In recent years, illegal activities such as money laundering using cryptocurrency represented by bitcoin have been emerging. The anonymity, two-way convertibility and transnational of bitcoin are used to “launder” illegal income. Some bitcoin theft incidents are also associated with money laundering. Hackers “launder” the stolen bitcoins and eventually convert them into legal property. In this paper, we explore whether these illegal activities can be detected. First, we mine the user characteristics from the original transaction data of bitcoin. Second, the user characteristics are classified to distinguish normal users from abnormal users. Third, Gaussian Mixture Model is used to cluster users to find suspicious users. Finally, we detect the abnormal transactions among the suspicious users.