FATF Says Criminals Are Building Stablecoins No One Can Freeze

TL;DR - FATF's July 2026 review says organized-crime networks are now issuing their own stablecoins engineered to resist freezing, a threat ordinary wallet screening can still catch early.

You assume every stablecoin behaves the same way. An issuer flags a wallet, the transfer clears, the balance drops to zero within hours. FATF's latest review says that assumption no longer holds for a growing slice of the market.

What did FATF actually report on July 16?

FATF's targeted update names a Cambodia-based financial services conglomerate that laundered at least $4 billion in illicit proceeds between 2021 and 2025, moving money for organized-crime fraud rings and DPRK-linked cyber theft through the same infrastructure. A second case gets its own line: Spain's Guardia Civil broke up a fraud network in June 2025 that had laundered roughly EUR 460 million from more than 5,000 victims worldwide.

FATF President Giles Thomson put it plainly: "Criminal networks continue to abuse virtual assets for illicit purposes and exploit their borderless nature to commit fraud and scams, evade sanctions and launder proceeds of crime." The report's real headline sits a few pages past the case studies, though.

Criminal networks are now issuing proprietary stablecoins built specifically to resist freezing and seizure. These aren't stolen USDC or laundered USDT. They're minted from scratch, with no Tether or Circle sitting above them able to pull a freeze lever.

The same update tracks compliance progress on the other side of the ledger: 83% of the 149 jurisdictions FATF assessed now have Travel Rule legislation on the books, up from 73% a year earlier. That's real movement. It just doesn't reach a coin with no issuer to serve a rule on in the first place.

Why would criminals build their own stablecoin?

Because the freeze lever is exactly what's been working against them. Tether alone froze $131 million tied to a single Iran-linked sanctions action this July, on top of the balances it locked after the ISIS-K designation two weeks earlier. Every dollar frozen is a dollar a laundering network can't move again, and issuer-side freezes have quietly become the biggest operational risk to running money through public stablecoins.

A self-issued coin removes that risk outright. There's no central issuer to serve a subpoena, no compliance desk watching the mint address, no blacklist function anyone outside the network controls. The chain still records every transfer. Nobody sanctioned can stop it moving.

How is a freeze-resistant stablecoin different from USDC or USDT?

Circle and Tether hold a blacklist function baked into their token contracts, and both companies have used it - freezing wallets tied to hacks, sanctions, and scams on request from law enforcement. That's the entire model FATF's report says is under strain: not broken everywhere, just routed around by a new class of token with no equivalent function.

A criminal-issued stablecoin skips that layer completely. It's pegged the same way. It moves the same way on-chain. It can sit in a wallet interface looking identical to any other dollar-pegged token. The difference only shows up once you check who actually controls the contract, and where the coin has circulated before it reached you.

Reserves are the other tell. Circle and Tether both publish attestations on where the dollars backing their tokens actually sit, because a bank-held reserve is also a lever regulators can pull. A coin built to dodge freezes has no reason to publish anything. If you can't find an attestation, a custodian, or a named issuer behind a "stablecoin," treat the peg itself as unverified, not just the freeze risk.

Does this change the risk for a wallet that never touches these coins?

Yes, mostly through counterparties rather than your own choices. FATF flags cross-chain layering through decentralized exchanges as sharply up in 2025. A swap that looks routine on one chain can be the exact hop that carries a criminal-issued coin's proceeds into a wallet holding ordinary USDC on the other side.

Plastron's own labeled dataset carries 3,901 addresses tied to scams, fraud, and exploits, plus 780 addresses drawn from the OFAC sanctions list alone. None of that exposure requires knowing a coin's name. It only requires the coin, or the address that sent it, to already be flagged somewhere in that data.

The Cambodia case FATF names is the pattern in miniature: a single conglomerate's infrastructure served both a fraud ring and a DPRK cyber-theft operation at the same time, over the same four years. One shared wallet cluster, two different criminal customers. That's the structure a self-issued stablecoin is built to scale.

How do you check whether a stablecoin or counterparty is one of these?

Start with the contract, not the ticker. Anyone can pull up a token contract on Etherscan and read the top holders, but that only shows where a coin sits today. It won't tell you whether the address that sent it has already touched a sanctioned wallet, a mixer, or a known scam cluster. Screen the wallet and the token with Plastron before you accept it, and you get sanctions exposure, mixer history, and stolen-funds links in one pass across Ethereum and six other EVM chains.

A single check beats a guess every time. FATF's report is a warning about a typology, not a list of addresses. The burden of catching it still lands on whoever screens the transaction, not on the report itself.

Two habits catch most of this before it's a problem. Screen a new counterparty address before you accept a transfer, not after. And treat any stablecoin with no named issuer or public reserve attestation as worth a second look, no matter how normal the deposit looks in your wallet.