2023 was a year of recovery for cryptocurrencies as the industry recovered from the scandals, explosions, and price crashes of 2022. With the rebound in crypto assets and growth in market activity throughout 2023, Many believe that crypto winter is ending and a new growth phase may soon be upon us.
But what did all that mean for cryptocrime? Let's look at the high-level trends.
2023 saw a significant drop in the value received from illicit cryptocurrency addresses, to a total of $24.2 billion. As always, we must caution that these figures are lower-bound estimates based on the inflows to the illicit addresses we have identified today. A year from now, these totals will almost certainly be higher, as we identify more illicit addresses and incorporate their historical activity into our estimates. For example, when we published our Crypto Crime Report last year, we estimated illicit transaction volume worth $20.6 billion by 2022. A year later, our updated estimate for 2022 is $39.6 billion. Dollars. Much of that growth came from the identification of previously unknown and highly active addresses hosted on sanctioned services, as well as our addition of the transaction volume associated with services in sanctioned jurisdictions to our illicit totals.
Another key reason the new total is much higher, besides the identification of new illicit addresses: we are now counting the $8.7 billion in creditor claims against FTX in our 2022 figures. In last year's report, we said that we would postpone the inclusion of transaction volumes associated with FTX and other companies that collapsed that year under allegedly fraudulent circumstances in our illicit totals until legal processes played out. Since then, a jury has convicted former FTX CEO of fraud.
We generally only include measurable chain activity in our estimates of illicit activity. In the case of FTX, it is impossible to use on-chain data alone to measure the extent of fraudulent activity, as there is no way to isolate illegitimate movements of user funds. As such, we believe that $8.7 billion in creditor claims against FTX is the best estimate to include. Given the size and impact of the FTX situation, we are treating it as an exception to our usual on-chain methodology. If the courts convict in similar ongoing cases, we plan to include your activity in our illicit transaction data in the future as well.
All other totals exclude proceeds from non-native cryptocurrency-related crimes, such as conventional drug trafficking where cryptocurrency is used as a means of payment. These transactions are virtually indistinguishable from lawful transactions in on-chain data. Of course, law enforcement in an off-chain context can still investigate these flows using Chainalysis solutions. In cases where we can confirm such information, we count transactions as illicit in our data, but there are almost certainly many cases where that is not the case and therefore the figures would not be reflected in our totals. .
In addition to the reduction in the absolute value of illicit activity, our estimate of the share of all crypto transaction volume associated with illicit activity also fell, from 0.42% to 0.34% in 2022. [1]
We are also seeing a shift in the types of assets involved in cryptocurrency-based crimes.
Until 2021, Bitcoin reigned as the preferred cryptocurrency among cybercriminals, likely due to its high liquidity. But that has changed in the last two years, and stablecoins now account for the majority of all illicit transaction volume. This change is also accompanied recent growth in the involvement of stablecoins in all crypto activity in general, including legitimate activity. However, the dominance of stablecoins does not apply to all forms of cryptocurrency-based crimes.
Some forms of illicit cryptocurrency activity, such as darknet market sales and ransomware extortion, are still predominantly carried out in Bitcoin. [2] Others, such as scams and transactions associated with sanctioned entities, have moved to stablecoins. These are also the largest forms of crypto crime by transaction volume, driving the broader trend. Sanctioned entities, as well as those operating in sanctioned jurisdictions or involved in terrorist financing, also have a greater incentive to use stablecoins, as they may face more challenges accessing the US dollar through traditional means, but still want benefit from the stability it provides. . However, stablecoin issuers can freeze funds when they become aware of their illicit use, such as Tether. I recently did it with addresses linked to terrorism and war in Israel and Ukraine.
Below we will look at three key trends that defined cryptocrimes in 2023 and will be important to watch in the future.
Scams and theft of funds decrease in a big way
Revenue from crypto scams and hacking fell significantly in 2023, with total illicit revenue from each falling by 29.2% and 54.3% respectively.
As we will see later in our scam section, many cryptocurrency scammers have now adopted romance scam tactics, targeting people and establishing relationships with them to present them with fraudulent investment opportunities, rather than advertising them widely, which often makes them more difficult. to discover. Although the FBI has published data showing Although reports of crypto investment scams in the US have increased year over year through 2022, our on-chain metrics suggest that global scam revenue has been trending downward since 2021. We believe this aligns with The long-standing trend that scamming is most successful when markets are up, exuberance is high, and people feel like they are missing out on the opportunity to get rich quick. Of course, the impact of romance scams on individual victims is devastating and should not be underestimated. And while the increase in reporting (at least in the US) is a good sign, we still believe that knowledge about romance scams in particular is suffering from a lack of reporting. Our hypothesis is that the true damage of the scam is greater than what the FBI reports and our on-chain metrics show, but overall, the scam has decreased, given the broader market dynamics.
Cryptocurrency hacking, on the other hand, is much harder for criminals to hide, as industry observers can quickly spot unusual departures from a given service or protocol when a hack occurs. As we will see later, the decline in stolen funds is largely due to a sharp drop in DeFi hacking. This fall could represent the reversal of a disturbing situation, long term trendand it may mean that DeFi protocols are improving their security practices. That said, stolen funds metrics are largely based on outliers, and a big hack could change the trend again.
Ransomware and darknet market activity is on the rise
Ransomware and darknet markets, on the other hand, are two of the most prominent forms of cryptocrime whose revenues increased in 2023, in contrast to general trends. Ransomware revenue growth is disappointing after the sharp declines we experienced covered last yearand suggests that perhaps ransomware attackers have adapted to organizations' cybersecurity improvements, a trend we first reported earlier this year.
Similarly, this year's growth in dark web market revenue also comes after a 2022 decline in income. That decline was largely driven by the shutdown of Hydra, which was once by far the most dominant marketplace in the world, capturing more than 90% of all darknet market revenue at its peak. While no market has yet emerged to take its place, the sector as a whole is recovering and total revenues are returning to their 2021 highs.
Transactions with sanctioned entities drive the vast majority of illicit activities
Perhaps the most obvious trend that emerges when analyzing the volume of illicit transactions is the prominence of sanctions-related transactions. The sanctioned entities and jurisdictions together accounted for a combined transaction volume of $14.9 billion in 2023, representing 61.5% of all illicit transaction volume we measured for the year. Most of this total comes from cryptocurrency services that were sanctioned by the US Department of the Treasury's Office of Foreign Assets Control (OFAC), or are located in sanctioned jurisdictions, and can continue to operate because they are located in jurisdictions where US sanctions do not apply.
While those services can and have been used for nefarious purposes, it also means that some of that $14.9 billion in sanctions-related transaction volume includes activity from average cryptocurrency users residing in those jurisdictions. For example, the Russian-based Garantex exchange, which was sanctioned by OFAC and OFSI in the UK. for facilitating money laundering on behalf of ransomware attackers and other cybercriminals, was one of the largest drivers of transaction volume associated with sanctioned entities in 2023. Garantex continues to operate because Russia does not enforce US sanctions. So does that mean that all of Garantex's transaction volume is associated with ransomware and money laundering? No. However, exposure to Garantex introduces a risk of serious sanctions for crypto platforms subject to US or UK jurisdiction, meaning those platforms must remain increasingly vigilant and detect exposure to Garantex to be able to comply.
More information on crypto crimes to come
Stay tuned for more investigations into cryptocurrency-based crimes, as we continue to provide information on ransomware, hacking, crypto money laundering, and more. You also can Click here to receive the full 2024 Crypto Crime Report in your inbox as soon as it is published.
Final notes:
[1] Transaction volume is a measure of all economic activity, an indicator of funds changing hands. We eliminate peeling chains, internal service transactions, exchanges and any other type of transaction that does not count as an economic transaction between different economic actors.
[2] These estimates do not include privacy coins like Monero.
This material is for informational purposes only and is not intended to provide legal, tax, financial, investment, regulatory or other advice, nor should it be considered a professional opinion. Recipients should consult their own advisors before making these types of decisions. Chainalysis does not guarantee the accuracy, completeness, timeliness, suitability or validity of the information contained herein. Chainalysis has no liability for any decision made or any other act or omission in connection with the Recipient's use of this material.
