The analysis, which WDR, NDR, and SZ were able to review, identifies numerous suspected straw man accounts. This is because the registered owner profiles often do not match the enormous sums of money that are alleged to have flowed through these accounts.
According to the analysis, all incoming cryptocurrencies were immediately converted into other coins, withdrawn, and forwarded. This transaction pattern significantly complicates investigations.
Binance declined to comment on the specific 63 accounts in this case when contacted by the media. However, the company emphasized its commitment to adhering to the highest security standards, monitoring high-risk activities and transactions, and cooperating closely with international law enforcement.
But Binance wasn't the only platform through which funds are alleged to have flowed. The trail leads to many other exchanges worldwide.
Not just fraud
Investigators have observed that the criminal landscape surrounding cryptocurrencies has expanded significantly. It's no longer solely about fraudulent investment schemes. Alongside legitimate applications, the crypto world is increasingly becoming a hub for illicit financial transactions.
Cartels use digital assets to conceal drug money, while payments related to human trafficking, child pornography, or extortion via malware can be processed using cryptocurrencies. Digital financial structures thus offer diverse opportunities for a wide range of serious crimes.
The crypto scene also appears to be used to finance terrorism. According to a media report, the Palestinian terrorist organization Hamas allegedly displayed wallet addresses in YouTube videos, allowing supporters to donate Bitcoin to the fight against Israel. This was reported by CNN.
„Global crime uses cryptocurrencies wherever possible,“ explains a German investigator who works on such cases worldwide. At the end of these money flows, the digital assets are usually exchanged for traditional currencies like euros or dollars – a step for which the perpetrators typically need banks.
„At some point, the perpetrators have to resurface if they want to exchange crypto for real money,“ says Jana Ringwald from the Central Office for Combating Internet and Computer Crime (ZIT) of the Frankfurt Public Prosecutor's Office. „And that's precisely where our opportunity lies.“
The ZIT (Central Office for Cybercrime) has existed since 2010 and works closely with specialists from the nearby Federal Criminal Police Office (BKA) in Wiesbaden, which has its own cybercrime unit. Since 2017, the two agencies have jointly seized approximately €245 million from crypto-related crimes.
The Financial Intelligence Unit (FIU) of the customs service is also sounding the alarm. The number of suspicious activity reports is rising noticeably, agency head Daniel Thelesklaf told WDR, NDR and SZ: "In 2024, we had almost 9,000 reports relating to crypto assets. And that clearly shows that money launderers are increasingly exploiting the opportunities this sector offers."„
Lax regulation in many states
Outside the EU, numerous countries have weak control and monitoring mechanisms in the crypto sector. Money launderers exploit these regulatory gaps and preferentially establish themselves in countries where oversight is significantly weaker than within the European Union.
„We are observing that professional money launderers – often in close connection with organized crime structures – are systematically exploiting existing vulnerabilities in the crypto sector to conceal proceeds from illegal activities,“ explains FIU Director Daniel Thelesklaf.
For victims of crypto fraud, the chances of getting a refund are often slim. Felix Wandraschek has also had little success in tracing his money. Only one Luxembourg-based cryptocurrency exchange flagged some of his transfers as suspicious and froze the corresponding amounts in a wallet. At least around €150,000 was recovered this way.
