One coin — one hundred traces

Today, as more digital assets and decentralized platforms circulate, criminals are using increasingly sophisticated schemes for money laundering. One such tactic has been to split large sums into small transfers across multiple different wallets.

In 2025, this scheme became very popular, and even experienced analysts and blockchain specialists find it difficult to identify real sources of funding and establish final withdrawal venues.

How is it that millions are hidden behind hundreds of transfers of $50? What tools help to make sense of this crypto chaos? And is it even possible to trace where the digital trail ends? Georgy Osipov, the director of investigations at "Shard," explains.

How microtransactions are used to conceal the origin of funds

Micropayments are transfers of small amounts, usually within a few dollars. However, with mass usage, such operations can total tens or hundreds of thousands of dollars. Fraudsters break assets into multiple transactions to disguise the origin of the funds and make tracking them more difficult.

The scheme is carried out in four steps:

1. Splitting. First, a large amount, say 10 BTC, is divided into many small transfers, for example, 0.01–0.1 BTC each.
2. Dispersion. Funds are directed to different wallets, which may be interconnected, but formally appear as separate.
3. Recirculation. Micropayments are transferred between addresses, sometimes through smart contracts or decentralized exchanges.
4. Consolidation. After the "washing", small amounts are gathered again, but in different currencies, on new addresses or centralized exchanges with less strict control.

Many cryptocurrency exchanges and services impose limits, which, when exceeded, trigger additional verification procedures (, for example, for transfers over $10,000). Such measures may include risk level analysis, blocking the transfer until circumstances are clarified, or requesting documents that confirm the source of funds. Splitting helps avoid automatic "flags" and keeps transactions within a "safe" range.

A large number of small transfers complicates the analysis of the transaction chain. It is especially difficult to reconstruct the path of funds if each fragment of the transaction passes through different DeFi protocols or cross-chain bridges. This creates "noise" in the data and makes it difficult to build a complete picture.

Moreover, such a scheme creates the illusion of normal user activity. By distributing funds across dozens of addresses and transactions, attackers blend in among millions of real users on cryptocurrency exchanges, NFT platforms, and DeFi networks. This reduces the likelihood that the monitoring system will recognize the transfer as suspicious.

How Analysts Restore Connections Between Microtransactions

Microtransactions create a chaotic effect: hundreds of small transfers, dozens of wallets, various exchange services, and NFT platforms. However, modern analytical tools are becoming increasingly accurate and allow for finding connections between seemingly disparate elements.

The key method is the construction of a fund movement graph. In such a model, each address acts as a node, and each transaction serves as a connection between them. Even if the amount is divided into a hundred micropayments, the route from the starting point to the final recipient can be reconstructed using clustering, analysis of temporal dependencies, and assessment of joint control over the addresses.

In Russia, investigations into cryptocurrency crimes are also becoming more technological. An important role here is played by the use of off-chain data — such as KYC information, IP addresses, data from law enforcement agencies, and information from open sources. In combination with on-chain analytics, this helps to form a comprehensive picture of the movement of funds and, in some cases, deanonymize the owners of crypto wallets.

How DeFi platforms and NFTs are used to obscure the trail

Since the beginning of the 2020s, DeFi and NFTs have become a place where some people launder money. Decentralized platforms offer quick and anonymous operations without intermediaries, which helps criminals obfuscate the trails of their assets that have been obtained dishonestly.

In 2025, numerous schemes related to the evasion of honest cryptocurrency use are being conducted through DeFi protocols and NFT markets. According to Chainalysis data, in 2023, criminals stole $1.1 billion through attacks on DeFi protocols — a 64% decrease compared to 2022, when the damage amounted to $3.1 billion. Let's examine the main tools that fraudsters resort to.

Using DEX (decentralized exchanges). Scammers use DEX platforms like Uniswap, PancakeSwap, and SushiSwap, among others, to swap one asset for another. This usually happens through a chain of exchanges involving different coins: for example, ETH is exchanged for DAI, then DAI for USDT, and finally the stablecoin is withdrawn to the BSC network. These transactions break the flow into separate parts, and each of them is difficult to trace.

Example: the address receives $10,000 in ETH coins, divides it into 20 transactions of $500 each, exchanges each part for different coins through DEX, and then transfers them through bridges to other networks. Thus, by using DEX exchanges and the splitting tool, the fraudster greatly complicated the transaction analysis chain.

Transaction mixing protocols (mixers). Crypto mixers like Tornado Cash allow users to mix tokens from different users. This helps to obscure the source of the funds. Even if the amounts of damage are small and there are few transactions, after running the cryptocurrency through mixers, it becomes difficult to trace who is actually receiving the funds, especially if there is a long time interval between sending the funds to the mixer and receiving them.

NFT as a money laundering tool. It should be noted that NFTs are increasingly used as a means of obscuring the origin of funds: fraudsters create tokens and then buy them back from themselves with another wallet — this is a classic wash trading scheme, where cryptocurrency is legitimized as "income from digital art." Additionally, NFTs allow for the transfer of funds into another class of assets, not always falling under financial regulation. This complicates the identification of operations and reduces the likelihood of automatic detection of suspicious transactions.

What is the difficulty of matching micropayments between different blockchains

Comparing micropayments across different blockchains is one of the most labor-intensive tasks in cryptocurrency investigations. Malefactors are increasingly fragmenting stolen funds and dispersing them across many networks, such as Ethereum, TRON, BNB Chain, Avalanche, Polygon, and others. This method helps them exploit the features of each network to obscure their tracks.

Let's analyze the main reasons why tracking microtransactions between blockchains is a challenging task.

Firstly, there is often no single way to link a transaction in one network to a transaction in another. Unique identifiers and wallet addresses do not overlap between chains, so when we move from one network to another (, for example, through a bridge or a decentralized service ), it disrupts the continuity of the chain. For instance, a user sends 0.001 ETH to the bridge and receives 0.001 wETH on the Polygon network. Visually, these are two different events with different addresses and hashes.

Secondly, most cross-chain transactions go through bridges. Bridges often use wrapped coins, such as wETH and wBTC, which are different assets in the receiving network. This not only obscures the origin of the funds but also alters the coin structure, adding additional layers of complexity.

Thirdly, blockchain networks vary in terms of access levels. For example, Ethereum and Bitcoin networks can be easily explored using open nodes and APIs. In contrast, networks like Zcash and Monero are closed or require special tools or permissions to access data.

The less transparent the blockchain, the harder it is to trace transactions, especially if some micropayments go to closed networks or are hidden using special protocols.

What behavioral patterns most often indicate money laundering through microtransactions

Microtransactions are often used in money laundering schemes, mimicking the appearance of legitimate activity and obscuring the connection between the sender of the funds and the recipient. Although such transactions may seem small and inconspicuous, some behavioral patterns recur frequently enough to be used as indicators of suspicious activity. Analysts, law enforcement, and cybersecurity experts employ the methods we described below to uncover detailed schemes for laundering money.

1. Super regularity and patterning of transfers. One of the main features of money laundering through micropayments is the identical and frequent transfers of similar amounts that occur at small intervals. Such transactions make no sense and are unlike normal transfers from users. Example: if one address sends 0.0015 ETH every 7 seconds to 100 different addresses over the course of an hour, and there is no context or reciprocal transfers, this may indicate an automated money distribution scheme.
2. Cyclical Routes and Fund Returns. Sometimes laundered money is partially sent back to the same addresses from which it came, creating the appearance of user activity. Such schemes are often used to legitimize cryptocurrencies on centralized exchanges. Example: scheme A → B → C → A with intermediate splits into small payments and a return of part of the funds. This creates the illusion of income from DeFi operations.
3. Frequent use of bridges and DeFi platforms. If payments go through multiple blockchains and DeFi services, especially with small amounts and large transaction volumes, this may indicate an attempt to hide something from law enforcement or regulatory agencies, as the economic sense of transactions is lost due to the high number of fees. For example, suspicious behavior may look like this: transferring 0.001 ETH, exchanging it for DAI through Uniswap, then using a blockchain bridge to BNB Chain, exchanging back, purchasing an NFT, and then quickly reselling it.
4. Using temporary addresses. So-called burner wallets are addresses created for one or two transactions and then simply forgotten. They are often used in micro-networks, and if many such addresses accumulate in one chain, it's a reason to think. Example: more than 100 addresses, each receiving about $40 in 30 minutes, and then all funds are collected in one new wallet and sent to the exchange.
5. Anomalies against the regular user model. A number of analytical systems work with behavioral profiling. For example, if an address that was previously used only for storage suddenly starts making many small transfers through DeFi, this is perceived as an anomaly in behavior.
6. Unusual activity hours and geographical desynchronization. Unusual activity hours and discrepancies in location can raise suspicions. For example, if you see many small transactions occurring at night, say, between 3-4 AM, or if they come from IP addresses not associated with the real location of the account (, as in cases with exchanges that have identity verification ), this is often linked to the operation of automatic laundering bots.

Conclusion

In 2025, microtransactions are part of complex schemes for laundering and moving digital assets. Criminals have learned to adapt to new methods of analyzing crypto transactions and use various tricks to launder stolen assets.

Nevertheless, the crypto industry is not standing still. New analysis tools are emerging, such as graph models, machine learning, and working with offline data (KYC, IP, network logs, OSINT data, etc.). These technologies help restore real relationships between participants in blockchain chains.

Typical actions of fraudsters, such as frequent micro-transfers, circular ( transactions, disposable wallets, and wash trading, are increasingly being recorded in monitoring systems. However, without international cooperation and access to critically important data ) personal information, including KYC(, the fight against crypto-crime will still be a challenging task.

Today, the effectiveness of cryptocurrency investigations depends not only on technology but also on the ability to understand the behavior of the criminals behind the transactions. One coin can leave many traces — the key is that someone notices and recognizes them in time.