Polkadot

🔴 High Risk

Polkadot’s relay-chain and parachain architecture, while innovative for interoperability, creates substantial money-laundering vulnerabilities that have drawn intense scrutiny from Swiss and German regulators, positioning DOT as a high-risk asset in cross-chain sanctions evasion and obfuscation schemes. No standalone criminal prosecution singles out Polkadot as the primary laundering vehicle in these jurisdictions, yet forensic analyses explicitly document DOT flows within multi-asset chains used by Russian-linked sanctioned actors to bypass restrictions, routing illicit proceeds through privacy parachains, mixers like Cryptomixer (dismantled in 2025 joint operations), and lightly supervised centralised exchanges before cashing out. Switzerland’s 2023 ML/TF risk assessment flags decentralised networks as systemic threats requiring stringent VASP oversight, while Germany’s BaFin enforces aggressively with record fines (e.g., €45M against J.P. Morgan for AML lapses) and ATM crackdowns, underscoring how Polkadot’s liquidity and bridging amplify exposure to organised crime, ransomware proceeds, and kleptocratic networks in Europe’s financial core.

Polkadot is not currently at the centre of a named, public money‑laundering prosecution in Switzerland or Germany, but both countries’ AML regimes, enforcement activities, and analytical reporting place DOT and the broader ecosystem firmly within a high‑risk category of virtual‑asset infrastructures used in complex laundering and sanctions‑evasion schemes. Swiss authorities explicitly recognise virtual assets and DLT services as significant ML/TF risks and apply stringent AML duties to intermediaries, which by definition applies when those intermediaries handle DOT, whether for Swiss clients or in cross‑border contexts. Germany, through BaFin and BKA, has combined tough supervision of banks and custodians—including record fines for AML failures—with targeted actions against unlicensed crypto ATMs and participation in international takedowns of mixing services that process enormous volumes of illicit crypto. Analytical work on Russian sanctions evasion shows that state‑linked actors have used multiple cryptocurrencies, explicitly including Polkadot’s DOT, as part of multi‑step laundering chains aimed at reaching major centralised exchanges, strengthening the case for treating Polkadot as a relevant vector in sanctions‑evasion risk. While public data do not support a precise estimate of the value laundered specifically through DOT in these two countries, the scale of surrounding infrastructure—mixers handling over 1.3 billion euros of Bitcoin and rising virtual‑asset STR volumes—indicates that the potential exposure is material. Consequently, from an AML‑risk perspective, Polkadot should be considered a significant, though not uniquely criminal, component of the crypto ecosystem that Switzerland and Germany are actively seeking to control and monitor through regulation, supervision, and enforcement.

Countries Involved

Switzerland and Germany both sit at the core of European AML supervision for crypto assets and therefore treat Polkadot‑linked flows as part of their cross‑border risk management rather than as a purely domestic phenomenon. Switzerland positions itself as a global crypto hub with extensive DLT activity in “Crypto Valley,” and FINMA’s guidance explicitly extends AML duties to virtual‑asset service providers that interface with decentralised networks, including those that support tokens like DOT. Germany, by contrast, has taken a more enforcement‑heavy stance through BaFin and the Federal Criminal Police Office (BKA), including coordinated raids on unlicensed crypto ATMs and platforms seen as laundering channels, which by definition include any assets those venues handle. In multi‑country investigations into mixers and complex laundering circuits, Swiss and German agencies often operate together with Europol and Eurojust, dismantling services that obfuscate the origins of crypto funds—services that, in practice, sit between a range of coins, bridges and DeFi protocols, making it plausible that some flows touch Polkadot where it is used in cross‑chain routing. Analytical work on sanctions evasion by Russian‑linked actors highlights the use of EU and non‑EU jurisdictions and multiple intermediaries, noting Switzerland as a frequent satellite jurisdiction, again bringing Swiss‑touching DOT flows inside a wider transnational picture. Germany’s role as both a major financial centre and an EU enforcement hub means that exchanges and custodians serving German clients are obliged to monitor DOT alongside other coins, reflecting both countries’ inclusion in any realistic description of Polkadot‑related ML risk.

Date Discovered / Reported

Instead of a single discovery date, the Polkadot‑related ML risk in Switzerland and Germany emerges gradually from several developments between 2020 and 2025: regulatory publications, risk assessments, and international operations against crypto laundering infrastructure. Switzerland’s 2023 report on money‑laundering and terrorism‑financing risks linked to virtual assets marks a key formal recognition that decentralised networks, non‑custodial wallets, and cross‑chain services collectively raise the country’s exposure to ML, which by construction covers major networks like Polkadot. Around the same period, Germany advances its implementation of EU‑wide frameworks and solidifies its stance under the German Money Laundering Act, culminating in a 2025 record AML fine against J.P. Morgan SE for failing to file timely suspicious‑transaction reports, underscoring how seriously the country now treats crypto‑linked flows going through major financial institutions. On the operational side, joint Swiss–German actions against a major crypto mixing service—Cryptomixer / cryptomixer.io—are announced in late 2025, highlighting how authorities are actively targeting infrastructure used to obfuscate fund origins. While the mixer focused primarily on Bitcoin, law‑enforcement and analytical reports emphasise its role in wider laundering chains that may involve multiple assets and exchanges, into which DOT can be inserted as an intermediate asset. Analytical publications on Russian sanctions‑evasion using various crypto assets, including Polkadot, appear in 2025, explicitly calling out DOT within flows toward major centralised exchanges, which solidifies attention to Polkadot‑linked transfers within European AML monitoring just before 2026.

Cryptocurrency Involved

DOT (Polkadot), plus BTC, major stablecoins and other liquid assets used in multi‑asset laundering chains

Type of Crime

The primary risk types involving Polkadot in Switzerland and Germany fall under money laundering and sanctions evasion, rather than, for example, simple investment fraud or market abuse. Swiss national risk analysis emphasises the potential for crypto to be used to launder proceeds of traditional predicate offences such as drug trafficking, fraud, corruption and cybercrime, with the virtual‑asset layer serving as a cross‑border, pseudonymous channel for moving value away from the reach of law enforcement. In transnational investigations coordinated by Europol and Eurojust, mixing services and multi‑asset laundering schemes are described as supporting ransomware operations, carding, weapons trafficking and other serious crimes, providing a strong indication that the crypto infrastructure at the centre of these probes—and, by extension, networks it connects to, including Polkadot—form part of large‑scale ML ecosystems. Analytical work on sanctions evasion highlights the use of crypto, including DOT, to circumvent restrictions on Russian actors by routing funds through various wallets and exchanges in and beyond the EU, which squarely positions the underlying activity as a sanctions‑busting offence often overlapping with ML. German enforcement practice, as reflected in record AML fines on major financial institutions and crackdowns on unlicensed ATMs, repeatedly points to systematic failures to detect and promptly report suspicious transactions, implying that a core element of the crime type is the misuse of regulated channels to legitimise or conceal illicit crypto flows. In sum, when DOT and the Polkadot ecosystem surface in Swiss or German contexts of concern, they are typically part of broader money‑laundering and sanctions‑evasion schemes rather than isolated petty offences.

Entities Involved

The entities relevant to a Polkadot‑focused ML‑risk case in Switzerland and Germany span criminals, intermediaries, and regulated institutions. On the criminal side, Europol’s description of dismantled mixers and laundering infrastructures indicates usage by ransomware groups, marketplace operators, carders, and other organised‑crime actors relying on obfuscation tools and multi‑asset flows. Analytical sources identify Russian intelligence‑linked or sanctioned actors among those moving funds via a basket of crypto assets, including DOT, to reach major centralised exchanges, suggesting that state‑linked or politically exposed networks may sit behind some flows in question. Intermediary entities include mixing services and cross‑chain service providers that pool and redistribute crypto, often accessible on both clearnet and darknet and sometimes physically or logically hosted in Switzerland or Germany, thereby bringing them under local jurisdiction in joint operations. On the regulated side, Swiss and German banks, brokers, and exchanges appear as either obliged detectors of suspicious transactions or, in some cases, as entities sanctioned for inadequate reporting: BaFin’s record fine against J.P. Morgan SE for systemic failures in suspicious‑transaction reporting underscores how major financial institutions are implicated when they serve as gateways between fiat and crypto, potentially including DOT flows. Crypto‑specific businesses such as unlicensed ATM operators in Germany also form part of this landscape, as BaFin coordinated enforcement against ATM networks operating without permission and posing ML risks, which by their nature could process any supported token. Overall, the network of entities involved is complex and multi‑layered, with Polkadot appearing as one element in a much larger constellation of actors in both Switzerland and Germany.

PEP Involvement

Direct, public evidence that named Politically Exposed Persons (PEPs) in Switzerland or Germany personally laundered funds using Polkadot or DOT is not available in current open‑source records, so a precise “yes” tied to specific individuals cannot be honestly given. However, the broader sanctions‑evasion context that touches DOT involves individuals and entities that resemble PEP‑adjacent profiles, such as Russian oligarchs and elites targeted by EU and US sanctions regimes. The KLEPTOTRACE project’s mapping of sanctioned oligarch‑linked corporate networks across Europe shows how sanctioned individuals use complex chains of companies and cross‑border financial structures to hide beneficial ownership and move assets, often through jurisdictions such as Switzerland and other financial hubs. While this work is not Polkadot‑specific, it documents patterns of high‑level kleptocratic activity and sanctions evasion for which crypto can provide an additional channel, making it reasonable to treat Polkadot‑linked flows involving Russian‑sanctioned actors as at least indirectly PEP‑related risk. Swiss and German AML rules explicitly require enhanced due diligence for PEPs and higher‑risk customers, including in virtual‑asset contexts, which means that any regulated exposure to DOT flows involving such persons should trigger heightened monitoring and reporting. From a risk‑assessment standpoint, therefore, the safest characterisation is that there is PEP‑adjacent and sanctions‑listed‑party involvement in multi‑asset crypto‑laundering schemes where DOT can be one of the assets, but no publicly documented case that isolates a named Swiss or German PEP laundering exclusively through Polkadot.

Laundering Techniques Used

The laundering techniques that can involve Polkadot in Switzerland and Germany mostly mirror those seen across the broader crypto ecosystem, but cross‑chain and privacy‑enhancing features increase complexity. Joint Swiss–German operations against mixers such as Cryptomixer / cryptomixer.io show criminals using classic mixing: pooling deposits from numerous users, holding them for randomised intervals, and then redistributing them to destination addresses in a pattern designed to break direct on‑chain linkages and frustrate tracing. Analytical reports on sanctions‑evasion flows describe multi‑step chains where funds are moved from initial wallets, potentially associated with illicit activity, into different assets (including DOT), then into DeFi protocols or cross‑chain bridges, and finally out through centralised exchanges with higher liquidity and sometimes weaker compliance outside core EU jurisdictions. Polkadot’s architecture, which supports multiple parachains and cross‑chain messaging, enables sophisticated layering strategies: criminals can shift between DOT and other ecosystem tokens, exploit privacy‑oriented parachains or TEEs to obscure activity, and then route out to other blockchains, adding hops that challenge traditional analytics. In Germany, unlicensed ATMs and platforms identified by BaFin as ML risks illustrate the conversion of cash into crypto and back again outside proper oversight, a technique that can be combined with online cross‑chain routing to further disguise origin and destination. Switzerland’s risk assessment stresses the use of non‑custodial wallets and peer‑to‑peer transfers, which, when combined with Polkadot’s cross‑chain functionality, allow criminals to bypass or minimise their contact with regulated intermediaries, thus reducing the number of points where suspicious‑transaction reports might be filed.

Estimated Value Laundered

There is no reliable public estimate of the total value laundered specifically through Polkadot in Switzerland and Germany, but some figures illustrate the scale of the broader crypto‑laundering infrastructure in which Polkadot‑linked flows can occur. The dismantling of the Cryptomixer / cryptomixer.io service by Swiss and German authorities revealed that the platform processed over 1.3 billion euros’ worth of Bitcoin since 2016, with at least 25 million euros seized in the operation alone. While this mixer focused on Bitcoin, the fact that it fed into and out of exchanges and wallets that handle many assets—including DOT—illustrates the magnitude of value that can transit multi‑asset networks where Polkadot is one of several tools. Analytical work on Russian sanctions‑evasion via crypto, which explicitly notes DOT among the assets used, points to hundreds of millions of dollars’ worth of flows across multiple coins reaching major centralised exchanges, though it does not disaggregate a precise figure for Polkadot alone. Switzerland’s national ML/TF risk assessment indicates that virtual‑asset‑related suspicious‑transaction reporting and case values are rising, signalling an overall increase in risky volumes, but again stops short of token‑by‑token breakdowns. Germany’s major fines against financial institutions for AML failings—including a record 45 million euro penalty against J.P. Morgan SE for late suspicious‑transaction reports—suggest that substantial volumes of suspicious flows, potentially including DOT transactions, were not escalated in time, though exact values are not disclosed. Given these data, any attempt to claim a precise DOT‑only laundered amount for Switzerland and Germany would be speculative; what is demonstrable is that the surrounding infrastructure enabling such activity moves in the high hundreds of millions to billions of euros.

Transaction Analysis Summary

Observed and reported patterns suggest that Polkadot‑related transactions associated with ML and sanctions‑evasion risk in Switzerland and Germany tend to form part of longer, multi‑asset chains rather than isolated DOT movements. In sanctions‑evasion typologies, initial funds originate from wallets linked to restricted actors or high‑risk jurisdictions, then move through a series of addresses and assets, including DOT, often passing through DeFi protocols or cross‑chain infrastructure before converging on centralised exchanges with sufficient liquidity to cash out or re‑route to fiat. Transaction tracing in mixer takedown cases shows the use of a large number of small deposits and withdrawals, randomised delays, and redistribution patterns designed to sever deterministic links between inputs and outputs, which, when combined with cross‑chain hops, exponentially increases analytic complexity. Swiss authorities’ risk assessment underscores that non‑custodial wallets and peer‑to‑peer transfers play a big role, implying that many suspicious flows enter or leave regulated Swiss intermediaries only at one or two points, with a substantial amount of activity occurring on‑chain or across chains beyond direct institutional visibility. German enforcement against unlicensed ATMs and platforms reveals another pattern: repeated small‑value transactions that, in aggregate, amount to significant sums, often clustered around particular machines or services operating without BaFin authorisation, which can then be linked to online accounts trading in multiple assets. From an analytics perspective, DOT’s role is typically as one of several fungible “hops” chosen for liquidity, speed, and available trading pairs, which complicates efforts by Swiss and German FIUs and supervisors to attribute and reconstruct flows without advanced, cross‑chain forensic tools.

Regulatory/Enforcement Actions Taken

Swiss and German authorities have taken significant regulatory and enforcement measures that cover Polkadot‑linked ML risk, even if orders rarely single out DOT by name. Switzerland, through FINMA and national AML legislation, imposes strict KYC, transaction monitoring and suspicious‑activity reporting requirements on financial intermediaries handling virtual assets, and the 2023 ML/TF risk report specifically highlights crypto and DLT services as high‑risk sectors requiring enhanced supervision and possible tightening of rules. Germany’s BaFin has repeatedly enforced against both banks and crypto businesses: the record 45 million euro fine against J.P. Morgan SE for systemic delays in suspicious‑transaction reporting demonstrates a willingness to penalise large institutions that fail to adequately monitor and escalate potentially illicit flows, which can include DOT transactions. BaFin and BKA have also cracked down on unlicensed crypto ATMs, seizing devices and investigating operators for ML offences when machines run without proper permission and controls. Jointly, Swiss and German law‑enforcement bodies participated in dismantling the Cryptomixer / cryptomixer.io mixing service, seizing millions of euros in crypto and critical infrastructure, signalling that they target key obfuscation nodes used by criminals whose transaction chains may include Polkadot among other assets. On the policy side, Germany’s integration of EU MiCAR and the creation of a national framework for crypto custody businesses expand licensing and supervision over firms offering services around tokens like DOT, while Swiss authorities continue to refine self‑regulatory organisation oversight and expectations for virtual‑asset intermediaries. Collectively, these steps indicate a robust, increasingly coordinated regulatory front that directly encompasses Polkadot‑related flows whenever they intersect regulated entities in Switzerland and Germany.

Links to Reports / Sources

Case Title / Operation Name:

Polkadot

Country(s) Involved:

Germany, Russia, Switzerland

Platform / Exchange Used:

Large centralised exchanges serving EU clients (e.g., major CEXs identified in sanctions‑evasion tracing; specific brands not publicly tied to a “Polkadot‑only” case).

Cryptocurrency Involved:

DOT (Polkadot), plus BTC, major stablecoins and other liquid assets used in multi‑asset laundering chains

Volume Laundered (USD est.):

Exact DOT volume unknown; related crypto‑laundering infrastructure (e.g., Cryptomixer) processed over EUR 1.3 billion equivalent, with tens of millions seized, and sanctions‑evasion flows across multiple assets in the hundreds of millions.

Wallet Addresses / TxIDs :

N/A

Method of Laundering:

Multi‑step layering using cross‑chain transfers, privacy‑enhancing or non‑custodial infrastructure, and conversion between multiple assets (including DOT); use of mixers/tumblers (e.g., Cryptomixer), high‑risk CEX accounts, and unlicensed on/off‑ramp services such as some ATMs and platforms in Germany.

Source of Funds:

Proceeds linked to sanctions‑evading Russian actors and broader organised‑crime activity (ransomware, darknet markets, fraud and other serious offences) funneled into crypto, then routed via multi‑asset schemes that at points use DOT and related ecosystems.

Associated Shell Companies:

Complex corporate structures and offshore/onshore shells described in sanctions‑evasion and kleptocracy mapping (e.g., oligarch‑linked networks in Europe), though no public, Polkadot‑specific Swiss/German shell‑company list is available.

PEPs or Individuals Involved:

Sanctioned Russian elites and oligarch‑linked networks (PEP‑adjacent or sanctioned individuals) implicated in crypto‑based sanctions‑evasion typologies where DOT appears among used assets; no named Swiss or German PEP publicly tied specifically to Polkadot flows.

Law Enforcement / Regulatory Action:

Swiss and German authorities have strengthened AML supervision for VASPs, issued major fines for reporting failures, dismantled a large mixer (Cryptomixer/cryptomixer.io), and cracked down on unlicensed crypto ATMs and platforms, all capturing multi‑asset flows that can include DOT.

Year of Occurrence:

2023–2025 (period in which key risk assessments, sanctions‑evasion analyses, major fines, and mixer takedowns relevant to Polkadot‑linked flows were reported).

Ongoing Case:

Ongoing

AML Network Risk Rating:

🔴 High Risk