Smugglers, money launderers and people facing sanctions once relied on diamonds, gold and artwork to store illicit fortunes. The luxury goods could help hide wealth but were cumbersome to move and hard to spend.
Now, criminals have a far more practical alternative: stablecoins, a cryptocurrency tied to the US dollar that exists largely beyond traditional financial oversight.
These digital tokens can be bought with a local currency and moved across borders almost instantly. Or they can be returned to the traditional banking system – including by converting funds into debit cards – often without detection, a New York Times review of corporate filings, online forum messages and blockchain data shows.
A report released in February from Chainalysis, a blockchain analysis firm, estimated that up to US$25bil (RM102.07bil) in illicit transactions involved stablecoins last year. And as more Russian oligarchs, Islamic State group leaders and others have begun using the cryptocurrency, the rise of these dollar-linked tokens threatens to undermine one of America’s most potent foreign policy tools: cutting adversaries off from the dollar and the global banking system.
“Bad actors are moving faster than ever before,” said Ari Redbord, a former Treasury official and the head of policy at TRM Labs, a blockchain data company. Sanctions and other economic penalties, he said, lose force when criminals can move millions with a few clicks.
Governments are racing to contain the activity. Late last month, Britain arrested members of a billion-dollar money-laundering network that purchased a bank in Kyrgyzstan in order to help evade sanctions and facilitate payments in support of Russian military efforts. For a fee, Britain’s National Crime Agency said, the launderers would convert money, often generated from the drug trade, firearm sales and human trafficking, to Tether, the most popular stablecoin.
“These ‘cash to crypto’ swaps are an integral part of a global criminal ecosystem,” said Sal Melki, deputy director for economic crime at the National Crime Agency.
For decades, the Treasury Department has relied on banks and credit card companies to root out illicit financial activity, requiring them to spend billions on compliance measures that track and block groups that are subject to government sanctions – or face enormous fines. Since most of the world’s dollar-denominated trade flows through these regulated channels, transacting with those facing sanctions has been extraordinarily difficult.
Stablecoins bypass this system entirely. Through layers of intermediaries, digital dollars can be moved, swapped and mixed into pools of other funds in ways that are more difficult for authorities to trace, Redbord said.
A test of how easily money can be converted
To test just how easily crypto can slip between the cracks of banking controls, I found a crypto ATM in Weehawken, New Jersey, to convert cash into stablecoins.
Soon after I fed two US$20 bills into the machine, I received a notification on my phone that crypto had arrived in my digital wallet. A Telegram bot then guided me through the next step: using the stablecoins to generate a Visa payment card number with a balance that I could spend anywhere.
A payment card functions very much like a debit card, though it is not tied to any of my bank accounts. In this case, the card I was issued did not require me to provide an address or identity check of any kind – in effect creating a degree of anonymity for my spending.
My experiment was perfectly legal, despite anti-money-laundering laws in the United States that require banks to scrutinise the identity of an account holder and the source of funds before issuing credit, debit and payment cards.
The Telegram bot that issued my card was run by WantToPay, a company that advertises Visas and Mastercards to Russians who want to shop abroad or make purchases online but are blocked by US sanctions. Because of sanctions tied to the invasion of Ukraine, many American companies cannot process payments from most Russian banks.
In its ads, on WantToPay’s website and on its Telegram channel, the company promises instant issuance without any of the traditional customer checks that banks must perform.
WantToPay is incorporated in Hong Kong, though a Russian entrepreneur in Thailand leads the company, corporate records show.
Hundreds of reviews on Russian-language online forums describe using the cards to circumvent restrictions and pay for services such as ChatGPT, Netflix and other online platforms that Russians cannot otherwise use.
WantToPay did not respond to multiple requests for comment. After I contacted the company, references to Visa and Mastercard disappeared from its website, and it posted a notice on Telegram that it was no longer issuing cards.
Visa said in a statement that it maintained robust compliance controls and required all clients and partners to follow applicable laws. After I alerted Visa to the WantToPay cards, Visa said it had opened an investigation into the company.
A spokesperson for Mastercard said the company has zero tolerance for unlawful activity and reviews potential issues ensure compliance with local laws and standards.
Devon Spurgeon, a spokesperson for Telegram, said the platform complies with all US money laundering regulations and removes illegal content upon confirmation.
WantToPay, however, was only one link in a chain of financial intermediaries I encountered. While it marketed my card to me, I learned that WantToPay used another company to generate it. I soon traced my Visa to Dock, a Brazilian financial-technology firm that issues cards for companies such as WantToPay.
Dock is one of many financial firms that help companies issue Visa and Mastercard cards through banks, but are themselves not regulated financial institutions, meaning they are not subject to the same compliance standards as their banking partners.
Dock denied any relationship with WantToPay, and the financial firm said it had canceled cards it believed were tied to illicit activity. In a statement, the company said customers must comply with mandatory know-your-customer requirements.
The growing chain of custody of my card illustrated how illicit actors can use crypto to exploit gaps between companies responsible for issuing cards and those responsible for enforcing financial rules.
On Telegram and elsewhere, I was able to identify 24 additional companies advertising anonymous Visa and Mastercard products funded by stablecoins, with spending limits up to US$30,000 (RM122,490). The companies are incorporated in countries across the globe, including Costa Rica, Malta, Georgia, Kazakhstan and Russia, according to corporate filings and government records. Most rely on automated Telegram bots to manage customer sign-ups and transactions.
Limited jurisdiction
In July, President Donald Trump signed the GENIUS Act, which was described as the United States’ first major piece of crypto legislation. It established a federal regulatory system for stablecoins, defined rules to ensure financial stability and created compliance programs intended to combat illegal activity and sanctions violations.
Circle, the second largest issuer of stablecoins, praised the law, saying it showed the federal government was modernising anti-money-laundering rules for the digital era.
In an interview, Dante Disparte, an executive at Circle, said the company cooperated with law enforcement agencies to freeze assets when violations were identified. He added that cryptocurrency offered users a greater presumption of innocence than traditional finance.
A spokesperson for Tether said in a statement that criticisms related to illicit finance overlooked the fact that blockchain transactions were far more traceable than cash, and that most illicit activity occurred in secondary markets outside its control. The company emphasized that it worked closely with global law enforcement agencies and that it had helped to freeze more than US$3.4bil (RM13.88bil) in illicit funds.
But critics argue the law has limits. The regulations apply primarily to US-based exchanges such as Coinbase, which must verify customers and monitor transactions. Yet funds can still move freely through offshore platforms, unregulated coins and decentralised finance systems that face none of those requirements.
Tether, which has more than US$180bil (RM734.94bil) worth of stablecoins in circulation, is based in El Salvador and would not be covered by the new rules. The company holds more than US$112bil (RM457.30bil) in US Treasurys, and any law enforcement action against Tether could potentially risk destabilising important financial markets.
The picture is further complicated by political and financial ties surrounding Tether. The company has close connections to the family of Commerce Secretary Howard Lutnick, who is responsible for restricting exports of sensitive US technology – restrictions that people can try to sidestep by making transactions with stablecoins like Tether.
One of Lutnick’s sons, Brandon, is the chair of Cantor Fitzgerald, which provides services to Tether, placing the family in a position where the company behind the world’s largest offshore dollar token intersects with a key federal enforcement role. Another son, Kyle, is executive vice chair of the firm.
Cantor Fitzgerald and the Commerce Department declined to comment.
Efforts to police the offshore crypto ecosystem have repeatedly fallen short. A Kyrgyz company this year introduced dollar-backed Visas and Mastercards bought with stablecoins pegged to the ruble. Even after the United States and Europe placed sanctions on the ruble-pegged coin, known as A7A5, and its issuer, supporting banks, exchanges and the oligarch tied to its development, the token continues to circulate.
Shortly before US authorities placed sanctions this year on the main exchange that traded A7A5, it quietly transferred tens of millions of dollars in stablecoins to new wallets that had not been identified by authorities to be seized under the sanctions, according to a Times review of blockchain activity. – ©2025 The New York Times Company
This article originally appeared in The New York Times.