At the end of August 2026, federal prosecutors filed a civil forfeiture complaint in New Mexico describing an undercover investigation that had been running since February 2025. 

‍

Agents and a confidential source bought two kilograms of cocaine from a man named Miguel Torres, allegedly a member of the Sinaloa Cartel's Los Mayos faction, and paid him $30,000 in USDT. Agents wanted to test whether Torres could use crypto instead of cash to move drug proceeds across the border.

‍

Over the following months, agents picked up bulk cash on Torres's instructions, including $73,000 in Kansas and $173,000 in South Carolina, converted it into USDT and sent it through the TRON network to accounts Torres directed but did not personally control, as the accounts belonged to independent money laundering organisations working on the cartel's behalf. The same accounts were also handling funds tied to Iran's Revolutionary Guard Corps and roughly $12,000 laundered from the 2025 ByBit exchange hack, the theft attributed to North Korean hackers. Investigators asked Tether to freeze the accounts in mid-2025, and by 11 August 2026 the full balance, $2,248,478, had been transferred into FBI custody. No arrests had been made at the time of writing. 

‍

This case demonstrates an interesting progression as hostile groups across the world embrace crypto as a financial railing. A single laundering pipeline, built to move a Sinaloa faction's cocaine money, was also carrying funds for an Iranian state-security apparatus and for the proceeds of a North Korean hack, three entirely different criminal or state actors sharing the same rented plumbing.

‍

This story sits alongside another recent story concerning the Sinaloa Cartel. In Puebla state, Mexican federal prosecutors, the Navy and state police dismantled a clandestine crypto mining operation in the municipality of Tlaola, seizing around 300 GPUs, transformers and satellite internet equipment that had been illegally drawing power from a hydroelectric complex, the fourth such farm found in the same corridor since early last year. No formal cartel link has been confirmed in court filings, however, Mexico-based security analyst David Saucedo described the operation as evidence that cartels have reached a new level of financial sophistication. 

‍

‍

These cases demonstrate different levels of reliance on crypto by the Cartel: going digital does not allow the operation to move entirely away from the real world. The Puebla farm case still required electricity, stolen from a real hydroelectric grid, and the New Mexico network needed real cash and a network of people to collect pickups before any cash could be moved on-chain. Cartels are adapting their methodologies to incorporate crypto, and to different degrees within their models. 

‍

Cartel's Methodology

‍

The courier-to-stablecoin model 

The New Mexico case is close to a textbook version of the pattern that has shown up repeatedly in US enforcement actions since 2023. A courier or undercover buyer hands over cash for drugs or as a laundering test; a broker converts that cash into a stablecoin, usually USDT, in transactions designed to stay under reporting thresholds; the funds move through one or more wallets, often across chains, before reaching cartel leadership or being reinvested in the business. US Treasury sanctions have named specific individuals running this model for the Sinaloa Cartel's Los Chapitos faction: Mario Alberto Jiménez Castro, sanctioned in 2023 for laundering roughly $870,000 through crypto before he was killed in 2024, and his successor Armando de Jesús Ojeda Aviles, sanctioned in May 2026 for a similar network built on US-based couriers.

‍

‍

Cross-Border Broker Networks

Some prosecutions demonstrate this methodology at a large scale. A Mexican broker known as "Meño" was sentenced in 2025 to eight years for laundering $5.4 million in crypto for the Jalisco New Generation Cartel (CJNG) across thirteen US cities. A separate Florida-based hub, run by a Colombian national and a dozen associates, allegedly moved tens of millions of dollars over four years. Court filings also describe collaboration with Chinese money laundering organisations, which move crypto proceeds internationally and arrange precursor chemical payments back to Chinese suppliers through the same networks.

‍

Mining as a Laundering Channel

The Puebla farm points to a smaller-scale but distinct method: generating crypto directly with stolen electricity rather than converting cash that has to be explained. It fits a wider regional pattern of Latin American criminal groups treating mining rigs as a laundering tool precisely because the proceeds never pass through a visible cash-to-crypto conversion step. 

‍

How Transaction Monitoring can Support the Takedown of the Cartels 

‍

Wallet Screening at the Point of Conversion

The most exposed moment is the cash-to-USDT conversion itself, the point where a broker's wallet first touches a regulated exchange or off-ramp. Real-time screening that flags a wallet the instant it shows exposure to a known broker cluster, rather than after a transaction settles, turns a compliance check into an interdiction: the deposit or withdrawal can be held before the funds move on. 

Typology Matching to Catch Structuring Before it Repeats

Brokers converting bulk cash tend to structure the resulting crypto transactions to stay under reporting thresholds and repeat the pattern across many pickups, as Torres did across Kansas and South Carolina. A monitoring system tuned to that specific behaviour can flag it after two or three instances rather than waiting for a broker to build out a network across a dozen cities.

Off-chain signals to Catch Shared Infrastructure Before it Serves a Third Client.

 The fact that the same accounts served the cartel, the IRGC and a North Korean hacking operation only became visible through advanced intelligence layered on top of the raw transaction data. In practice, that means a cluster flagged for cartel exposure should automatically be checked against sanctions lists, adverse media and dark web intelligence tied to entirely different typologies. That is what turns a single laundering-network discovery into a lead on other hostile entities is using the same pipeline, rather than a closed case once the original client is designated.

‍

Freezing and Referral Once a Network is Confirmed

The New Mexico case shows this mechanism working successfully: once blockchain analysis tied specific USDT accounts to the laundering network, investigators asked Tether to freeze them, and the full balance was in FBI custody within months, well before any arrest. That is the freeze acting as the interdiction itself, not merely as a step toward one. 

‍

Nominis assesses that the most important finding in the New Mexico case is not that a cartel used crypto, that has been documented since 2023, but that the laundering pipeline it used was not built exclusively for it. The same accounts carried Sinaloa cocaine proceeds, IRGC-linked funds and North Korean hacking proceeds, which suggests laundering-as-a-service, not client-specific infrastructure, is what these networks are actually optimised to sell. 

‍

Surfacing that kind of finding at all depends entirely on the quality of the clustering behind it: a shallow attribution model sees three unrelated wallets making ordinary transfers, while a deep one recognises them as a single entity serving three different illicit clients. That is the gap between an alert that closes a case and one that only reopens it three more times under three different names. The Puebla mining case shows cartels are willing to experiment with generating crypto value directly; while the New Mexico case shows what a working laundering network actually looks like once it exists, shared, reusable, and identifiable as a single cluster only to a monitoring stack built to attribute it correctly in the first place.

‍

All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.

‍