Chinese underground banking systems, known informally as “fei qian” or “flying money,” have become central to the operations of organized crime groups around the world. Functioning beyond the reach of regulated banking channels, these shadow financial systems facilitate the covert transfer of billions of dollars across borders.

Expanding Criminal Reach Through Crypto and Casinos

A recent report by blockchain intelligence firm TRM Labs, Shadow Bankers [pdf], explains how these networks are increasingly relying on cryptocurrency to carry out rapid and pseudonymous cross-border transfers for criminal clients. Among those benefiting from these services are Mexican drug cartels, Chinese Triad gangs, North Korean hackers, and Russian crime syndicates.

According to the report, Triad organizations such as 14K and Sun Yee On have fully embraced the combination of underground banking and digital assets to launder criminal proceeds. Historically dominant in Hong Kong and Macau gambling junkets, they have expanded their reach across Southeast Asia through both physical and online casinos. Many of these venues operate as laundering hubs, moving funds derived from drug trafficking, human trafficking, and large-scale fraud.

The COVID-19 pandemic prompted further adaptation, with Triads repurposing casino networks into cyber-scam compounds that conduct “pig-butchering” romance and investment frauds. The illicit profits from these schemes, often in cryptocurrency, are cycled through casino accounts, betting credits, and high-volume wagers. By blending these funds with legitimate gambling activity, the money eventually emerges as declared winnings or business revenue, effectively disguising its origins.

The UN Office on Drugs and Crime has observed that such casino-based laundering now moves money “in much bigger and more untraceable ways than in the past,” making it increasingly challenging for authorities to disrupt.

TRM Labs notes that Triad-linked operations frequently combine casino-based laundering with trade-based money laundering, or TBML. Criminal cash is used to purchase high-value goods, often through front companies, which are then exported and sold abroad to produce legitimate-looking profits. Cryptocurrency is becoming a common element at various stages of this process, whether for paying suppliers or buying goods, adding further anonymity to the transactions.

The Mirror Exchange Linking Cartels and Chinese Brokers

Mexican cartels, including the Sinaloa Cartel, work with Chinese money laundering organizations through what is known as a mirror exchange system. In this arrangement, a Chinese broker purchases cartel-held U.S. cash and pays the cartel’s contacts in Mexico with pesos drawn from funds already under their control in that country.

The same broker then sells those U.S. dollars to wealthy Chinese clients seeking to move money abroad, collecting payment in yuan within China. As a result, the dollars and yuan remain in their respective countries, but the value is transferred between parties entirely outside the formal banking system.

Cryptocurrency has enhanced the speed and secrecy of this method. Cartel affiliates can convert bulk cash into Bitcoin using crypto ATMs or exchanges in the United States, sending it to wallets controlled by Chinese networks. Those networks can then convert the cryptocurrency into fiat currency or use it to purchase goods for the cartel. The entire process avoids cross-border bank wires and reduces the risk of interception.

The TRM Labs report also details how North Korea’s state-sponsored hackers, who have stolen billions in cryptocurrency through cyberattacks, rely on Chinese over-the-counter crypto brokers to cash out their proceeds. In a 2023 U.S. indictment, North Korean banker Sim Hyon Sop and three brokers — Wu Huihui, Cheng Hung Man, and “Jammy Chen” — were charged with laundering stolen assets.

These brokers routed the hacked cryptocurrency through exchanges and shell companies, converting it into U.S. dollars that were then used to purchase sanctioned goods via Hong Kong-based front companies. The laundering process often included mixers and cross-chain “bridges” to make the transaction trail more difficult to follow before final cash-out.

The report states, “In other cases, North Korean-linked wallets have sent funds to accounts on Russian-run exchanges and mixers, suggesting collaboration — or at least shared facilitators.”

TRM Labs has identified at least $85 million since 2021 sent to wallets tied to Russian and Chinese entities engaged in the trade of military and dual-use equipment, creating what it describes as a sanctions evasion pipeline powered by cryptocurrency. Chinese companies manufacturing military hardware, such as drones and optical equipment, have sold to Russia, with crypto used as the payment method.

North Korea has similarly used Chinese brokers to channel stolen cryptocurrency into purchases of sanctioned goods. Russian darknet marketplaces and crypto exchanges have also facilitated laundering for both Chinese and North Korean actors. This relationship forms an interconnected network in which North Korea provides stolen digital assets, Chinese networks launder and settle the funds, and Russian actors supply platforms, cyber tools, and marketplaces.

The report emphasizes that these underground financial networks exploit regulatory gaps, technological blind spots, and international jurisdictional divides. They operate in areas with weak Know Your Customer rules, layer transactions through multiple accounts, and rely heavily on mixers, privacy coins, and rapid blockchain transfers to obscure money trails.

When enforcement actions do manage to disrupt an operator — such as when Binance froze Wu Huihui’s accounts in 2022 — the networks adapt quickly, shifting to new platforms or using intermediaries to continue operations.

TRM Labs concludes that countering these activities will require a combination of advanced blockchain analytics, global cooperation, and innovative enforcement strategies. The networks’ ability to merge long-standing underground banking practices with modern digital asset technology makes them a persistent and highly adaptable threat to the integrity of the global financial system.