Chainalysis Cryptocurrency Crime Trends: Extortion and Darknet Activity Grow

Source: Chainalysis; Compiled by: Songxue, Golden Finance

2023 is the year of cryptocurrency recovery, as the industry recovers from the scandals and price drops of 2022. As crypto assets rebound and market activity grows in 2023, many believe that the crypto winter is ending and that a new crypto winter is coming to an end. A growth phase may be coming soon.

But what does this mean for cryptocurrency crime? Let's look at the trends.

2023 In 2017, the amount received by illegal cryptocurrency addresses dropped significantly, totaling $24.2 billion. As always, we must caution that these numbers are lower-end estimates based on inflows from the illegitimate addresses we identified today. A year from now, these totals will almost certainly be higher as we identify more illegitimate addresses and incorporate their historical activity into our estimates. For example, when we published our Crypto Crime Report last year, we estimated that illicit transaction volume would be worth $20.6 billion in 2022. One year later, our updated value for 2022 is $39.6 billion. Much of this growth comes from the identification of previously unknown highly active addresses hosted by sanctioned services, as well as our addition of transaction volumes associated with services in sanctioned jurisdictions to our illicit totals.

In addition to the discovery of new illegitimate addresses, there is another key reason why the total is so high: we now count creditor claims against FTX at $8.7 billion in 2022 data. In last year's report, we stated that we would delay including trading volume related to FTX and other companies that collapsed due to alleged fraud that year in our illicit totals until the legal proceedings were concluded. A jury has since convicted FTX’s former CEO of fraud.

Typically, we only include measurable on-chain activity in our estimates of illegal activity. In the case of FTX, the extent of fraudulent activity cannot be measured using on-chain data alone because there is no way to isolate illicit flows of user funds. Therefore, we believe the $8.7 billion creditor claim against FTX is the best estimate to include. Given the scale and impact of the FTX situation, we view it as an exception to our usual on-chain approach. If there are court convictions in similar ongoing cases, we plan to include their activities in our illegal transaction data in the future as well.

All other totals exclude proceeds from non-cryptocurrency homegrown crimes, such as traditional drug trafficking using cryptocurrencies as a means of payment. Such transactions are effectively indistinguishable from legitimate transactions in on-chain data. Of course, law enforcement with off-chain environments can still investigate these traffic using Chainalysis solutions. Where we are able to confirm such information, we will treat these transactions as illegal in our data, but this will almost certainly not be the case in many cases, so these numbers will not be reflected in our totals.

Except for illegal activities absolutely In addition to the decrease in value, our estimate of the share of all cryptocurrency trading volume related to illegal activity has also declined to 0.34% from 0.42% in 2022. [1]

We It has also seen changes in the types of assets involved in cryptocurrency-based crimes.

To Bitcoin has dominated 2021 as the cryptocurrency of choice for cybercriminals, likely due to its high liquidity. But this has changed in the past two years, with stablecoins now accounting for the majority of all illicit transaction volume. This change also comes alongside the recent growth of stablecoins’ share of all crypto activity, including legal activity. However, the dominance of stablecoins does not apply to all forms of cryptocurrency-based crime.

Someone Some forms of illegal cryptocurrency activity, such as darknet market sales and ransomware extortion, still primarily occur in Bitcoin. [2]Other aspects, such as scams and transactions related to sanctioned entities, have turned to stablecoins. These also happen to be the largest forms of cryptocurrency crime by transaction volume, thus driving a larger trend. Sanctioned entities and those operating in sanctioned jurisdictions or involved in terrorist financing also have more incentives to use stablecoins, as they may face more challenges when entering the United States. The U.S. dollar still hopes to benefit from the stability it provides. However, stablecoin issuers can freeze funds when they realize they are being used illegally, as Tether recently did with addresses linked to terrorism and war in Israel and Ukraine.

Below, we explore three key trends that will define cryptocurrency crime in 2023 and will be critical going forward.

Scams and stolen funds drop significantly

Cryptocurrency scams and hackers earn in 2023 Both fell significantly, with total illegal income falling by 29.2% and 54.3% respectively.

As we discuss later in the scams section, many cryptocurrency scammers are now employing scam tactics to target individuals and engage with them Build relationships in order to market fraudulent investment opportunities to them rather than promoting them widely. While reports of cryptocurrency investment scams in the U.S. and fraud revenue have increased year over year in 2022, our on-chain metrics show that global fraud revenue has been declining since 2021, according to data released by the FBI. trend. We believe this is consistent with the long-term trend that scams are most successful when markets are rising, exuberance is high and markets are prosperous. People feel like they’re missing out on opportunities to get rich quick. Of course, the impact of butchery scams on individual victims is devastating and should not be underestimated. While reporting has increased — at least in the United States — which is a good sign, we still believe insights into butcher plate scams are particularly underreported. We assume the true damage from scams is greater than reported to the FBI and our on-chain metrics indicate, but overall, scam activity is down given broader market dynamics.

Crypto hacking, on the other hand, is harder for criminals to hide because industry observers can quickly detect unusual outflows from specific services or protocols when a hack occurs. As we will discuss later, the decrease in stolen funds is mainly due to the sharp decrease in DeFi hacking attacks. This decline may represent a reversal of a troubling long-term trend and may mean that DeFi protocols are improving their security practices. That said, stolen funds metrics are largely driven by outliers, and a large-scale hack could change that trend again.

Ransomware and darknet market activity are on the rise

On the other hand, ransomware and darknet markets, two of the most prominent forms of cryptocurrency crime, saw revenue growth in 2023, in stark contrast to the overall trend. The disappointing growth in ransomware revenue follows the sharp decline we reported last year, suggesting ransomware attackers may have adapted to organizations' cybersecurity improvements, a trend we first reported earlier this year.

Similarly, this year’s increase in darknet market revenue follows a decline in revenue in 2022. This decline was largely caused by the shutdown of Hydra, which was by far the most dominant marketplace in the world, accounting for more than 90% of all darknet market revenue at its peak. While a single market has yet to emerge to replace it, the industry as a whole is rebounding, with total revenue climbing to 2021 highs.

Transactions with sanctioned entities drive the vast majority of illegal activity

When looking at illegal transaction volumes , perhaps one of the most obvious trends is the prominence of sanctions-related transactions. In 2023, transactions between sanctioned entities and jurisdictions totaled $14.9 billion, accounting for 61.5% of all illicit transactions we measure annually. Much of this is driven by cryptocurrency services sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) or services located in sanctioned jurisdictions, which can continue to operate because they are located in jurisdictions where U.S. sanctions are not enforced .

While these services can be used for improper purposes, it also means that some of that $14.9 billion is tied to the activities of ordinary cryptocurrency users who happen to live in these jurisdictions. For example, Russia’s Garantex exchange, sanctioned by the US OFAC and UK OFIS for assisting ransomware attackers and other cybercriminals in money laundering, was one of the largest drivers of total transaction volume related to sanctioned entities in 2023. Garantex continues to operate because Russia does not enforce U.S. sanctions. So, does this mean that all of Garantex’s transaction totals are related to ransomware and money laundering? no. However, exposure to Garantex introduces serious sanctions risks for cryptocurrency platforms subject to US or UK jurisdiction, meaning these platforms must remain more vigilant and screen for links to Garantex in order to remain compliant.

Endnotes:

[1] Trading volume is a measure of all economic activity and an indicator of how much money is changing hands. We remove strip chains, internal service transactions, change, and any other type of transaction that is not considered an economic transaction between different economic actors.

[2] These estimates do not include privacy coins such as Monero.