CRYPTOCURRENCY
Crypto giant Tether promised careful vetting. Some early customers were later implicated in financial crimes.
Financial records obtained by ICIJ show that they included individuals later accused of or sanctioned for money laundering and other financial crimes.
During a two-month period in 2020, a Russian man named Nikita Krasnov purchased about $1.16 million worth of newly minted USDT — the widely used stablecoin made by the cryptocurrency company Tether. A little more than four years later, Krasnov was sanctioned by U.S. authorities for his role in an expansive sanctions evasion scheme catering to Russian elites.
It’s a story that repeats itself across Tether’s customer base. Tether’s USDT token, whose value is pegged 1-to-1 to the U.S. dollar, has become one of the most widely used types of cryptocurrency in illicit finance. But the 12-year-old company has long claimed that it does thorough due diligence on its primary customers — that is, the people and institutions who purchase USDT directly from Tether, rather than from secondary sources once the tokens are in general circulation. In a 2023 letter, Tether CEO Paolo Ardoino assured members of Congress that the company uses vetting practices that “you would see at sophisticated financial institutions,” such as reviewing customers’ sources of funds, sanctions lists and any other information that links them to illicit activity.
A set of Tether documents obtained by the International Consortium of Investigative Journalists suggests otherwise. The documents show who was buying USDT tokens from Tether during 2019 and 2020 — a key period of growth for the company, when its tokens in circulation rose from less than $2 billion to more than $20 billion.
Although several years old, the records give a rare look into exactly who was buying USDT from Tether. Among them were some possibly concerning clients. These included hundreds of millions of dollars in purchases by shell companies based in the Cayman Islands, British Virgin Islands, the Seychelles and Hong Kong. More significantly, ICIJ identified several actors later revealed to be involved with financial crimes who together bought tens of millions of tokens directly from Tether. Among them were firms later named as laundering vehicles for North Korean hackers and for the Sinaloa Cartel, which smuggles vast amounts of heroin and fentanyl into the United States.
While Tether sold tokens to these customers years before their alleged crimes came to light publicly, the transactions raise questions about how closely Tether scrutinized the buyers. The purpose of thorough customer vetting goes beyond identifying known lawbreakers; its aim is also to understand customers’ sources of wealth and the nature of their business in order to detect fishy activity, especially when dealing in millions of dollars, according to experts.
“A lot of due diligence is to prevent you from onboarding a customer who later turns out to be a criminal,” Alison Jimenez, an anti-money laundering expert, told ICIJ. “You need to understand where the $50 million came from.”
In the documents examined by ICIJ, the identities of some of Tether’s customers are obscured behind shell companies in offshore tax havens known for secrecy. Others went on to become prominent players in crypto markets.
Perhaps the most infamous Tether customer is Alameda Research, which was co-founded by Sam Bankman-Fried, and was closely tied to Bankman-Fried’s FTX crypto exchange. Bankman-Fried is now serving a 25-year federal prison sentence for crimes related to his looting of more than $8 billion from FTX customer accounts. During the 17-month period recorded in the documents, Alameda Research — which served multiple, and sometimes conflicting roles, as a crypto hedge fund, a venture capital firm and a market-maker — purchased more than 4.1 billion USDT tokens directly from Tether.
As chronicled in other journalistic investigations and in Bankman-Fried’s own court trial, Alameda performed an essential role in buying billions of dollars’ worth of USDT from Tether and then putting them into wider circulation. A 2021 report on the website Protos named Alameda Research and a number of Tether’s other institutional customers.
The documents ICIJ obtained also list a group of previously-unknown buyers later linked to serious financial crimes. Tether directly did more than $100 million in deals with a pair of Hong Kong shell companies that a group of sanctions authorities from 11 countries say was used to access banking services and launder cryptocurrency proceeds for a notorious hacking and ransomware group run by North Korean intelligence operatives.
One of these companies, Lucky DC Trade Pty Limited, purchased nearly $47 million in USDT straight from Tether in 2020. Lucky DC’s director, Cheng Hung Man, was indicted by a federal grand jury in 2022 for laundering money for Pyongyang. The sanctions authorities said Cheng also used a firm called Tomorrow Good Limited to launder funds. That company purchased more than $66 million in USDT directly from Tether in 2019, according to the Tether sales document. It also appeared in a 2024 indictment of Sinaloa Cartel members that described how the Mexican drug gang laundered funds using USDT.
The documents also show that a Cayman Islands firm called AP Capital Investment Limited purchased $23.7 million in USDT directly from Tether in 2020. A few years later, it was cited in a Vietnamese case in which two men were sentenced to prison for an illicit trading scheme involving USDT, according to press reports from 2024.
“The case referred to solely concerns the conduct of certain local individuals,” Chris Humphries, a Cayman Islands attorney representing AP Capital Investment Limited told ICIJ. “The case is suspended with regard to the company due to insufficient evidence.”
Another early Tether customer, Ianis Antropenko, was indicted in 2024 on federal charges of targeting healthcare facilities and educational institutions with ransomware. Antropenko’s guilty plea earlier this year included an agreement to forfeit $1.4 million in USDT as well as other cryptocurrencies.
Krasnov, the Russian Tether customer who was sanctioned in 2024, played a key role in the criminal organization targeted in Operation Destabilise, the U.K. National Crime Agency’s largest anti-money laundering operation in a decade. The Economist magazine later pointed to the case in an article that called Tether’s stablecoin a “money launderer’s dream currency.” Krasnov’s direct purchase of tokens from Tether in 2020 has not been previously reported.
The Tether sales document does not include the wallet addresses — the crypto equivalent of a bank account number — that the firm’s customers used to receive the USDT they purchased. But ICIJ matched the dollar amounts and dates of dozens of the sales to specific transactions recorded in public blockchain data. The analysis shows that one of the wallet addresses Krasnov used to receive tokens from Tether was named by the U.S. Treasury Department in 2024 as a key money laundering account.
ICIJ also matched the transactions of two other Tether customers that the sales document lists as Russian nationals who together purchased more than $57 million tokens from Tether. These two customers used another wallet address that Krasnov used to receive USDT, although that wallet was not later sanctioned. The common address suggests those two customers were part of the same financial network as Krasnov, according to Paul Sibenik of Cryptoforensic Investigators, who reviewed the data at ICIJ’s request. Attempts to reach Krasnov were unsuccessful.
Tether says it subjects its direct customers to strict vetting. As for tokens that are acquired in general circulation by bad actors, Tether touts its work with law enforcement to freeze billions in illicit fund flows and its assistance in law enforcement investigations has become highly sought-after by agencies around.
“Tether has a long record of voluntarily assisting law enforcement agencies with investigations involving illicit activity,” the firm recently told ICIJ. Government investigators and crypto analysts who they work with have described Tether’s assistance in fast-moving crypto investigations as invaluable and say the company has been in some cases more responsive to law enforcement needs than other issuers of stablecoins.
Tether did not respond to requests to comment for this story.
Although Tether is supposed to hold one dollar in cash or cash equivalents, like U.S. Treasury bills, for each USDT token it mints, the company has been accused of issuing USDT without 1-to-1 dollar backing. In 2021, the Commodity Futures Trading Commission fined Tether $41 million for issuing misleading statements about its dollar reserves. New York’s attorney general also required Tether and Bitfinex, its affiliated crypto exchange, to pay $18.5 million in penalties for making false statements about Tether’s backing and ordered the firms to discontinue trading activity with New Yorkers.
Tether went on to buy billions of dollars’ worth of U.S. Treasuries with the help of Cantor Fitzgerald, the New York-based financial firm whose former chairman and CEO, Howard Lutnick, serves as President Trump’s commerce secretary. One of Lutnick’s sons, Brandon Lutnick, succeeded his father as chairman of Cantor Fitzgerald, which reportedly bought rights to a 5% interest in Tether, and has said that he personally verified Tether’s reserves.
As USDT surged to become a cornerstone of the crypto economy, Tether made deep inroads in politics, establishing its headquarters in bitcoin-friendly El Salvador and hiring former Trump crypto adviser Bo Hines.
One of the largest buyers of USDT in the records ICIJ reviewed is the eccentric Chinese entrepreneur Justin Sun, founder of the Tron blockchain, where about half of all USDT tokens now circulate. From April 2019 to March 2020, Sun purchased more than $214 million worth of USDT from Tether. Sun has had his hands in many pots, from advising the sanctioned crypto exchange HTX to participating in crypto projects at a Chinese school that trains future Communist Party leaders. During the Biden administration, the SEC accused Sun of selling unregistered securities and “fraudulently manipulating the secondary market for TRX,” his Tron token, which Lindsay Lohan, Jake Paul, and six other celebrities were allegedly quietly paid to promote alongside BTT, another Sun-affiliated token.
Later, Sun became one of the biggest buyers of the TRUMP memecoin and World Liberty Financial’s WLFI token. Earlier this year, the SEC resolved the case by dismissing its claims against Sun while one of his companies, Rainberry, agreed to pay a $10 million penalty. (Sun has since sued World Liberty Financial, claiming the Trump family crypto company stiffed him.)
Other Tether customers who appear in the documents obtained by ICIJ were later fined by U.S. regulators or arrested by foreign authorities. In 2023, Nexo Capital, a Cayman Islands-based crypto firm with more than $11 billion in assets under management, agreed to pay a total of $45 million in fines, divided equally between the SEC and regulators in multiple states.
A spokesperson for Nexo said that both “matters were concluded on agreed terms in 2023 and have been closed since” and that the regulatory actions had no bearing on the firm’s purchase of Tether tokens.
A company owned by Zhao Dong, a Chinese crypto trader and Bitfinex shareholder, received approximately $1.5 million worth of USDT over eight days in 2020. Chinese authorities later arrested him for suspected money laundering; he was convicted and spent several years in prison.
UKDE, which acquired roughly $867,000 worth of USDT, was the subject of a consumer warning from the U.K.’s financial regulatory authority in 2023 for providing unauthorized financial services. The company, which had raised at least $12 million in investment capital, has been liquidated, its phone number disconnected. If you go to its old website, ukde.com, you’ll be automatically forwarded to another site that reveals the fate of the former Tether client. It says: “This domain has been seized by the Bergen County Prosecutor’s Office, Financial Crimes Unit.”