Organized Crime Network Investigation: Money Laundering Through Cash-Out of Online Game Virtual Assets

Organized Crime Network Investigation: Money Laundering Through Cash-Out of Online Game Virtual Assets

On Oct. 26, 2026, the operator of the popular NetEase game Fantasy Westward Journey posted a routine maintenance notice on its official website, announcing an upcoming adjustment to the game’s prepaid-card trading system on four test servers. The changes included capping the amount of prepaid game time a character can buy each day with in-game currency at 200 points, and placing the in-game currency earned from card sales under a two-hour review.

This is a rare major change since the game launched its virtual prepaid-card trading service in 2004. Players who had previously been able to buy virtually unlimited prepaid game time each day will now be able to buy only 20 yuan worth. The change immediately caused an uproar in the game’s community. Some players believe the operator is trying to curb improper profits made by gaming studios; others believe it was required by regulators. As of publication, however, the company had not offered an explanation.

Drawing on Bitrace’s intelligence on cryptocurrency money laundering, this article examines possible reasons for the significant change from an anti-money-laundering perspective.

Fantasy Westward Journey’s Prepaid Game Time Consignment Mechanism

Fantasy Westward Journey is a massively multiplayer online role-playing game developed and operated by NetEase. It uses a subscription model based on play time and has been popular with players since its public launch. Beyond its gameplay, the title is particularly known for its highly effective and stable in-game economy.

The game includes an in-game virtual asset marketplace called the Treasure Pavilion, where users can buy and sell items, materials, summoned creatures and other game assets in yuan. It also allows players to trade in-game currency for prepaid game time, known as game cards.

An ordinary player can buy prepaid game time in yuan on the official website, then list it for sale with a designated non-player character in the game. Other players can place orders using in-game currency and receive game time. Players with unused in-game currency can also list it on the Treasure Pavilion and convert it into yuan.

These two mechanisms help preserve the value of in-game virtual assets and keep the exchange rate between in-game currency and yuan highly stable. For example, as of Oct. 27, 2026, when this article was completed, a prepaid card worth 200 yuan could be sold in the game for 30 million Fantasy coins. The exchange rate had remained in this range for more than a decade.

What Is Cash-Out Processing?

In money laundering—particularly services that clean funds for illicit markets such as online gambling and telecom fraud—“cash-out processing” refers primarily to using specialized platforms to verify and monetize fungible assets such as virtual goods, online accounts, precious metals and consumer electronics. Trading these goods is intended to disrupt the traceability of funds and facilitate laundering. 

An example of a cash-out channel using online game virtual assets in a telecom fraud scenario:

Professional money-laundering crews recruit large numbers of third parties in advance, under the pretext of online earning opportunities, work-from-home jobs for mothers, student part-time jobs or task-based gigs. After receiving fiat currency stolen from victims on behalf of fraud groups, crew organizers immediately use it to buy game assets. They then ask third parties to purchase those assets at below-market prices using the U.S. dollar stablecoin Tether (hereafter, USDT). The third parties subsequently monetize the game assets and keep the price difference as profit.

In this process, the third parties mistakenly believe they are taking part in an online earning opportunity, but in reality they become low-level money mules.

These unlicensed cash-out platforms—or platforms disguised as legitimate gift-card buyback services—and money-laundering crews take work from telecom fraud groups upstream and connect with large numbers of low-level mule account holders downstream. Using USDT and online game virtual assets, they break the direct link between funds and the underlying crimes, laundering the proceeds.

In addition to online cash-out through virtual assets, there are many offline channels using gold and Apple iPhones, known in the industry as “physical-asset cash-out.” The money-laundering methodology is unchanged; only the form differs, so it is not discussed further here.

A Money-Laundering Case

Bitrace has long monitored cryptocurrency money-laundering activity on Telegram. The following is a real case involving money laundering through NetEase prepaid game time:

Take a third-party payment tool as an example. The platform advertised prepaid cards for various games at discounted prices. NetEase prepaid cards were specifically listed at 84% of the official price, meaning buyers could pay 84 yuan (equivalent to 12.57 USDT) for a 1,000-point card with a face value of 100 yuan.

Payment, however, had to be made in USDT. The platform published two receiving addresses on its official Telegram channel:

TFKSDvM7Nw2gX57j3Xuo6JbxUYTWAEX3DS

THovNk3LWCmbGeYw6YFmeATZSiwzYiLcfP

An analysis of transactions involving the two receiving addresses found that the entity had collected more than $2.37 million in USDT in just the past month. Since the money-laundering spread is not included, the actual amount laundered may exceed $2.5 million.

Notably, not all of these fund flows were related to NetEase; the data covered multiple companies and platforms.

NetEase’s Tough Anti-Money-Laundering Stance

Although NetEase has offered no additional explanation for this major change, a review of the company’s work over the past several decades to combat money laundering and related illicit industries gives players a glimpse of its consistently tough approach. 

On one front, its official trading platform, the Treasure Pavilion, has steadily strengthened its risk controls in recent years. Players must log in through NetEase Pass, bind an authentication device such as the NetEase Token or a security card, and complete real-name verification. The platform has also added holding periods and safeguards for unusual transactions involving virtual assets. Before assets can be sold, they must be listed publicly for several hours to 14 days to prevent sales of stolen accounts. Yuan earned from a sale cannot be withdrawn immediately; it is subject to a three-day review period to prevent illicit fund transactions. The platform also monitors unusual pricing and suspicious asset origins to prevent threat actors from laundering money by selling virtual assets at inflated prices.

NetEase has also worked with police for years to combat illicit industries involving private servers, cheats and gambling. In concentrated campaigns, including in 2021, authorities solved multiple cases, arrested dozens of people, shut down numerous private servers, investigated cases involving tens of millions of yuan and targeted fund-settlement platforms. Official announcements show that in 2025 the company continued working with police to investigate cases involving private servers, cheats and casinos operated through game mechanics, with multiple defendants sentenced to prison. NetEase’s internal risk controls have also identified anomalies: in the past, the company identified an employee who stole dormant accounts and referred the case to police.

These efforts have disrupted illicit-industry networks that could be used to move illegal funds. The latest move to sharply restrict the amount of prepaid game time players can buy or sell appears to be a further patch to an already well-developed anti-money-laundering framework, reducing the likelihood that in-game currency will be exploited by illicit-market operators.

Disclaimer

This article is based on publicly available information and related investigative materials. It aims to highlight the real-world threat of using online game virtual assets to transfer, convert and launder illicit funds, and to inform anti-fraud awareness, risk identification and compliance research. The Telegram groups, blockchain addresses and operating methods discussed are supported by corresponding materials. Assessments of their nature, use and connections are limited to the evidence and scope of analysis set out in this article.

Specific games, companies, trading platforms and payment tools are mentioned solely to explain how related assets and services may be exploited in the scenarios described. Their mention does not constitute an allegation that they participated in, knew of or tolerated illegal activity. The misuse of a legitimate product or service by a third party should not, by itself, be treated as evidence of wrongdoing by its provider. The appearance of a group, account or address also does not mean that all of its activities, transactions or associated parties are criminal. Specific liability and legal status must be determined by the competent authorities in accordance with the law.

Recruitment messages, profit promises and claims such as “risk-free” quoted in this article are statements made by the publishers of the source materials; the article does not endorse or verify their accuracy. Descriptions of the methods are provided solely to explain the risks and do not constitute instructions for participation, transaction advice or recommendations of any platform or service.

For risk-control and compliance teams at blockchain trading platforms and payment providers, these activities are a reminder that fund flows ostensibly tied to game purchases, virtual-asset trading or gift-card buybacks may still be connected to illicit financial networks involving fraud or gambling. Relevant institutions should assess risk in light of customer behavior, transaction patterns and fund sources. They should not determine legality based only on a transaction label, nor presume a transaction is illegal merely because it involves game assets or tools such as USDT.

Contact us:

Website: www.bitrace.io

Email: [email protected]

Twitter: @Bitrace_team

LinkedIn:@bitrace tech