How online criminals are turning to unlicensed crypto exchanges and over-the-counter crypto brokers to cash out profits and how crypto forensic firms track them
Criminals are locked in battle with Forensics firms tracking how Treasure Men, privacy wallets and gift cards are used to turn virtual hauls into hard cash Tweets: @dimartinobooth , @paulkrugman , and @mshannahmurphy Tweets: Danielle DiMartino Booth / @dimartinobooth : “Authorities “need to modernise forfeiture and asset freezes” so that it is easier for law enforcement to seize crypto from exchanges.” https://www.ft.com/... Paul Krugman / @paulkrugman : Who says crypto isn't a job-creator? https://www.ft.com/... Hannah Murphy / @mshannahmurphy : In online crime, crypto is the payment method of choice. But virtual hauls still need to be turned into hard cash. Enter the “Treasure Men”. My read on how ransomware gangs launder illicit funds & the growing market for forensics firms that hunt them down https://www.ft.com/...
Context & Ripple Effects
This FT piece maps the last mile of crypto crime — the moment stolen coins become spendable cash through unlicensed exchanges, OTC brokers and the specialists who hunt illicit funds. Forensic firms are profiling the toolkit: Treasure Men, privacy wallets, gift cards — each a bridge off the ledger where blockchain transparency stops helping investigators.
The timing matters: three weeks later the same paper reported ransomware gangs shifting to Monero precisely because they distrust bitcoin's traceability, showing the cash-out problem described here escalating from technique to coin choice. And the Ronin case later demonstrated both sides of the fight — hackers dribbling out funds slowly because the public ledger makes large-scale laundering visible.
First-order effects
- Forensic firms get a clear, monetizable mandate: mapping the specific cash-out instruments (Treasure Men, privacy wallets, gift cards) that convert ransom payments into hard cash.
- Law enforcement's bottleneck shifts to legal process — Danielle DiMartino Booth's call to 'modernise forfeiture and asset freezes' targets the gap where police can see the money on-chain but cannot seize it quickly through an exchange.
Second-order effects
- Exchanges become the enforcement fulcrum: cases like Dark Scandals show prosecutions succeed when exchanges cooperate, so unlicensed brokers and OTC desks exist precisely to route around that cooperation — pushing compliant venues toward stricter screening or losing criminal flow entirely.
- Ransomware operators respond by moving up the anonymity stack, from mixing services to privacy coins like Monero, forcing forensics firms to chase value across chains rather than within one.
Third-order effects
- If cash-out keeps migrating to off-ramp channels — OTC brokers, gift cards, and eventually the cash-to-crypto swap networks that let anyone convert local currency without oversight — regulation pivots from policing the blockchain to licensing the fiat exit points.
- Forfeiture and asset-freeze modernization becomes the structural fix law enforcement argues for: the ability to freeze and seize crypto at exchanges determines whether on-chain visibility translates into recovered funds.
The trend: Crypto crime is becoming a contest over the fiat off-ramp: every improvement in on-chain forensics pushes criminals toward less-regulated conversion channels, dragging regulators toward controlling the exits rather than the ledger.