$107M Crypto Laundering scheme in South Korea using tuition and surgery

Key Points

• Customs officials uncovered a cross-border money laundering investigation tied to cosmetic surgery payments
• Operators routed funds through crypto exchanges, then converted proceeds to Korean won using local accounts
• Transactions disguised as tuition and medical fees across borders from 2021 through 2025
• Authorities linked the activity to foreign exchange violations involving three Chinese nationals

$107 million in crypto laundering was the core issue for investigators working on this developing case in South Korea.

Authorities report three Chinese nationals were involved in an advanced scheme that utilized several financial conduits. The ring used flow descriptions such as tuition payments and cosmetic surgery payments to avoid a closer examination by authorities. Funds were sent to other countries via crypto exchanges and then transferred back into Korean Won to the account holders’ bank accounts.

Using investigative methods, investigators looked for patterns across many transfers, and the fact that many of the invoices had differing information about the recipient’s address, etc. South Korean Customs described the case as an international money laundering case, involving foreign exchange violations, which circumvented normal documentation requirements. The investigation spanned over two years (late 2021 through mid 2025) across several corridors.

The ring disguised their true intentions behind the tuition payments by using the same description for cross-border invoices as “normal service” payment arrangements for families and students. The ring would use the invoice description to conceal large transfer amounts associated with stable digital assets and send the funds through crypto exchanges with a series of small, fragmented orders so they could be less visible to others. The funds were then converted back into Korean Won and deposited into Korean Won bank accounts connected to the ring’s local facilitators.

Agents identified repetitive tuition references that didn’t match the students’ enrollment records at the listed schools. Similarly, agents noted cosmetic surgery payments were repeatedly made without any evidence of corresponding clinic appointments or recovery schedules. South Korean Customs now works with cooperating agencies to verify the identities and narratives of the parties involved in the money laundering investigation and identify additional parties who have been identified in the related bank records.

How the Ring Disguised the Money Laundering

Agents noted that tuition terms moved with exchange rates, rather than school calendars. Agents observed that the fees paid were directly correlated with the price of the tokens during the periods of heaviest trading. Similarly, cosmetic surgery payments also occurred around weekends, when clinics reported fewer active procedures. The agents believe the ring timed their conversions to take advantage of more favorable crypto exchange conditions. The investigators mapped the ring’s wallet activity and traced the activity back to the ring’s local cash withdrawal within a few hours.

The agents believed the ring attempted to limit their exposure to market swings and raise red flags regarding structured flows. The ring’s approach used volume, speed, and repetition throughout a network of accounts. South Korean Customs reports the ring’s objective was to create a consistent narrative that would create a sense of normalcy around an otherwise abnormal set of patterns.

ANOTHER MUST-READ ON ICN.LIVE

OpenAI is using a new revenue strategy with ads, pricing, and privacy focus

Key Phrase and the $107M Crypto Laundering Timeline and Scope

South Korean Customs reports the ring began its activities in September 2021 and continued until June 2025. The ring’s early transfers were of lower value, but the ring’s confidence in their ability to launder money without being detected grew, so did their volumes. The ring’s volumes increased when they discovered banks willing to allow them to process their transactions with less scrutiny. The ring used multiple crypto exchanges to split their trades across various pools of liquidity to help keep their large orders under the radar of automated monitoring systems.

After the ring received the cryptocurrency, the ring would convert the funds into Korean Won and disperse the funds to various personal and business accounts. Many of the accounts receiving the funds experienced rapid inflows and outflows of funds within very narrow time frames. The agent’s experience indicated the pattern was consistent with the typical placement and layering techniques associated with other similar money laundering schemes.

Why this Case is Important to Compliance Teams

Regulatory bodies are increasing pressure on financial organizations to comply with regulations regarding foreign exchange violations in cross-border payments. To help increase compliance, compliance teams should compare the descriptions in invoices against external databases to provide a more accurate level of validation. Compliance teams should ensure that tuition descriptions mirror academic calendars and common fee structures within targeted areas. They should ensure that cosmetic surgery payments align with clinic schedules and reasonable recovery timelines. Also, ensure that their banks implement stricter controls if crypto exchange references are identified during onboarding checks.

ANOTHER MUST-READ ON ICN.LIVE

Practical Steps for Businesses and Schools

Businesses should evaluate the legitimacy of service invoices that reference tuition or cosmetic surgery payments from outside their country. Schools should audit enrollment verification requests that seem irregular with the typical student timeframe. Medical clinics should confirm the source of deposits when transfers from outside the country occur through unknown intermediate parties. Payment processing companies should correlate wallet addresses with known exchange clusters and off-ramp nodes.

Auditors should select a random sample of transactions where the conversion to Korean Won occurs rapidly after the receipt of crypto inflows. Companies should include questions regarding crypto exchanges in high-risk onboarding questionnaires. Companies should maintain records of the claimed services and supporting documentation showing a direct connection to the actual event. These steps will limit your company’s exposure and improve your company’s defense mechanisms during any money laundering investigation.

Institutions Providing Financial Services

From my perspective, the most obvious lesson is related to speed, repetition, and the story created and told consistently across all channels. The ring believed that the stories it provided for each channel would move faster than the standard review processes of the authorities. Stronger controls can disrupt that rhythm through verifications, data-sharing, and improved sequence logic. Institutions providing financial services should verify the legitimacy of a claimed service prior to releasing funds when tuition or medical invoices arrive. Compliance teams should establish rules that link narrative text with timing patterns to identify potential masking.

South Korean Customs points to cooperation as the primary factor that assisted in identifying the parties involved in this money laundering scheme. Regional cooperation can assist in tracking the flow of funds from exchange wallets to local accounts within hours. This provides the opportunity for authorities to connect the stories presented with the facts without allowing the patterns to solidify. Better validation prevents money laundering schemes from reaching the size and complexity demonstrated in this case.