Criminals can move cryptocurrency in minutes, while European investigators wait weeks or months for information needed to freeze it, EU agencies warned lawmakers on Tuesday. Their warnings come days after hackers stole about $6.3bn from Binance in the biggest cryptocurrency theft on record.
“This is something that takes weeks or months, whereas cryptos are moving within minutes,” Europol’s financial crime chief Alexander Resch told a joint meeting of European Parliament’s economic affairs and civil liberties committees on 3 November. He described the delays investigators face when seeking customer information or freezing funds held through providers outside the EU.
A race to stop stolen money
The Binance attack shows how quickly that window can close. Most of the theft unfolded in around 20 minutes on 29 October, according to Reuters’ account of the attack. Stablecoin issuers subsequently froze roughly half the stolen assets. Stablecoins are crypto tokens designed to track a currency or another reference asset; some issuers can block their movement remotely.
Cash and crypto are no longer separate channels. They are sold together as one laundering service for other criminals.
— Paweł Wąsik, chair of Eurojust’s Economic Crime Team
The FBI attributed the attack to North Korea and said hackers were converting stolen assets primarily into ether. It warned that services allowing users to exchange cryptocurrencies could facilitate further laundering. North Korea rejected the allegations. Binance co-chief executive Richard Teng said on Tuesday that the company had replenished 95% of the affected tokens using its own resources. “It’s a painful lesson. We take responsibility for it,” he said, according to Reuters. Replacing customers’ assets does not mean investigators have recovered the stolen funds.
Tuesday’s discussion examined the broader networks through which criminal proceeds move. “Cash and crypto are no longer separate channels. They are sold together as one laundering service for other criminals,” said Paweł Wąsik, chair of Eurojust’s Economic Crime Team. Intermediaries can collect cash in one country, arrange payment elsewhere, and use cryptocurrency to settle what they owe each other.
EU agencies described difficulties following those transactions across borders. Europol can trace funds to a provider, but obtaining information and securing a freeze may require lengthy cooperation with foreign authorities. Prosecutors also need evidence identifying who controls a wallet before they can turn a visible transaction into a case that stands up in court.
Stronger powers sought, existing controls uneven
The EU Anti-Money Laundering Authority, AMLA, presented findings from an assessment it expects to publish by the end of the year. Stablecoins accounted for roughly three-quarters of identified illicit crypto exposure associated with businesses operating in the EU in 2025, its representative said. The figure concerns identified illicit activity, rather than stablecoin transactions overall. Nearly half of responding financial intelligence units reported difficulties obtaining information from crypto providers outside the EU.
Europol wants faster access to information through the proposed revision of its mandate, which Parliament and the Council are examining. Mr Resch highlighted provisions allowing access to relevant national records and enabling Europol to suggest that a member state freeze assets. National authorities would carry out the freeze. These powers remain proposals.
Speakers also warned against measures that exclude legitimate users. European Banking Authority director Marilin Pikaro said expensive transfers and difficulty obtaining bank accounts can push people towards alternative services. “We should make the framework safe to use for everyone,” she said. For victims of theft and investment fraud, the immediate concern is whether authorities can stop the money before it moves beyond their reach. And secure its eventual return.
