The Laundering Room

How dirty money moves — and how it gets caught. New case file every week. youtube.com/@TheLaunderingRoom

[thelaunderingroom]

Every hack starts somewhere ordinary. In March 2022, a Sky Mavis engineer opened a job offer attached as a PDF. Inside was spyware — and it gave attackers a foothold into four of the nine validator keys securing the Ronin bridge.

Four signatures weren't enough. The fifth belonged to the Axie DAO, via a temporary gas-free permission granted months earlier to handle a traffic spike. The spike passed. Nobody revoked it. It sat open for months, forgotten — until the attackers found it and used it as the fifth signature.

On March 23rd, 2022, four validator keys plus that one leftover permission moved $625,000,000 out of the Ronin bridge in two transactions. Nobody at Sky Mavis noticed for six days. What caught it wasn't an internal alert — it was an ordinary user's failed withdrawal, filed as a routine support ticket.

The FBI attributed the attack to North Korea's Lazarus Group. The same playbook — fake recruiter, fake job, real document — scaled to $1,500,000,000 against a different exchange in 2025. It didn't require a genius exploit. It required patience, a document, and one administrative task nobody ever closed out.

Full case file: https://www.youtube.com/watch?v=HnyH3rrLqtA&utm_source=tumblr&utm_medium=social&utm_campaign=l14

Documentary commentary on a publicly reported, officially attributed case. Mechanism described conceptually only — no operational detail. Sources: CoinDesk (2022-04-14, 2022-04-06); The Block; U.S. Treasury/OFAC (2022-08-08). The targeted engineer is not named; the Lazarus Group / North Korea attribution is sourced to the FBI's own statement.

[thelaunderingroom]

They stole Twitter in two hours. $278,000 never made it out.

130 accounts. 45 tweeting. One bitcoin address, published to several hundred million people. About $118,000 arrived.

Then someone at a crypto exchange — nobody has ever said their name — added that address to a blocklist, and 1,100 customers were stopped from sending 30.4 bitcoin. More money blocked than the entire scheme ever collected.

They were caught because the business they were running before the hack had to get paid, and getting paid means showing ID.

Full case file → https://www.youtube.com/watch?v=KJqODUO19hs&utm_source=tumblr&utm_medium=social&utm_campaign=l13

[thelaunderingroom]

A branch worth half of one percent of its bank was earning nearly all of its money from foreign customers nobody had verified.

Nobody had to trace a transaction to see it. It was in the branch's own profit line, every year, for years.

One employee read it and wrote it down on 27 December 2013. Three months later Copenhagen replied that there were "some shortcomings in customer documentation."

The portfolio ran another year and a half.

New case file: https://www.youtube.com/watch?v=VPvFOxJEvr4&utm_source=tumblr&utm_medium=social&utm_campaign=l12

[thelaunderingroom]

In May 2021 someone got into Colonial Pipeline using one VPN account. The password was complex. It just wasn't unique — it had been reused from another site that was already breached.

The company shut down 5,500 miles of pipeline and paid roughly 75 bitcoin, about $4.4 million, to a group called DarkSide. DarkSide didn't even run the attack. It rented its ransomware to an affiliate and took a cut — keeping 11.3 coins and forwarding the other 63.7 to whoever actually broke in.

Then the money did the one thing cash never does. It stayed on the record.

Bitcoin isn't anonymous. It's pseudonymous — no name on the wallet, but a complete, unerasable diary of everywhere the money has ever been. The affiliate wasn't hiding in the dark. They were standing in a room with glass walls, confident because nobody had happened to look yet.

Their mistake wasn't getting caught spending it. It was time. 63.7 bitcoin sat in one reachable address for weeks.

A month after the ransom was paid, the DOJ announced it had recovered all 63.7 — not by arresting anyone, but through a civil forfeiture action against the money itself.

How the FBI got the private key has never been made public. The filing doesn't say, the agent declined to explain, and the one theory that circulated was publicly disputed by the company it named. That's the honest end of the record.

DarkSide shut down a week later. BlackMatter appeared within weeks, built on the same code. BlackMatter went dark; BlackCat turned up with the same fingerprints. Three names, one lineage.

Which is the lesson: don't chase the criminal, chase the coin. The criminal can rebrand. The coin can't.

Full anatomy, from the DOJ filings: https://www.youtube.com/watch?v=zMZh2bRUknA&utm_source=tumblr&utm_medium=social&utm_campaign=l11

Educational/documentary. The intrusion is described conceptually, with no reproducible detail. How the private key was obtained is not publicly known and is not asserted.

[thelaunderingroom]

He Stole 50,000 Bitcoin. Then He Sold 118 of Them.

In 2012 a 22-year-old found a flaw in Silk Road's withdrawal system. Deposit coin, then ask to withdraw it several times inside the fraction of a second before the site finished updating its own records.

He put in 500 bitcoin and took out 2,500. Then he did it again, across nine accounts and more than 140 transactions, until roughly 50,000 bitcoin had left the site.

Then — and this is the part that matters — he did nothing with it for nine years.

Every anti-money-laundering control in existence is built to watch money move. Money that sits still is money nothing is looking at. He wasn't hiding from a manhunt; there was no manhunt, because nobody knew there was anyone to look for.

What ended it wasn't the theft, and it wasn't the 911 call he made when his own house was burgled in 2019 — that case stalled, and the burglar was never caught.

It was 118 bitcoin, sold in 2019, from his own IP address. Two-tenths of one percent of the pile.

The blockchain said where the coin came from. The exchange said who opened the account. There is no third step.

Agents found roughly 50,676 bitcoin in a floor safe and a popcorn tin. He served one year and one day.

Full anatomy, from the court filings:

Educational/documentary. Silk Road has been defunct since 2013; the flaw is unreproducible. Allegations attributed to the charging document.

[thelaunderingroom]

A Casino Paid $15,000,000. One Transaction Later, the FBI Froze 277 Bitcoin.

A casino paid roughly $15 million in bitcoin in September 2023. The coin then did not move for five months — which is the most professional thing anyone in this case managed.

On 19 January 2024 it moved: 402 bitcoin into a currency bridge. Bridges are operated by identifiable companies. The FBI looked up who ran this one and phoned them. Ava Labs froze 277.56 bitcoin. 125 had already crossed and have never been recovered.

The difference between the coin that got away and the coin that did not was not skill, and it was not cryptography. It was how fast somebody picked up a phone.

Three people were later found by a food delivery, a broadband bill, and a device identifier none of them knew was running. The blockchain was public the entire time. It caught nobody.

Educational/documentary. Adjudicated cases only; nothing instructional. Unconvicted individuals are not named. Primary sources (SEC, DOJ, NCA, court record) linked on the video.

Watch the full case file: https://www.youtube.com/watch?v=yBjPIB0jkto&utm_source=tumblr&utm_medium=social&utm_campaign=l9

[thelaunderingroom]

The bank rated Mexico "standard" — its lowest risk category — and $881,000,000 walked through

A bank branch in Mexico. An ordinary weekday, an ordinary queue. A man reaches the counter carrying a box that is the wrong shape for a box — too flat, too wide, proportions that match no parcel anyone would ever carry.

Because it was never built to hold anything. It was built to fit. Somebody had measured a teller window and built cardboard to those measurements.

Prosecutors put the floor at eight hundred and eighty-one million dollars in drug proceeds, laundered through HSBC Bank USA without being detected.

The mechanism is not a clever scheme. It is a single field in a database.

HSBC Bank USA sorted every country on earth into one of four anti-money-laundering risk categories: standard, medium, cautionary, high. Mexico sat in the lowest one, from at least 2006 until May 2009 — while the State Department had been calling it a jurisdiction of primary concern for money laundering since 2000. Because Mexico was rated standard, wire transfers originating there were, as a rule, not reviewed at all.

And here is the flaw, which is not the box: switching monitoring off leaves a perfect record of exactly what you switched off. The system did not fail to notice the Mexican wires — it excluded them by rule, and a rule that excludes things has to identify what it is excluding. So it counted them. Over three hundred and sixteen thousand transactions, worth over six hundred and seventy billion dollars, from HSBC Mexico alone.

A bank that had merely been sloppy would have left nothing to count. This one left a complete, itemised inventory of its own blind spot.

The reckoning: a Senate case history, seventeen thousand unreviewed alerts, a four-count criminal information, roughly $1.9 billion. Two defendants named on the first page — both of them companies. Not one individual criminally charged. Charges dismissed with prejudice in December 2017.

Full anatomy with the primary sources on screen:

Educational commentary on financial crime and its detection. No operational detail. HSBC entered a deferred prosecution agreement and admitted the conduct; the charges were dismissed in 2017 and neither company was convicted. No individual is named.

[thelaunderingroom]

$81,000,000 Walked Into A Casino. Nobody Had To Report It.

$81 million left a central bank in February 2016 and walked onto a casino floor.

The theft mostly failed. Of $951 million requested, about $850 million never left.

The laundering worked, because in 2016, casinos in the Philippines owed nobody a report. That gap closed in July 2017. Seventeen months too late.

Roughly $66 million has never come home.

Full case file: https://www.youtube.com/watch?v=MI7-PnDNwEE&utm_source=tumblr&utm_medium=social&utm_campaign=l7

This is an educational and documentary examination of an adjudicated financial crime and the regulatory gap that enabled it. It is not instructional and contains no operational method. Allegations are attributed to their sources; individuals are named only where convicted or officially designated by a government authority.

[thelaunderingroom]

$1 Billion From 100 Banks: The Hack That Took Two Years to Notice

An employee opened an ordinary-looking email. Months later, an ATM started handing out cash with no card in the slot, to a man who just waited for it. The total, once every bank was counted: one billion dollars, from as many as a hundred banks, in around thirty countries. Investigators called it Carbanak.

Not a smash-and-grab — a patient intrusion that sat inside a bank's network for months, learned its software, and impersonated a legitimate operator. Three ways to turn that access into money: inflate a balance and siphon the invented difference, route funds out through the bank's own transfers, or command an ATM to pay out cash on schedule to a waiting mule.

The fatal flaw: software never needs to spend anything, but people do. Proceeds laundered through crypto and prepaid cards, spent on cars and houses — assets with paperwork, titles, deeds, names. A stolen dollar hides in a ledger forever; a car in a driveway cannot hide at all. That paper trail is what closed the net: a 2018 arrest in Alicante, coordinated by Europol and the FBI. The honest reckoning — the leader's name was never released and the record goes quiet, while two operators were later sentenced to eight years each for the same trick.

Educational commentary on financial crime; no operational detail. The arrested administrator is alleged, not convicted, and unnamed.

Full breakdown: https://www.youtube.com/watch?v=pwj9RXh99x8&utm_source=tumblr&utm_medium=social&utm_campaign=l6

[thelaunderingroom]

On April 5th, 2022, the United States blacklisted a cryptocurrency exchange called Garantex. A sanctioned exchange is supposed to die within days — partners run, customers scatter, the lights go out. This one kept its lights on for almost three more years, and moved ninety-six billion dollars in total.

Why is a crypto exchange so valuable to a launderer? Because a ransomware crew paid in crypto is holding evidence: every coin carries a public, permanent record of where it came from. What they need is a laundry — somewhere that takes radioactive crypto in one door and hands back clean money out the other. That is what Garantex was, in three moves: placement, layering, integration. Chainalysis traced its flows back to the most active ransomware crews on earth. It wasn't writing the ransomware. It was the cash register.

But a sanctioned exchange still depends on things its enemies can touch: servers in Europe, a stablecoin that can be frozen with one command, and administrators who have to physically exist somewhere. You can host a website against sanctions. You cannot host a vacation.

That is where the net closed: a four-country seizure, $26 million frozen, $27 million more frozen by the token's issuer, and one administrator arrested on holiday in India. The honest part — he died in prison before trial, and the machine simply reopened under a new name.

The crime is easy. The cash-out is where it dies.

Full case file: https://www.youtube.com/watch?v=PwdQ7UjHBlo&utm_source=tumblr&utm_medium=social&utm_campaign=l5

Documentary commentary on publicly reported, officially sanctioned cases. Mechanism described conceptually only — no operational detail. Sources: DOJ (2025-03-07); U.S. Treasury/OFAC (2022-04-05); Chainalysis; Meduza (2025-09-11). Charged administrators are alleged, not convicted.

[thelaunderingroom]

Pig Butchering: How a Text Becomes a $10 Billion CryptIt starts with one word on a phone screen. Hello.

Sometimes it's "hey, long time." Sometimes it's a wrong number that apologizes and then keeps talking. It reads like a mistake. It is not a mistake. That message is the first moving part in an industrial machine — one with office towers, shift quotas, and its own armed security. The people who built it gave it a name that tells you how they see you. They call it pig butchering. You are not the customer. You are the livestock.

The texts come from purpose-built compounds on the Myanmar border, staffed by trafficked workers from more than eighty countries, handed a script and a daily quota. The machine runs in six moves: contact, the fattening, the tip, a fake investment platform whose gains are typed in by the other side, one small withdrawal that works as bait — and then the wall of taxes and fees until nothing is left.

It has one flaw it cannot escape: it has to come to you. A web address you can click, money on a public ledger that never forgets. That is where the net closed — a seized domain, sanctions on the armed group protecting the compounds, $580 million clawed back. The honest part: the compounds were demolished for the cameras and moved by truck up the road.

A message that opens with hello and a mistake is sometimes neither.

Full case file: https://www.youtube.com/watch?v=I4yRjfMvTqc&utm_source=tumblr&utm_medium=social&utm_campaign=l4

Documentary commentary on publicly reported, officially designated cases. Mechanism described conceptually only — no operational detail. Sources: FinCEN Alert FIN-2023-Alert005; U.S. Treasury (2025-11-12); DOJ Scam Center Strike Force; FBI IC3 2025.

[thelaunderingroom]

They Approved The Transaction. It Cost Them $1.5 Billion.

One and a half billion dollars, gone the moment three people clicked approve.

On February 21, 2025, three authorized signers at the crypto exchange Bybit each looked at a screen that told them the same thing: routine transfer, cold wallet to hot wallet, the kind performed safely thousands of times before. They checked it the way you're supposed to. They compared it against their hardware wallets. Everything matched. Everyone signed.

What they approved wasn't a transfer. It was a single line of code — a delegatecall — that handed a stranger control of the vault itself. 401,347 ether. The largest theft in the history of cryptocurrency, gone in the time it takes to click "confirm."

Nobody hacked the wallet. This wasn't a broken lock; it was a lock that worked perfectly, on a door nobody could actually see. The cryptography held. The multisig policy was followed to the letter. The failure was that raw delegatecall data isn't human-readable — so three qualified people verified something that could not actually be seen.

Attribution was fast: Elliptic, Chainalysis, TRM Labs and ZachXBT independently converged within 72 hours, and the FBI formally named North Korea's Lazarus Group. Recovery was not. Roughly 89% of the money remains traceable. Under 5% has been frozen or recovered.

Every security system eventually asks a person to verify something. This one asked them to verify something invisible.

Full case file: https://www.youtube.com/watch?v=6lGeWRbHN_o&utm_source=tumblr&utm_medium=social&utm_campaign=l3

Documentary commentary on a publicly reported, officially attributed case. Mechanism described conceptually only — no operational detail. Sources: NCC Group technical analysis; FBI/IC3 PSA (2025-02-26); Chainalysis; Cryptopolitan.

[thelaunderingroom]

127,271 bitcoin. Around $15 billion on the day it was seized — the largest forfeiture action in DOJ history. It didn't come from an exchange hack or a cartel. It came from a conglomerate in Phnom Penh with towers it actually built, and, prosecutors allege, forced-labour scam compounds running underneath it generating more than thirty million dollars a day.

The scheme has a name: pig butchering. Contact, platform, cash-out. The money was allegedly sprayed across dozens of wallets and slowly reconsolidated until the trail read like ordinary market activity.

Then the flaw. The chairman didn't trust exchanges — a defensible instinct. Exchanges get subpoenaed. Exchanges employ people paid to notice you. So the proceeds went somewhere an exchange never touches: unhosted wallets. No custodian, no compliance officer, just him and the keys. Which is how 127,271 bitcoin ended up in one place under one man's control, with nothing between it and a seizure warrant but a private key he carried himself.

It wasn't carelessness. It was caution, in exactly one direction, all the way to the bottom of the ledger.

Educational and documentary — allegations from an unsealed indictment. The chairman has been charged, not convicted, and is presumed innocent.