jakiro
Source: Chainalysis; Compilation: Baishui, bitchain vision
In recent years, cryptocurrencies have become increasingly mainstream.Although illegal activities on the chain used to be mostly centered around cybercrime, cryptocurrencies are now being used to fund a variety of threat factors, from national security to consumer protection.As cryptocurrencies gain more and more recognition, illegal activities on-chain have become more diverse.For example, some illegal actors operate primarily off-chain but transfer funds to the chain for money laundering.
We report certain defined categories every year – stolen funds, dark web markets, and ransomware, to name just a few.However, as crypto crimes diversify to include all types of crime, the on-chain illegal ecosystem has witnessed an increasing specialization, and the number of organizations and networks of illegal actors using cryptocurrencies has become increasingly complex.In particular, we have seen the emergence of large-scale on-chain services that provide infrastructure for multiple types of illegal actors to help them launder money.
How do these developments develop on the chain?Let’s look at the data and overall trends.
According to our metrics today, the value received by illegal cryptocurrency addresses appears to drop to $40.9 billion in 2024.However, 2024 could be a record year for illegal inflows, as these figures are based on the lower limit estimates of illegal address inflows we have determined to date.
A year later, these totals will be higher as we identify more illegal addresses and include their historical activity in our estimates.For example, when we released last year’s crypto crime report, we reported $24.2 billion in 2023.One year later, our latest estimate for 2023 is $46.1 billion.Much of the growth comes from various types of illegal actor organizations, such as vendors operated through Huione, which provide on-chain infrastructure and money laundering services to high-risk and illegal actors.
It makes sense that illicit cryptocurrency transactions in 2024 will exceed 2023.Since 2020, our annual estimates of illegal activities, including attribution of evidence and Chainalysis Signals data, have increased by an average of 25% during the annual reporting period.Assuming that crypto crime reports grow similarly from now to next year, our annual total in 2024 could exceed the $51 billion threshold.
Generally speaking, our total does not include income from non-crypto-native crimes, such as traditional drug trafficking and other crimes that may use cryptocurrencies as means of payment or money laundering.Such transactions are almost indistinguishable from legitimate transactions in on-chain data, although law enforcement agencies with off-chain information can still use Chainalysis solutions to investigate these crimes.If we can confirm such information, we will count these transactions as illegal transactions in the data.For example, our 2022 data has included $8.7 billion creditor claims against the exchange since the former FTX CEO was convicted of fraud.But, it is almost certain that in many cases we do not have such confirmation, so these numbers are not reflected in our total.
How big is the scale of crypto crime in 2024?
-
Currently known illegal addresses receive $40.9 billion in funds, but based on historical trends, we estimate that the total may be close to $51 billion
-
Accounts for 0.14% of the total transaction volume on-chain
Estimates of illegal trading activities include:
-
Funds are sent to addresses we deemed illegal
-
Funds stolen by cryptocurrency hackers
Estimates of illegal trading activities do not include:
-
Send funds to which we have not identified as illegal addresses.Why?Because we don’t know that they are illegal.But as we do more recognition, we roll over our numbers.
-
Funds from non-crypto-native crimes, except for cases where customers bring our attention.Why?Because without more information, these transactions cannot be proven illegal.
-
Funding related to extremist groups.Why?Because the definitions that constitute extremism are often influenced by interpretation and are inconsistent in different jurisdictions.
-
Funds related to the crypto platform accused of fraud have not been convicted by court.Why?Because only the judge and the jury can make this decision.
-
Trading volume related to potential market manipulation.Why?Because our research heuristics aim to capture suspicious instances of market manipulation based on on-chain behavior, but are not decisive.
At the time of publication, we saw an absolute value of illegal activity drop year-on-year; however, based on historical growth rates, we suspect that this number will eventually exceed the total last year as data attribution improves.In addition, our estimates of all attributive crypto trading volume share associated with illegal activities (shown below) also fell from 0.61% in 2023 to 0.14%.Again, we expect this ratio to rise over time, although historically these ratios have always been below 1%.[1]
We also see a continuous trend in asset types involved in crypto crime.
By 2021, BTC is undoubtedly the preferred cryptocurrency for cybercriminals, possibly due to its high liquidity.However, since then, we have observed a steady diversification of BTC, and stablecoins now account for the vast majority of all illegal transactions (63% of all illegal transactions).This new reality is part of a broader ecosystem trend, where stablecoins also account for a considerable proportion of all crypto activity, as evidenced by a year-on-year increase of about 77%.In our 2024 Crypto Geographic Report, we present a wide range of practical use cases of stablecoins in a range of markets such as storing value, remittances, facilitating cross-border payments and international trade.Additionally, if stablecoin issuers realize that illegal actors use these funds, they usually freeze the funds.Tether, for example, has frozen worrying addresses related to scams, terrorist financing and sanctions evasion, which could make stablecoins a bad tool for illegal actors to transfer value.
Nevertheless, despite these ecosystem-wide trends, some forms of crypto crime, such as ransomware and dark web market (DNM) sales, remain dominated by BTC.The popular privacy currency Monero, while an increasingly important part of the DNM ecosystem, is not included in the analysis of this report.Other illegal activities (such as fraud or money laundering) are often taken a more compromised approach and are spread across all asset types.Other illegal activities, such as transactions related to sanctioned entities, have shifted primarily to stablecoins.Sanctioned entities, including individuals operating within sanctioned jurisdictions, often have a greater motivation to use stablecoins because a traditional way of obtaining the dollar is challenged while looking to benefit from the stability of the dollar.
Below, we will take a closer look at three key trends that define crypto crime in 2024 that will be important trends to focus on in the future.
Stolen funds and fraud are still rampant
The stolen funds rose by about 21% year-on-year to $2.2 billion.Although the largest share of stolen funds comes from decentralized finance (DeFi) services, centralized services are the most popular in the second and third quarters.Private key leaks accounted for the largest share of stolen cryptocurrencies in 2024 (43.8%), with North Korean hackers stolen more money from crypto platforms than ever: $1.34 billion, accounting for 61% of the total stolen amounts throughout the year.Some of these incidents appear to be related to North Korean IT workers who increasingly penetrate encryption and web3 companies, disrupt their networks, and use complex strategies, technologies, and procedures (TTP).
High-tech and low-tech fraud and fraud are rampant in 2024, and high-yield investment fraud and pig killing are the most successful types of fraud and fraud.We also observedArtificial intelligence (AI) is increasingly used in the fields of fraud and fraud, such as highly personalized sexual ransomware attacks.This use of AI is consistent with a wide range of illicit cybercrime trends, as using AI to bypass the services required by Understanding Customer (KYC) has emerged.Fraud and scam operators are also leveraging guaranteed services such as Huione (described below), and crypto ATM scams are increasingly worrying, especially in connection with older adult fraud.
Ransomware remains focus, dark web market and fraud stores decline
Ransomware revenue continues to reach hundreds of millions of dollars, but a series of large-scale multilateral law enforcement interference, coupled with the decline in victims’ willingness to pay ransom, has had a shock to the ecosystem.Still, 2024 is still a productive year, as attack volumes are relatively stable, and some ransomware groups still manage to barely pay the ransom – albeit with a lower amount.
The dark web market received $2 billion, compared to nearly $2.3 billion in 2023, while the number of fraudulent stores fell a little more than half to $220.1 million.The number of fraud stores has dropped significantly, in part because of the massive shutdown of the Universal Anonymous Payment System (UAPS), a crypto payment processor that facilitates transactions for hundreds of fraud stores including Brian Dumps and Faceless.
The crypto crime landscape is becoming increasingly diversified and professional
A range of illegal actors, including transnational organized crime groups, are increasingly using cryptocurrencies to commit traditional crimes, such as drug trafficking, gambling, theft of intellectual property, money laundering, trafficking in population and wildlife, and violent crime.Additionally, some criminal networks are resorting to cryptocurrencies to promote multiple crimes or multiple types of crime.In fact, of the total $40.9 billion received in 2024, $10.8 billion came from “illegal actors organizations”, which is what we do for direct cybercrimes such as hacking, ransomware, trafficking or fraud.A collective term for services and personal wallets, and those who promote such activities by selling the infrastructure, tools and services needed for crime and profitability, including money laundering as a service.
Perhaps no entity illustrates the specialization of the crypto crime ecosystem better than the online marketplace Huione Guarantee.As we highlighted in the mid-2024 Crypto Crime Update, Huione and all vendors operating on its platform have processed over $70 billion in crypto transactions since 2021.The platform provides the infrastructure to promote the sale of fraudulent technology and handles on-chain transactions of pig killings and other frauds and scams, addresses reported as stolen funds, sanctioned entities such as Garantex, fraud stores, childrenSexual abuse materials as well as gambling websites and casinos, etc.
Notes:
[1] Trading volume is an indicator for measuring all attributive economic activities and an agency indicator for capital transfer.This year, we adjusted our approach to include only transactions involving at least one attribution entity, while removing divest chains, internal service transactions, transactions between two personal wallets, change and any other not considered different economic actors.Types of transactions between economic transactions.
