Typologies: what laundering looks like to a compliance desk

Graduate · enrolled learners

This lesson opens with Hydra Market, seized April 2022.

What happened

Hydra was the world's largest and longest-running darknet market, serving users in mainly Russian-speaking countries, until on 5 April 2022 the German Federal Criminal Police, in coordination with US law enforcement, shut down its servers in Germany and seized 25 million dollars in bitcoin, and OFAC sanctioned it the same day. Since 2015 it had received approximately 5.2 billion dollars in cryptocurrency, and in 2021 it accounted for an estimated 80 percent of all darknet-market cryptocurrency transactions. Part of what made it dominant was that it industrialized laundering as a service: per the Justice Department, Hydra offered an in-house mixing service to launder and then process vendors' withdrawals, its vendors offered a robust array of money laundering and cash-out services that converted bitcoin into other forms of currency, and some users set up shell vendor accounts purely to run money through Hydra's bitcoin wallets as a laundering technique. Goods were delivered by dead drop, left hidden at a physical location whose whereabouts the buyer received after paying. Hydra did not invent these methods, since mixing services such as Bitcoin Fog had operated since 2011; it packaged the recognizable patterns of money laundering into a product. For a compliance desk, its value as a case is that it displays those patterns, the typologies, in their fully developed form, because the shapes Hydra automated are the same shapes a desk must learn to recognize anywhere.

The decision point

A typology is a recognizable pattern of how illicit funds are moved and cleaned, mixing to sever the link between source and destination, layering through many hops to distance funds from their origin, structuring into amounts and paths that avoid attention, and cash-out through points that convert crypto to usable value. Typologies matter because laundering is not usually caught by recognizing a specific address you already know is bad; it is caught by recognizing the shape of the activity, the pattern that looks like cleaning regardless of which addresses are involved. Hydra is the demonstration because it industrialized two of those patterns, mixing and cash-out, into services, so it shows them fully formed. The critical shift for a compliance desk is from a list to a shape: screening asks whether an address is on a known-bad list, but a typology lets a desk flag laundering it has never seen a particular address commit, because the activity has the recognizable form of layering or mixing or structured cash-out. So the decision an institution makes is to monitor for the patterns and not only the addresses, because a launderer generates new addresses freely but cannot easily avoid the shape of laundering itself, and the shape is what a desk trained on typologies can see.

Recorded loss

$5,200,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.