Money Laundering Through NFTs: The Wash Trading Playbook and How to Spot It

This is a companion article to 7 MINUTE MINT Episode 01. You can follow along with the tools below — everything I show you is free and public.

---

The traditional art market has been a money laundering vehicle for decades. Subjective valuations, private sales, no real price anchors — the perfect setup for moving dirty money.

NFTs took that model and removed every remaining friction point. No physical transport, no customs, no intermediary. Transactions settle in minutes. And the "value" of a digital artwork? Whatever two wallets agree it is.

Money laundering through NFTs isn't theoretical. It's a $35.6 billion problem. Let me walk you through exactly how it works — and how to spot it on-chain.

---

Step 1: Understanding the Wash Trading Mechanic

The basic trick is deceptively simple: you buy your own NFT.

Take a PFP collection — cute penguins, anime cats, whatever's trending. Someone mints an NFT from Wallet A, then "sells" it to Wallet B for 5 ETH. Wallet B sells to Wallet C at 15 ETH. The blockchain now shows a digital asset with rising demand and a legitimate-looking sales history.

The catch: all three wallets belong to the same person.

Mapped to the classic three-stage laundering model:

Placement. Illicit funds buy crypto (ETH, SOL, stablecoins). This step is most likely to hit KYC at a centralised exchange — which is why launderers use P2P, DEXs, or pre-loaded wallets.

Layering. The crypto buys NFTs, flips them between self-controlled wallets at inflated prices, cycles through multiple collections. Each trade adds a layer. The NFT is the vehicle — not the destination.

Integration. The NFT sells to a real buyer who believes the price history, or the funds extract through a marketplace payout to a bank-connected account. The money is now "art sale proceeds."

The on-chain mechanic

Every NFT trade on Ethereum boils down to a single contract call: transferFrom(from, to, tokenId) on the ERC-721 contract (or safeTransferFrom on ERC-1155). Marketplaces like OpenSea's Seaport wrap this in an atomic swap — the NFT transfer and the ETH/WETH payment execute in one transaction, so neither side can rug the other.

That atomicity is what makes wash trading cheap. A launderer writes a single contract call that:

1. Borrows ETH via flash loan (Compound, Aave, or dYdX all support this),
2. Calls Seaport's fulfillOrder to "buy" their own listed NFT,
3. Repays the flash loan with a 0.09% fee — all before the block closes.

Total cost: gas + a ~9bps flash loan fee. Result: a blockchain-recorded "sale" at whatever price they chose. This is how CryptoPunk #9998 got its $532M "sale" — one wallet, one block, zero capital at risk.

---

Step 2: See the Scale on Dune Analytics

Let's look at real data. Open Dune Analytics and search for @hildobby's "EVM NFTs Wash Trading" dashboard. Here's my walkthrough:

$35.6 billion. That's the all-time wash trading volume across EVM NFT marketplaces. Not total NFT volume — just the wash trades.

The dashboard breaks it down by marketplace. Here's what stands out:

The percentages vary, but the absolute numbers are staggering. And these are only the detectable wash trades — the ones caught by @hildobby's algorithm.

---

Step 3: The 5 Typologies — What the Dashboard Actually Detects

@hildobby's dashboard flags a trade as wash trading when it triggers at least one of five filters. Here's the walkthrough of each one:

Now click into the query editor on the Dune dashboard and you can see the actual SQL behind those filters. In this walkthrough I open @hildobby's query and step through what each one is doing — so even if you've never written SQL, you can follow along:

The detection logic lives in @hildobby's nft.wash_trades Spellbook model (open source on GitHub: duneanalytics/spellbook). It's a materialised view built on top of nft.trades that flags each row against a series of boolean columns — is_self_trade, is_back_and_forth, is_same_funder, etc. Any row where at least one flag fires is counted as a wash trade.

Let's walk through the actual SQL patterns behind each flag:

Filter 1 — Buyer = Seller

SELECT *, (buyer = seller) AS is_self_trade
FROM nft.trades
WHERE buyer = seller

Literally the same address on both sides of the trade. What it looks like in practice: a single wallet lists an NFT for 50 ETH, then fulfils its own listing in the next block. Etherscan shows the same address in both the from and to fields of the Seaport OrderFulfilled event.

This catches the laziest launderers. Most reputable marketplaces (OpenSea's Seaport, Blur) reject self-trades at the contract level by checking msg.sender != order.offerer. But smaller platforms — and especially ones offering trading-volume rewards — often don't validate, and launderers know exactly which.

Filter 2 — Back & Forth

-- Same two wallets, same NFT, traded in both directions
WITH pairs AS (
  SELECT nft_contract_address, token_id, buyer, seller,
    LEAST(buyer, seller) AS wallet_a,
    GREATEST(buyer, seller) AS wallet_b
  FROM nft.trades
)
SELECT *, COUNT(*) OVER (
  PARTITION BY nft_contract_address, token_id, wallet_a, wallet_b
) AS ping_pong_count
FROM pairs
HAVING ping_pong_count >= 2

The LEAST/GREATEST trick normalises the pair so (A→B) and (B→A) cluster into the same bucket. Any token_id traded twice or more between the same two addresses is flagged.

What this looks like in practice: Wallet A "sells" NFT #4207 to Wallet B for 10 ETH. Two hours later, Wallet B "sells" it back to Wallet A for 12 ETH. Repeat. Each hop inflates the reported price. On Etherscan, you'll see the same two addresses alternating in the transfer history — and if you click into either wallet, they typically share the same funder (see Filter 4) or one funds the other directly.

Filter 3 — Rapid Flip

-- Same NFT sold 3+ times within a short window at rising prices
SELECT token_id, COUNT(*) AS flip_count,
  MAX(amount_usd) / NULLIF(MIN(amount_usd), 0) AS price_multiple
FROM nft.trades
WHERE block_time > NOW() - interval '1' hour
GROUP BY token_id, nft_contract_address
HAVING flip_count >= 3 AND price_multiple > 5

Three or more trades of the same token inside an hour, with a 5× price jump from low to high. Legitimate markets don't move that fast.

What this looks like in practice: NFT #9821 sells for 0.5 ETH at 14:02, 2 ETH at 14:17, and 10 ETH at 14:41 — all between different-looking wallets. A real collector didn't just 20× their valuation in 40 minutes. This pattern is the classic "pump" phase used right before a real victim buyer gets onboarded: the launderer needs a credible recent price history to justify the exit sale.

Filter 4 — Same-Funder Wallets

This is the clever one. Trace each trader's funding source one hop back:

WITH first_funding AS (
  SELECT "to" AS wallet,
    FIRST_VALUE("from") OVER (
      PARTITION BY "to" ORDER BY block_time
    ) AS funder
  FROM ethereum.traces
  WHERE value > 0
)
SELECT t.*, b.funder AS buyer_funder, s.funder AS seller_funder
FROM nft.trades t
LEFT JOIN first_funding b ON b.wallet = t.buyer
LEFT JOIN first_funding s ON s.wallet = t.seller
WHERE b.funder = s.funder
  AND b.funder NOT IN (SELECT address FROM labels.cex_hot_wallets)

Look at where each wallet first received ETH. If buyer and seller were both funded by the same upstream address — and that address isn't a CEX hot wallet (Coinbase, Binance, etc.) — they're almost certainly the same person. The CEX exclusion is critical: millions of wallets get first funded by Binance 15, and that isn't wash trading.

What this looks like in practice: two wallets (0xAAA... and 0xBBB...) that have never interacted with each other except through NFT trades. Individually they look like strangers. But trace each one back one hop: both received their first 0.1 ETH from 0xCCC... within minutes of each other. 0xCCC... isn't labelled as any exchange. That's a creator wallet spinning up two "clean" trading wallets to simulate market activity. This is the hardest pattern for a casual observer to spot — and the most common in sophisticated laundering operations.

Filter 5 — Flash Loan Self-Trade

-- NFT trade in the same tx as an Aave/dYdX flash loan from the same sender
SELECT t.*, fl.flash_loan_amount
FROM nft.trades t
INNER JOIN ethereum.traces tr ON tr.tx_hash = t.tx_hash
INNER JOIN flash_loans fl ON fl.tx_hash = t.tx_hash
WHERE fl.borrower = t.buyer

The tell: a flash loan borrow and an NFT purchase inside the same tx_hash. Because flash loans must repay in one transaction, the borrower and the buyer being identical is near-definitive proof of a self-trade with borrowed capital.

What this looks like in practice: the infamous CryptoPunk #9998 "sale" for $532M on 28 October 2021. One wallet flash-borrowed 124,457 ETH (87,000 of it from Compound, the rest from other pools), "bought" the Punk from itself at that price, sent the 124,457 ETH straight back to the buyer, repaid the loans, and returned the Punk to the original wallet — all in a single block. The wallet never owned $532M. Larva Labs confirmed the trade looked like a wash sale; the transaction was real on-chain but the ownership change was fictional. If you ever see a nine-figure NFT headline, check whether the buyer-to-seller ETH movement and the NFT-back-to-origin transfer are in the same block — they almost always are.

When @hildobby's dashboard reports $35.6B in wash trading, it means $35.6B of trades triggered at least one of those five flags. Fork the Spellbook query on Dune, swap the date filter, and you can reproduce every number in this article.

---

Step 4: Walk Through a Real Wallet on Etherscan

Let me show you how to read a wallet on Etherscan — what to look at and what the data tells you. Open Etherscan and check address 0xCB17490509413aE052d587eea1140e9BA156dFDE. Here's my walkthrough:

Here's how to read the key fields on any wallet:

Funding source. This wallet was funded by Binance 15 — a centralised exchange hot wallet. That tells you the wallet owner used Binance as their on-ramp. In your own analysis, compare funding sources across wallets in a trade chain. If the buyer and seller both trace back to the same funding source — or worse, to Tornado Cash or freshly created intermediaries — that's a red flag worth investigating.

Transaction count. This wallet shows 280 transactions over 4+ years — a reasonable distribution. What you're looking for when assessing risk: wallets with high NFT activity but almost no other transaction types. Single-purpose wallets created just to buy and sell NFTs are a common wash trading pattern.

NFT Transfers tab. Click it. This is where the real story unfolds:

You can see specific NFT movements — Lil Pudgy #1315 sold, other ERC-721 transfers. For every transfer on any wallet, you can trace:

• Where the NFT came from (the seller's wallet)
• Where the funds came from (the buyer's wallet funding source)
• Whether multiple wallets in the trade chain share the same origin

This is the core of on-chain NFT analysis: follow the wallets, trace the funding, map the connections. When the buyer's wallet and the seller's wallet trace back to the same upstream source — that's not a market. That's a performance.

Doing this at scale: the API layer

Etherscan's UI is for spot checks. When you need to monitor thousands of wallets, you hit the same data through the Etherscan API (or Alchemy/QuickNode/Moralis for higher rate limits):

# Pull every ERC-721 transfer for a wallet
curl "https://api.etherscan.io/api\
?module=account\
&action=tokennfttx\
&address=0xCB17490509413aE052d587eea1140e9BA156dFDE\
&startblock=0&endblock=99999999\
&sort=asc&apikey=YOUR_KEY"

The response gives you from, to, tokenID, contractAddress, blockNumber, and timeStamp for every NFT transfer. Feed that into any pipeline and you can:

• Compute each wallet's first funder (eth_getTransactionByHash on the first incoming tx),
• Build a transfer graph (edges = transfers, nodes = wallets) and run community detection for clusters,
• Cross-reference against OFAC/Tornado Cash address lists (publicly maintained by Chainalysis and 0xaa on GitHub),
• Score each trade against the five filters above in near real-time.

For production compliance monitoring, this is the stack:

• RPC node (Alchemy/Infura/self-hosted) for raw trace data
• Indexer (The Graph, Covalent, or custom Postgres) for queryable history
• Label database (Etherscan tags, Arkham, Nansen) to resolve addresses to entities
• Graph database (Neo4j, TigerGraph) for cluster analysis
• Sanctions screening (Chainalysis KYT, TRM Labs, Elliptic Navigator) for OFAC/FATF list hits

Chainalysis and TRM essentially productised this stack. Their wash trading heuristics publicly document: same-funder clustering, flash loan detection, rapid-flip scoring, and marketplace incentive arbitrage (like the LooksRare $WETH/$LOOKS token farming that pushed 87% wash volume at launch).

---

Step 5: The Legal Landscape — Who's Actually Regulating This?

The tools to detect NFT money laundering exist. The legal obligation to use them? That depends entirely on where you are.

EU — MiCA and AMLD

MiCA (Markets in Crypto-Assets Regulation), fully applicable since December 2024, is the EU's flagship crypto framework. The common assumption is that NFTs are exempt — but that's only half true.

MiCA does carve out an exemption for crypto-assets that are "unique and not fungible" (UNFCA). But MiCA applies substance-over-form: a unique tokenId alone is not enough to qualify as a UNFCA. Most PFP collections, membership passes, gaming items, and fractionalised art actually fall within MiCA's scope once you assess the metadata and rights layers. Only a small minority — fully on-chain, genuinely distinct characteristics, no homogeneous utility — qualify as true UNFCAs (think CryptoPunks).

Where MiCA definitely bites: any CASP (Crypto Asset Service Provider) that touches NFT-related transactions — exchanges converting NFT sale proceeds to fiat, custodians holding NFT assets, payment providers processing marketplace payouts. These entities have full AML/CFT obligations: customer due diligence, transaction monitoring, suspicious transaction reporting, and Travel Rule compliance under the EU Transfer of Funds Regulation.

The upcoming AMLD6 and the new EU AML Authority (AMLA), launching in Frankfurt, will further tighten the net with direct supervisory powers over high-risk obligated entities.

FATF — The Global Standard-Setter

FATF's Updated Guidance on Virtual Assets (October 2021) was explicit: NFTs are generally not virtual assets under FATF's definitions — but countries should consider applying VA standards to NFTs on a case-by-case basis, particularly where they're used for payment or investment.

In practice, FATF flagged NFT marketplaces as a potential gap in the AML framework. Their 2023 and 2024 targeted reviews noted that many jurisdictions haven't extended AML obligations to NFT platforms at all — leaving a regulatory vacuum that launderers exploit.

The key FATF principle: substance over form. If something functions as a value transfer mechanism, it should be regulated as one — regardless of whether it's called an "NFT" or a "digital collectible."

Beyond the EU

Outside Europe, the picture fragments. The US is enforcement-led without a framework: DOJ has prosecuted specific cases (Frosties rug pull, Chastain insider trading), OFAC sanctions hit the Lazarus Group's Tornado Cash laundering, and the SEC signals some NFTs are securities under Howey — but FinCEN has not classified NFT marketplaces as MSBs, and OpenSea/Blur/Magic Eden don't file SARs.

The direction of travel is the same everywhere: obligations are expanding, enforcement is accelerating, and the "NFTs aren't regulated" argument has a rapidly shrinking shelf life. If you're at an EU CASP that processes any NFT-adjacent transactions — even fiat off-ramps from marketplace payouts — your AML obligations are already in play.

---

Step 6: Red Flags in One Glance

If you're monitoring NFT-related activity at an EU CASP, the five typologies above ARE the red flags — now operationalised. A few extras worth flagging in transaction monitoring:

• Customer deposits, immediately buys high-value NFTs, immediately withdraws proceeds to fiat
• No apparent collecting interest: no social presence, no community, no engagement beyond transactions
• Collections with low holder counts but high reported volume (check Bubblemaps for cluster shape)
• Sudden volume spikes on previously dormant collections — often the layering phase just started

---

Step 7: Understand Why It's Not Being Caught

Most NFT marketplaces — OpenSea, Blur, Magic Eden — aren't registered as financial institutions anywhere. They're not obligated entities under MiCA, they're not registered MSBs under US BSA rules, and they don't perform KYC or file suspicious activity reports. They position themselves as technology platforms, not financial intermediaries.

Under MiCA, CASPs have transaction monitoring obligations — but NFT marketplaces sit outside the MiCA perimeter because NFTs themselves are excluded from the definition of crypto-assets (unless fractionalised or functioning as financial instruments). The regulatory gap is real, it's acknowledged, and it's exploitable.

Real Cases Already Prosecuted

This isn't hypothetical:

• CryptoPunk #9998 — "sold" for $532M using a flash loan self-trade. Same person, same transaction block.
• LooksRare — 87% of platform volume was wash trading when they launched trading rewards.
• DOJ v. Nathaniel Chastain (2022) — first NFT insider trading prosecution. Anonymous wallets, front-running OpenSea homepage features.
• Frosties rug pull — $1.1M stolen, both creators charged with wire fraud and money laundering conspiracy.
• Lazarus Group — North Korea's hackers ran 500+ phishing domains targeting NFT holders, laundered through Tornado Cash.

Chainalysis (2022 Crypto Crime Report) identified 262 users who had each sold an NFT to a self-financed address more than 25 times — their internal threshold for "more likely wash trading than not." Elliptic has separately documented over $100M in NFT theft in a single year.

---

Your Toolkit — Follow Along

Everything I walked through in this article is free and public:

---

This article is educational content and does not constitute legal or financial advice. Always consult qualified legal professionals for compliance decisions specific to your organisation. On-chain patterns described are illustrative — actual investigation should be conducted by trained analysts using appropriate tools.