Typologies: what laundering looks like to a compliance desk

Graduate · enrolled learners

This lesson opens with Hydra Market, seized April 2022.

What happened

Hydra was the world's largest and longest-running darknet marketplace, operating primarily in Russian, until a joint US and German action seized its servers in April 2022 and it was sanctioned the same day. Over its life it facilitated on the order of 5.2 billion dollars in cryptocurrency transactions, and part of what made it dominant was that it industrialized laundering as a service: it ran built-in mixing to break the link between deposits and withdrawals, layered funds through chains of intermediary addresses, and offered structured cash-out options, including dead-drop schemes that turned crypto into physical caches, so that proceeds could be cleaned and extracted at scale. Hydra did not invent these methods; it packaged the recognizable patterns of money laundering into a product. For a compliance desk, its value as a case is that it displays those patterns, the typologies, in their fully developed form, because the shapes Hydra automated are the same shapes a desk must learn to recognize anywhere.

The decision point

A typology is a recognizable pattern of how illicit funds are moved and cleaned, mixing to sever the link between source and destination, layering through many hops to distance funds from their origin, structuring into amounts and paths that avoid attention, and cash-out through points that convert crypto to usable value. Typologies matter because laundering is not usually caught by recognizing a specific address you already know is bad; it is caught by recognizing the shape of the activity, the pattern that looks like cleaning regardless of which addresses are involved. Hydra is the demonstration because it industrialized those exact patterns into a service, so it shows them fully formed. The critical shift for a compliance desk is from a list to a shape: screening asks whether an address is on a known-bad list, but a typology lets a desk flag laundering it has never seen a particular address commit, because the activity has the recognizable form of layering or mixing or structured cash-out. So the decision an institution makes is to monitor for the patterns and not only the addresses, because a launderer generates new addresses freely but cannot easily avoid the shape of laundering itself, and the shape is what a desk trained on typologies can see.

Recorded loss

$5,200,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.