SECTION 1: WHAT IT IS

Definition and Ecosystem Role

Cryptocurrency exchanges and their associated money launderers are the primary crypto-to-fiat conversion layer of the ransomware supply chain. They are the terminal interface between the illicit cryptocurrency world and the legitimate financial system — the point at which ransomware proceeds are converted to usable fiat currency, stablecoins, or alternative assets that can feed mule networks, OTC settlement, or direct banking. Node 02 is rated CRITICAL in the EDP Dependency Map alongside Node 01 (OTC Brokers): without a functional exchange-based off-ramp, ransomware proceeds remain stranded in cryptocurrency, subject to ongoing blockchain forensic tracing and OFAC pressure.

The exchange ecosystem for ransomware laundering encompasses three operationally distinct tiers: mainstream regulated centralized exchanges (CEXs) that receive criminal funds via straw-man accounts and nested OTC brokers despite active compliance programs; high-risk and sanctioned exchanges (Garantex/Cryptex-type) that provide permissive or fake KYC and operate under jurisdictional protection; and dedicated underground VASPs and nested exchanges whose core business is laundering for ransomware, fraud, and darknet markets.

CONFIRMED Chainalysis data for 2024 documents that centralized exchanges accounted for approximately 39% of all ransomware off-ramping — slightly above the 2020-2024 average of 37% — remaining the single largest laundering category despite all enforcement activity against this tier. This persistence is the module's central analytical paradox: enforcement pressure on mixers and some exchanges increased ransomware actors' reliance on compliant CEXs (via intermediary layers) rather than eliminating it.

How It Functions: Canonical Ransom-to-Fiat Flow

The canonical 2024-2025 ransomware laundering flow, per Chainalysis and TRM Labs typologies:

• Step 1: Victim pays ransom to attacker-controlled wallet address, typically in Bitcoin or USDT. Payment addresses are generated by the ransomware implant or provided via negotiation interface.
• Step 2: Funds move through intermediary wallets using peel chains — small slices peeled off through a series of controlled addresses — combined with time delays and amount randomization to reduce simple heuristic attribution.
• Step 3: Optional obfuscation via mixers (declining share post-ChipMixer/Sinbad/Tornado enforcement) or increasingly via cross-chain bridges and DEX swaps (BTC to ETH, USDT, or TRX) to break chain-specific forensic heuristics.
• Step 4: Consolidated at CEX or high-risk exchange accounts controlled by money launderers or OTC broker nested desks. Accounts are opened using straw-man identities, forged KYC documents, or legitimate accounts purchased from mule account suppliers.
• Step 5: Final off-ramp — swap to fiat or local stablecoin, then withdraw via bank wire, payment processor, or local cash network. High-risk exchanges in permissive jurisdictions allow this step with minimal friction; at compliant CEXs it requires the mule/straw-man account layer.

ANALYST INFERENCE A documented behavioral adaptation: CyberScoop reporting notes that some ransomware operators let crypto "sit in wallets" for extended periods rather than moving funds to exchanges — indicating that tracing risk at exchange off-ramps is producing a behavioral deterrence effect consistent with the EDP Phase A mechanism. Funds parked in wallets are not yet converted to usable criminal proceeds, representing a partial enforcement win even before formal OFAC action.

Why Exchanges Remain the Dominant Off-Ramp

Three structural factors sustain exchange dominance in ransomware laundering despite sustained enforcement. First, liquidity: deep order books at major CEXs allow large ransom amounts (six to seven figures) to be converted with minimal slippage — a capability that mixers, OTC brokers, and DEXs cannot replicate at equivalent scale and speed. Second, jurisdictional coverage: the global distribution of exchange operators creates a persistent regulatory arbitrage gap where enforcement in one jurisdiction pushes activity to permissive alternatives rather than eliminating it. Third, the nested intermediary model: money launderers and OTC brokers insert themselves between ransomware operators and exchange accounts, absorbing KYC risk and allowing compliant CEXs to process illicit flows without directly implicating the exchange.

CREDIBLE Chainalysis notes a concentration risk pattern: for high-risk exchange categories, bridges, and sanctioned entities, a small number of services capture a disproportionately high share of ransomware flows. This concentration makes these services strategic chokepoints — OFAC designation of a single dominant high-risk exchange produces ecosystem-wide disruption disproportionate to the size of the designated entity.

SECTION 2: KEY ACTORS AND EXAMPLES

Exchange Tiers and Named Actors

Comparative Role Table: Exchanges vs. Mixers vs. OTC Brokers

Embargo Ransomware Case Study: Exchange Flow Documentation

CONFIRMED TRM Labs and CryptoNews documented a detailed flow for Embargo ransomware activity from April 2024 through mid-2025. Total ransom-linked crypto tracked: approximately $34M. Approximately $13.5M moved through various VASPs at various stages of the laundering chain. More than $1M transited through Cryptex.net — a sanctioned high-risk exchange — before further distribution. The case illustrates how a mid-tier ransomware group (Embargo had a significantly smaller victim footprint than LockBit or RansomHub) still accessed sanctioned exchange infrastructure for a meaningful share of its laundering volume.

CONFIRMED Garantex documentation by TRM Labs establishes the exchange as a systemic node rather than an incidental participant: Ryuk ransomware alone laundered more than $2.3M through Garantex; the exchange also processed significant flows from Conti and LockBit, the two largest ransomware programs by revenue during their operational periods. Garantex's role as a ruble-liquidity hub for Russian-speaking cybercriminal groups — combined with its FSB-adjacent state protection — made it the clearest available proof of concept for the EDP Phase A exchange disruption model.

SECTION 3: INFRASTRUCTURE DEPENDENCIES

Upstream Dependencies

Mixing and obfuscation layer (Node 08 / Module 11): Mixer outputs feed exchange deposits after obfuscation. Post-enforcement (ChipMixer 2023, Sinbad 2023), the share of mixer-to-exchange flows declined; cross-chain bridge-to-exchange flows increased to compensate. Mixer disruption pushes flows toward exchanges with less obfuscation, increasing forensic traceability at the exchange deposit point.

OTC brokers and nested desks (Node 01 / Module 12): OTC desks operate nested accounts within CEXs, absorbing KYC compliance risk on behalf of ransomware operators. From the exchange's perspective, the deposit comes from a (sometimes legitimate-appearing) OTC account; from the forensic perspective, the chain traces back to ransomware wallets. OTC disruption forces ransomware operators to interact with exchange KYC directly or use lower-quality straw-man accounts.

Cross-chain bridges and DEXs: Increasingly used as pre-deposit layering between ransomware wallets and exchange accounts. Chainalysis notes that private-key compromise incidents (APT-linked heists and some ransomware) prefer bridges and mixers, while other ransomware attack vectors lean more on DEXs and direct exchange deposits. Bridge disruption (OFAC designation of smart contracts) reduces this layering option and increases forensic visibility of exchange deposits.

Underground forums (Node 07 / Module 10): Nested and underground VASP operators advertise services on Exploit, XSS, and RAMP. Forum disruption degrades the primary discovery channel for criminal-facing exchange services — reducing new criminal client acquisition for underground VASPs.

Downstream Dependencies

Mule networks (Node 09 / Module 14): Exchange-to-fiat conversion proceeds feed mule network accounts for layering and integration. The exchange is the bridge between the crypto and fiat worlds; mule networks handle the fiat-side layering after withdrawal. Exchange off-ramp disruption reduces the fiat volume entering mule pipelines.

Local banking relationships: High-risk exchanges depend on maintaining correspondent banking access for fiat withdrawal. Banking de-risking pressure — where correspondent banks terminate relationships with high-risk exchanges following OFAC designation — is a force multiplier for exchange enforcement that does not require direct seizure.

Stablecoin issuers (Tether/USDT, Circle/USDC): Stablecoin conversion at exchanges is an increasingly common intermediate step before fiat withdrawal. Tether blacklisting authority (demonstrated in the Khinkis/Module 12 context) and Circle's equivalent USDC freeze capability can intercept stablecoin holdings at exchange accounts before fiat withdrawal.

Critical Chokepoints

Cross-Module Linkages

SECTION 4: DISRUPTION LEVERAGE POINTS

Primary Leverage Points

Compounding Actions

• The concentration risk pattern documented by Chainalysis is the primary targeting argument: when a small number of high-risk exchanges capture a disproportionate share of ransomware flows, each designation produces ecosystem-wide disruption disproportionate to the size of the designated entity. OFAC should prioritize identification and designation of the current dominant high-risk exchange rather than distributing enforcement effort across many smaller services.
• Coordinate Node 02 (exchange) designation with simultaneous Node 01 (OTC broker) action. Designating an OTC broker while the exchange hosting its nested accounts remains operational creates displacement, not disruption. Simultaneous or closely sequenced pressure on both nodes closes both primary off-ramp channels at once — the mechanism consistent with the 2024 payment decline.
• The three-year gap between Garantex's OFAC designation (April 2022) and physical shutdown (April 2025) demonstrates that designation-only action is insufficient for RU-domiciled exchanges. Policy should institutionalize a physical enforcement follow-up track for designated RU-based exchanges with confirmed continued operation post-designation.
• Mixer enforcement compounds exchange targeting: ChipMixer and Sinbad enforcement reduced mixer obfuscation coverage, pushing ransomware flows toward bridges and direct exchange deposits with less obfuscation. Each additional mixer enforcement action slightly increases the forensic traceability of funds reaching exchange accounts.
• Extend the Garantex-successor identification task (established in Module 12) to include exchange-tier successors. The same ruble-liquidity gap created by Garantex's April 2025 shutdown applies at the exchange level; the successor exchange is the next Phase A designation priority.

SECTION 5: RESILIENCE AND REPLACE DIFFICULTY

Replace Difficulty Assessment

Node 02 carries a HIGH replace difficulty rating in the EDP Dependency Map — the highest tier alongside Nodes 01 (OTC Brokers) and 03 (BPH). This rating reflects the structural factors that make exchange-based fiat conversion difficult to replace: liquidity depth (large CEXs provide fiat conversion capacity that mixers, OTC desks, and DEXs cannot replicate), global jurisdictional distribution (enforcement in one jurisdiction pushes activity to alternatives rather than eliminating it), and the persistent demand for fiat currency (cryptocurrency proceeds that cannot be converted to fiat provide limited criminal utility).

The key distinction within the HIGH aggregate rating is between compliant CEXs (which are highly resilient because they cannot be designated without disrupting legitimate operations) and high-risk/sanctioned exchanges (which are medium-difficulty to replace, since they provide specialized permissive services that take time to rebuild in a new entity). The Garantex-to-successor gap is the empirical test: how long does it take the criminal ecosystem to identify and trust a new dominant high-risk exchange following a physical takedown?

Historical Reconstitution Record

The "Wallet Sitting" Behavioral Adaptation

CREDIBLE CyberScoop reporting documents a notable behavioral adaptation: some ransomware operators are allowing crypto proceeds to sit in wallets for extended periods — or refraining from moving funds entirely — rather than risking tracing when interacting with exchanges. This "wallet sitting" behavior represents a partial enforcement win: funds parked in cryptocurrency are not yet converted to usable criminal proceeds, and extended wallet dwell time increases the forensic window available for blockchain analytics attribution before cash-out.

ANALYST INFERENCE If "wallet sitting" becomes structurally prevalent, it suggests the Phase A exchange enforcement mechanism is producing a deterrence effect that extends beyond the specific designated entities — ransomware operators are modifying behavior in response to the perceived tracing risk at exchange off-ramps generally, not just at designated exchanges specifically. This would represent a positive behavioral externality from targeted enforcement that the EDP framework should track as an indicator of ecosystem-wide pressure effectiveness.

SECTION 6: INDICATORS AND KPIs

Ecosystem Health Indicators

Disruption KPIs

Alert Thresholds

SECTION 7: SOURCES AND CONFIDENCE

Primary Sources

Blockchain Analytics and Financial Intelligence:

• Chainalysis — "Crypto Ransomware 2025: 35.82% YoY Decrease in Payments": 2024 revenue ($813.55M); 39% CEX share; mixer decline; bridge/DEX shift; concentration risk documentation; historical 37% average; primary quantitative source for exchange off-ramp data.
• Chainalysis — "Ransomware Hit $1 Billion in 2023" and 2024 Crypto Crime Trend reports: concentration on high-risk services; Garantex exposure; role of exchanges across multiple ransomware families.
• TRM Labs — "Ransomware in 2024: Latest Trends" and Garantex takedown analysis: peel chains; cross-chain laundering typologies; Garantex "key role in laundering ransomware proceeds" (Ryuk >$2.3M, Conti, LockBit); $2.2B stolen in 2024 crypto hacks.
• TRM Labs / Cointelegraph / CryptoNews — Embargo ransomware case: $34M tracked since April 2024; $13.5M through various VASPs; >$1M via Cryptex.net; cross-chain flow documentation.
• TRM Labs — "$2.2B Stolen in Crypto in 2024" and "Proportion of Illicit Volume Dropped 51%": macro context for illicit flow volumes and exchange role in post-heist laundering.

Media and Government Coverage:

• CyberScoop / Wired — coverage of Chainalysis 2024 ransomware findings: "wallet sitting" behavioral adaptation; 35% payment decline attribution.
• Europol — Garantex shutdown press release (April 2025): server seizure, domain takeover, operator charges; physical enforcement documentation.
• OFAC — SDN designation documentation: SUEX (September 2021), Garantex (April 2022), Cryptex (2024); designation rationale and criminal flow attribution.

Academic:

• Tandfonline academic article — "From prepaid cards to bitcoin: How did ransomware hackers adopt cryptocurrencies?": historical drivers for crypto adoption in extortion; structural role of centralized exchanges in ransomware monetization evolution.

Confidence Assessment by Topic

Intelligence Gaps

• Garantex successor exchange: No confirmed dominant high-risk exchange absorbing Garantex's ruble-liquidity function has been publicly identified as of April 2026. This is the highest-priority gap for next Phase A designation action.
• Straw-man account supply chain for compliant CEXs: The specific criminal supply chains providing straw-man and mule accounts to compliant CEX KYC processes are not systematically documented. Understanding this supply chain would allow more precise disruption targeting at the account supply level rather than the exchange level.
• Wallet dwell time baseline: No quantified baseline for average ransomware wallet dwell time before exchange deposit exists in open sources. Establishing this baseline would allow measurement of the behavioral deterrence effect and its correlation with specific enforcement actions.
• Underground VASP operator identities: Nested and underground VASP operators advertising on top-tier Russian forums are not publicly identified in open sources. These operators are the primary mechanism for routing ransomware funds through compliant CEX accounts.

SECTION 8: ANALYST ASSESSMENT

Key Takeaway

Module 13 contains the central paradox of the EDP financial disruption framework: CEX share of ransomware off-ramping slightly increased in 2024 (to 39%, above the 37% historical average) even as the overall ransomware payment volume fell 35%. These two findings are not contradictory — they reflect the same enforcement mechanism operating correctly. Mixer and high-risk exchange enforcement pushed ransomware operators toward compliant CEXs via more complex intermediary chains (OTC nested desks, bridges, straw-man accounts), reducing total payment volume while increasing the CEX share of the remaining flows. The enforcement is working. The implication is not to target compliant CEXs but to tighten the intermediary account supply chains — nested OTC desks and straw-man account suppliers — that provide access to compliant CEX liquidity.

The Garantex enforcement sequence is the definitive proof of concept for Phase A exchange action. The three-year gap between OFAC designation (April 2022) and physical shutdown (April 2025) is the most important operational lesson from the entire financial enforcement record: designation-only is insufficient for RU-domiciled exchanges. Physical enforcement, operator prosecution, and correspondent banking de-risking must follow designation within 12-18 months to produce durable disruption. The Garantex successor — whatever exchange is now absorbing displaced ruble-liquidity flows — is the immediate next Phase A priority, and it should be designated and physically targeted faster than the Garantex timeline.

Priority Recommendation

Immediate: Identify the Garantex successor exchange and initiate designation. The April 2025 Garantex shutdown created the largest ruble-liquidity gap in the RU criminal exchange ecosystem since the SUEX designation in 2021. Priority tasking to FVEY blockchain analytics partners (Chainalysis, TRM Labs) to identify RU-based exchange activity absorbing post-Garantex displaced volume. Target designation within 6 months of identification rather than the 12-month historical average — the criminal ecosystem reconstitutes faster with each successive disruption.

Near-term: Institutionalize the physical enforcement follow-up track for OFAC-designated RU-domiciled exchanges. The Garantex lesson — that designation alone allows three years of continued operation within Russia — should produce a policy commitment: any RU-based exchange designated by OFAC that continues operating within Russia should be escalated for Europol-model physical enforcement within 18 months of designation. This commitment would deter successors from establishing RU-domiciled operations assuming designation-only exposure.

Medium-term: Develop a straw-man account supply chain disruption program targeting the mechanism through which ransomware operators access compliant CEX liquidity. The 39% CEX share cannot be reduced by targeting exchanges directly — it requires targeting the intermediary account supply (nested OTC desks, straw-man account suppliers, mule account sourcing for CEX KYC). Coordinating behavioral biometrics vendors (BioCatch), exchange compliance teams, and FinCEN on account-pattern-based detection and suspension is the structural mechanism.

Sequencing note: Phase A Node 02 (exchange) and Node 01 (OTC broker) actions must remain closely coordinated. The 2024 35% payment decline reflects simultaneous pressure on both nodes — designated exchanges and OTC brokers, combined with improved exchange compliance integration. Allowing either node to remain without designation coverage for more than 18 months creates a displacement rather than disruption effect.

Connection to EDP Disruption Playbook

Node 02 (High-Risk/Non-Compliant Exchanges) is a Phase A node alongside Nodes 01 (OTC Brokers) and 03 (BPH). It forms the financial foundation of the EDP disruption framework: without functional exchange off-ramps, the entire ransomware supply chain — from stealer-log acquisition through RaaS deployment to extortion — produces cryptocurrency proceeds that cannot be converted to usable criminal wealth.

The 2024 payment decline is the empirical validation of the Phase A playbook. Coordinated OFAC action against Garantex and Cryptex (Node 02), combined with OTC broker enforcement (Node 01) and mixer actions (Node 08), produced a 35.82% year-over-year revenue reduction — the most significant ecosystem-level disruption metric in the EDP dataset. This compound effect is the core argument for Phase A coordinated action rather than sequential single-node targeting: each additional designation amplifies the effect of prior designations by closing alternative off-ramp channels.

Dependency Map Update Recommendations

Follow-On Research

• Identify Garantex ruble-liquidity successor at exchange tier: separate tasking from Module 12 OTC-tier successor identification; blockchain analytics priority to identify RU-based exchange absorbing post-April 2025 displaced criminal volume.
• Establish ransomware wallet dwell time baseline: task Chainalysis and TRM Labs to quantify average dwell time between ransom payment receipt and first exchange deposit across attributed 2024-2025 ransomware flows; correlate with specific enforcement action dates.
• Map straw-man account supply chain for compliant CEX access: identify the criminal supply chains (mule account suppliers, identity document forgers, underground VASP operators) providing KYC-passing accounts to ransomware operators for compliant CEX deposits.
• Assess bridge and DEX OFAC designation pipeline: identify the specific cross-chain bridge protocols most heavily used in 2024-2025 ransomware pre-exchange obfuscation; assess each for OFAC designation viability under Tornado Cash precedent.
• Model Phase A compound action marginal effect: using 2024 data as baseline, model the marginal revenue reduction effect of each additional Node 01/02/08 designation — distinguishing compound action multiplier from single-node effect.