Money mule networks represent a material risk for digital financial platforms because they use legitimate customer accounts to move illicit funds while avoiding detection at the transaction level. When this activity goes unnoticed, institutions face regulatory exposure, financial loss, and control failures that are often only identified after funds have exited the ecosystem.
StraitsX, a leading provider of digital financial services, identified recurring suspicious transaction patterns within its ecosystem as part of its proactive monitoring efforts. Coordinated stablecoin withdrawals were executed across newly created customer accounts, with funds routed through external wallets before converging in downstream consolidation addresses. While individual transactions aligned with expected customer behavior when reviewed independently, the risk emerged at the pattern level, across accounts and transaction flows. Addressing this activity required the ability to recognize coordinated pattern recognition and downstream convergence in addition to existing transaction monitoring and investigative controls.
To address this challenge, StraitsX partnered with Merkle Science, the predictive blockchain risk and intelligence platform. Using behavior-based analysis and network-level clustering, Merkle Science identified coordinated withdrawal patterns across multiple customer accounts and traced how funds converged into shared downstream wallets. Predictive risk scoring was then used to prioritize consolidation wallets most likely associated with money mule activity, enabling focused investigation and control actions.
The engagement delivered measurable outcomes:
This case study demonstrates how behavior-driven analytics strengthen AML detection by surfacing coordinated activity patterns that would otherwise require time-intensive manual investigation, enabling earlier intervention and more consistent risk decisions.
Money mules are intermediaries who knowingly or unknowingly move illicit funds through their accounts to obscure the origin and ultimate beneficiary. In crypto, mule laundering scales quickly because funds can be moved across many wallets in short timeframes, making coordinated activity harder to identify through isolated reviews.
Within crypto ecosystems, money mule operations exploit:
StraitsX observed a recurring pattern tied to stablecoin withdrawals. Multiple newly created customer accounts executed high-value withdrawals in USDT and USDC. Funds were routed to newly generated external wallets, and over time, flows from these wallets converged into the same wallet, which functioned as a consolidation point used to aggregate laundered funds.
While this pattern was identifiable through investigation, manual tracing required significant effort and was not optimized for large volumes. StraitsX needed a systematic, data-driven way to link related accounts and identify consolidation points more consistently, so the team could take timely control actions and reduce repeat abuse.
To analyze the coordinated mule activity observed at StraitsX, Merkle Science applied a set of capabilities focused on behavior, wallet relationships, and downstream fund movement.
Together, these capabilities supported a more systematic and consistent approach to detecting coordinated mule activity.
To guide the design and execution of the detection process, StraitsX and Merkle Science aligned on a clear set of objectives. The joint objective was to identify previously unknown consolidation wallets where mule-linked funds converge, map the associated money mule accounts connected to those wallets, and enable StraitsX to proactively block or flag new transactions involving identified high-risk destinations. This work was also intended to strengthen ongoing AML detection by embedding a behavior-driven approach that could be applied consistently as new activity emerged.
The detection process began with a detailed review of historical cases and investigative insights from StraitsX’s compliance and risk teams. This work focused on documenting how money mule activity manifested in practice within Fazz’s ecosystem, rather than relying on generic typologies. Key characteristics consistently observed included the use of multiple customer accounts, a concentration of withdrawals in stablecoins such as USDT and USDC, repeated transfers at similar intervals and values, and the convergence of funds into a limited set of external wallets used for aggregation. These observed behaviors formed the basis for the heuristics applied in subsequent analysis.
With the activity pattern defined, Merkle Science’s team analysed the bulk of StraitsX’s 2025 transaction data related to USDT and USDC withdrawals and transfers. The data was standardized and enriched using Merkle Science’s proprietary blockchain intelligence data, covering:
To analyze patterns of coordinated activity, the platform’s machine learning models executed an entity clustering algorithm that combined graph-based analysis with behavioral similarity metrics to group wallets exhibiting coordinated, mule-like activity. The clustering was informed by multiple indicators, including:
This approach enabled the separation of wallets associated with independent customer activity from those likely managed or coordinated by the same underlying actor or group. Once clusters were established, transaction flows were reviewed to identify wallets that repeatedly received funds from multiple, otherwise unconnected StraitsX customer accounts over time.
Using proprietary transaction graph analysis tools, Merkle Science identified over 250 unique consolidation wallets that matched the behavioral signatures of known laundering hubs. Each identified wallet was then evaluated using Merkle Science’s risk scoring framework, which assesses risk based on observed behavioral patterns and contextual indicators. StraitsX's compliance team subsequently reviewed and validated the findings using internal investigation methods and transactional data before incorporating these wallets into their control workflows.
Following identification of candidate consolidation wallets, StraitsX’s compliance team cross-validated the flagged addresses using internal investigation methods and transactional data. This review demonstrated that the detection logic was accurately identifying coordinated mule activity and could be operationalized within existing controls. Several of the assessed wallets were linked to previously unrecognized networks of suspicious accounts. The validated findings were incorporated into StraitsX’s transaction monitoring rules, enabling future transfers to these destinations to be proactively blocked.
Results
From an operational perspective, the value delivered extended beyond case resolution. StraitsX’s compliance team was able to reduce manual investigative workload while improving consistency in decision-making. AML detection was strengthened through reusable, behavior-based logic that complemented existing controls. By identifying and acting on mule-linked destinations, StraitsX reduced the risk of repeat abuse and improved readiness for internal audit and regulatory review.
This engagement highlighted a practical shift in how money mule activity can be detected and disrupted in crypto-enabled financial systems. Rather than relying on static indicators or known bad addresses, the approach demonstrated how behavior-driven analysis and network-level visibility can surface coordinated activity that remains invisible at the transaction or wallet level.
By applying this approach, StraitsX was able to move beyond reactive investigation and embed detection logic that supports earlier intervention and more consistent control decisions. The identification of previously unknown mule networks and the proactive blocking of repeat fund flows illustrate how behavioral intelligence can be operationalized within existing AML frameworks.
For financial institutions operating in decentralized environments, this case study underscores the importance of shifting from isolated monitoring to pattern-based analysis that captures how risk accumulates across accounts and wallets over time.
Merkle Science is a predictive blockchain risk and intelligence platform helping businesses, financial institutions, and regulators detect and prevent cryptocurrency-related crime. Its AI- and behavior-based analytics go beyond traditional on-chain tracing to deliver cutting-edge compliance, investigations, and monitoring solutions across the digital asset economy.
For more information, visit www.merklescience.com.
StraitsX is the stablecoin-native settlement layer for global finance and a Major Payment Institution licensed by the Monetary Authority of Singapore. As the issuer of XSGD and XUSD, StraitsX leverages blockchain technology to enable seamless payments interoperability and stablecoin-backed card issuance. Its infrastructure offers innovative tools for liquidity management and cross-border transactions, enabling businesses to integrate stablecoins into everyday payment flows. Through partnerships with leading financial institutions and payment technology partners, StraitsX delivers secure, regulated payment solutions that bridge traditional finance and the digital economy.
For more information, visit www.straitsx.com
