How Crypto Transactions Exposed an Alleged KSh300M Money-Laundering Network in Kenya
Imagine receiving USDT from another cryptocurrency trader, moving it between several exchange accounts and eventually converting it into Kenyan shillings.
The transactions may feel separate from the traditional banking system. However, once the cryptocurrency reaches a regulated exchange or is converted into money deposited in a bank account, investigators can begin connecting wallet activity with names, identification documents and financial records.
That is reportedly what happened in a major Kenyan investigation involving more than KSh300 million.
Kenya’s Assets Recovery Agency (ARA) says it traced money through international remittance platforms, intermediary bank accounts, companies and cryptocurrency wallets. The investigation resulted in approximately KSh115 million being frozen while authorities establish where the money originated.
The people named in the investigation deny wrongdoing and say they are legitimate cryptocurrency traders. No final court decision has established that they committed money laundering.
Kenyan authorities freeze KSh115 million
The investigation centres on Michael Machimbo and Glory Kithure, who are reportedly being investigated by the ARA and Directorate of Criminal Investigations (DCI).
According to an ARA affidavit reviewed by Business Daily, investigators believe the pair received and moved money through a network involving bank accounts, remittance services, companies and cryptocurrency exchanges.
The frozen assets reportedly include:
| Asset | Person or accounts linked | Approximate value |
|---|---|---|
| 751,853.70 USDT | Glory Kithure | KSh97.2 million |
| 896 USDT | Michael Machimbo | KSh115,852 |
| Funds held across nine bank accounts | Accounts at Equity Bank, Stanbic, NCBA, KCB and Absa | KSh17.6 million |
| Approximate total | KSh115 million |
The cryptocurrency figures are based on the exchange rate used when the case was reported. Their value in Kenyan shillings may change as the dollar-shilling exchange rate moves.
The preservation of some of the assets was also published in the Kenya Gazette of July 17, 2026.
Business Daily reported that a court granted a 90-day preservation order on July 3, allowing investigators to continue examining the funds.
A preservation order freezes property temporarily. It does not by itself mean that the owner has been convicted or that the property has been permanently forfeited.
How the alleged bank-transfer network operated
Investigators say the suspected operation used two main routes.
The first involved international remittance services, companies and several intermediary bank accounts.
According to the ARA affidavit, money allegedly originated from two individuals and two companies before moving through other accounts and eventually reaching accounts linked to Machimbo and Kithure.
The companies identified in the court filings were DigitalMall Global Limited and Bitflux Fintech Limited. Other individuals were allegedly used as intermediaries.
Between October 2022 and January 2024, Machimbo allegedly received KSh80.7 million in his Equity Bank accounts from two intermediaries. Another KSh17 million was reportedly transferred to his Stanbic Bank account from Bitflux Fintech.
Kithure allegedly received KSh53.6 million through 57 bank transfers between July 2022 and May 2025. The individual transactions ranged from KSh10,000 to KSh550,000.
The ARA argues that the repeated use of relatively small transactions and the movement of money through multiple accounts were possible indicators of layering.
Layering is the stage of money laundering in which funds are moved through different accounts, businesses, assets or financial systems to make their origin more difficult to identify.
However, frequent or small transactions do not automatically prove money laundering. Investigators must still establish that the money came from criminal activity and that the people involved knowingly handled criminal proceeds.
The crypto route investigators followed
The second route allegedly involved USDT, a stablecoin designed to track the value of the US dollar.
Investigators say cryptocurrency moved from an account on NoOnes to Binance wallets allegedly controlled by Machimbo and Kithure. Some of the cryptocurrency was then reportedly transferred to another Binance user who converted it into Kenyan shillings and sent the money to bank accounts.
The ARA affidavit identifies six people as having participated in different parts of the cryptocurrency transfers.
According to the reported court documents:
- Machimbo’s Binance wallet received 220,508 USDT in 10 transactions between June and September 2024.
- The same account recorded cumulative withdrawals or transfers of 899,130 USDT across 107 transactions between February 2023 and November 2025.
- Kithure’s Binance wallet received 930,597 USDT in 62 transactions between January 2023 and November 2025.
- Her account transferred or withdrew 178,491 USDT between February 2023 and January 2026.
Investigators reportedly interviewed one of the crypto traders involved in May 2026. He admitted controlling a NoOnes account registered using his wife’s identification details, according to the affidavit.
He also acknowledged operating accounts on OKX and Paxful. However, he claimed he did not know the source of the cryptocurrency he had been asked to transfer.
His wife reportedly said she had allowed him to use her details for cryptocurrency trading but did not know where the cryptocurrency passing through the accounts originated.
These statements remain allegations contained in the ARA’s court filings and have not yet been tested in a completed trial.
What reportedly triggered the wider investigation?
An earlier report by The Standard connected the investigation to money allegedly obtained from the United States Federal Student Aid Programme.
The court was reportedly told that people involved in the scheme were suspected of using US Social Security numbers to obtain federal student-aid grants before moving the funds through virtual assets.
The Standard reported that the prosecution identified the Federal Bureau of Investigation as the complainant and said investigators were examining nine cryptocurrency accounts.
Authorities also obtained orders affecting bank accounts, mobile-money accounts, cryptocurrency holdings, two vehicles and property in Kajiado County.
Business Daily reported that Kenya had sent a Mutual Legal Assistance request to the United States in May 2026.
A Mutual Legal Assistance request allows one country to formally seek bank records, identification information, testimony or other evidence from another country during an investigation.
How did crypto help investigators follow the money?
Cryptocurrency is sometimes described as anonymous, but most major blockchain networks are better described as pseudonymous.
A wallet address may not display its owner’s name publicly. Nevertheless, transactions can remain visible on the blockchain. Once investigators connect a wallet to a verified exchange account, bank account, phone number or identification document, they may be able to reconstruct parts of the transaction history.
In this case, the reported evidence appears to have come from a combination of:
- Cryptocurrency exchange account records
- Wallet deposit and withdrawal histories
- Identity information used to register exchange accounts
- Bank statements
- International remittance records
- Mobile-money activity
- Interviews with people who controlled the accounts
- Records showing the conversion of USDT into Kenyan shillings
This distinction is important. The public blockchain did not necessarily identify the people on its own. Investigators reportedly combined cryptocurrency records with information held by centralised exchanges, banks and remittance providers.
The conversion between crypto and Kenyan shillings may have been particularly significant. Moving USDT between wallet addresses can make ownership harder to establish, but depositing the resulting shillings into a bank account creates another financial record investigators can examine.
The couple denies the allegations
Machimbo and Kithure have challenged the freezing of their accounts in court.
According to The Standard, they accuse the ARA and DCI of conducting a fishing expedition and say the investigation raises concerns about privacy, due process and fair administrative action.
They deny involvement in criminal activity and maintain that they are cryptocurrency traders. They have also argued that freezing the accounts disrupted their source of income.
Business Daily reported that the two exercised their right to remain silent when questioned about the transactions. Exercising that right is not an admission of guilt.
The courts must ultimately determine whether the frozen assets represent proceeds of crime, legitimate cryptocurrency trading income or a mixture of funds from different sources.
Authorities also raise tax questions
The ARA says the pair are also being investigated for possible tax evasion.
According to its affidavit, they allegedly conducted transactions exceeding KSh300 million while consistently filing nil returns with the Kenya Revenue Authority.
Large transaction volumes do not necessarily represent taxable profit. A cryptocurrency trader can buy and sell the same capital repeatedly, creating substantial turnover without earning an equivalent amount in income.
Investigators and tax authorities would therefore need to distinguish between:
- Trading volume
- Initial investment capital
- Customer or third-party funds
- Business revenue
- Trading gains and losses
- Personal income
- Potential proceeds of crime
Nevertheless, filing nil returns while receiving large amounts through crypto and bank accounts is likely to attract scrutiny, particularly if proper trading and accounting records are unavailable.
Kenya is tightening its crypto oversight
The investigation comes as Kenya strengthens its approach to cryptocurrency regulation and financial crime.
The Virtual Asset Service Providers Act, 2025 created a formal legal framework for licensing and supervising businesses that provide virtual-asset services in Kenya.
The legislation is intended to bring cryptocurrency exchanges, brokers, custodians and other covered service providers into a clearer regulatory structure.
Kenya also remained on the Financial Action Task Force’s list of jurisdictions under increased monitoring as of June 2026. FATF acknowledged that Kenya had taken steps to improve its system but said the country still needed to increase money-laundering investigations and prosecutions, improve financial intelligence and strengthen risk-based supervision. FATF, June 2026
Being on the grey list does not mean every transaction from Kenya is suspicious. It means the country has committed to addressing identified weaknesses in its systems for fighting money laundering and terrorist financing.
What Kenyan crypto traders should learn from the case
The case does not mean cryptocurrency trading, P2P transactions or the use of USDT is illegal.
It does, however, show why traders need clear records explaining where their funds came from and why payments were made.
Crypto traders and businesses should consider keeping:
- Cryptocurrency purchase and sale records
- Wallet addresses and transaction hashes
- P2P order histories
- Bank and M-Pesa statements
- Customer invoices
- Agreements for transactions conducted on behalf of another person
- Evidence showing the source of trading capital
- Records of profits, losses, fees and taxes
- Proof that exchange accounts are registered in the correct person’s name
Allowing another person to use an exchange account or registering an account using someone else’s identification can create serious compliance and ownership questions, even where the underlying trading activity is legitimate.
Traders should also be cautious when asked to receive, transfer or convert cryptocurrency for someone who cannot clearly explain its source.
Frequently Asked Questions
Was KSh300 million in cryptocurrency frozen?
No. Authorities reportedly froze approximately KSh115 million in USDT and bank accounts. Investigators estimate that the wider property and transactions linked to the investigation exceed KSh300 million.
Who is being investigated?
The investigation reportedly centres on Michael Machimbo and Glory Kithure. They deny wrongdoing and maintain that they are legitimate cryptocurrency traders.
Which cryptocurrency was involved?
The investigation primarily involves USDT, a stablecoin designed to track the value of the US dollar.
How did investigators trace the cryptocurrency?
Investigators reportedly combined cryptocurrency wallet histories with exchange records, identification information, bank statements, remittance records and interviews.
Have the people involved been convicted?
No final judgment has established that they committed money laundering. The funds are preserved while investigations and court proceedings continue.
Is cryptocurrency trading illegal in Kenya?
No. Cryptocurrency trading is not prohibited in Kenya. However, traders and virtual-asset businesses must comply with applicable financial-crime, tax and regulatory requirements.
