Original author: Chainalysis team
Original compilation: Luffy, Foresight News
2023 is a year of cryptocurrency recovery, as the industry gradually recovers from a series of scandals, crashes, and price drops in 2022. As cryptocurrency prices rebound and market activity grows in 2023, many believe that the crypto winter is over and a new phase of growth may soon arrive.
But what does this mean for cryptocurrency crime? Let’s first look at the trends from an overall industry perspective.
In 2023, the value of cryptocurrencies received by cryptocurrency wallet addresses linked to violations fell significantly, totaling $24.2 billion. As always, we must caution that these numbers are based on inflows from wallet addresses that we currently identify as being associated with violations, which is the lower end of our estimates. Over the next year, as we identify more illegitimate addresses and incorporate their historical activity into our statistics, the total will almost certainly be higher. For example, when we released our Cryptocurrency Crime Report last year, we estimated that illegal cryptocurrency transactions would be worth $20.6 billion in 2022. One year later, our latest estimate for 2022 has increased to $39.6 billion. Much of this increase comes from the identification of previously unknown highly active addresses hosted by sanctioned services, as well as our addition of transaction volumes associated with services in sanctioned jurisdictions to our statistical totals.
In addition to the discovery of new illicit wallet addresses, there is another key reason why the new total is so high: we have now added $8.7 billion in creditor claims against FTX to the calculation of the 2022 data. In last years report, we stated that we would delay including trading volume related to FTX and other companies that collapsed due to alleged fraud that year in our total illegal activity statistics until the legal proceedings were officially concluded. A jury has since convicted SBF, the former CEO of FTX, of fraud.
Typically, we only include measurable on-chain activity in our statistics on illegal activity. In the case of FTX, it is impossible to measure the scope of fraudulent activity using on-chain data alone because there is no way to isolate the illicit flow of user funds. Therefore, we believe the $8.7 billion in creditor claims against FTX is the best estimate. Given the scale and impact of the FTX incident, we view it as an exception to our usual on-chain approach. If the courts result in convictions in similar ongoing cases, we plan to include such incidents in our illegal trade statistics in the future.
All other totals exclude proceeds from crimes not native to cryptocurrencies, such as traditional drug trafficking using cryptocurrencies as a means of payment. Such transactions are effectively indistinguishable from legitimate transactions in on-chain data. Of course, law enforcement with off-chain environments can still investigate this data using Chainaanalysis solutions. Where we are able to confirm such information, we will treat these transactions as illegal in our data, but this will almost certainly not be the case in many cases, so these figures will not be reflected in our annual reporting totals. middle.
In addition to the absolute decline in the value of assets involved in illegal activity, our estimate of the proportion of cryptocurrency trading volume related to illegal activity as a proportion of total cryptocurrency trading volume has also declined, from 0.42% in 2022 to 0.42% in 2023. 0.34%. [ 1 ]
We are also seeing changes in the types of assets involved in cryptocurrency-based crime.
Throughout 2021, Bitcoin has dominated as the cryptocurrency of choice for cybercriminals, likely because Bitcoin is a highly liquid cryptocurrency. But this has changed in the past two years, with stablecoins now accounting for the majority of all illicit transaction volume. The change also comes alongside the recent growth in stablecoins’ share of all cryptocurrency activity, including legal activity. However, the dominance of stablecoins does not apply to all forms of cryptocurrency-related crime.
Certain forms of illegal cryptocurrency activity, such as darknet market sales and ransomware extortion, still occur primarily in Bitcoin. [ 2 ] But in other areas, such as scams and transactions related to sanctioned entities, there has been a gradual shift towards stablecoins. These also happen to be the top forms of cryptocurrency crime by transaction volume, thereby driving the larger trend. Sanctioned entities and entities operating in sanctioned jurisdictions or involved in terrorist financing also have more incentives to use stablecoins, as they may face more challenges in obtaining U.S. dollars through traditional means, but still want the stability provided by the U.S. dollar benefit from. However, stablecoin issuers can freeze funds when they realize they are being used illegally, as Tether recently did with addresses linked to terrorism and war in Israel and Ukraine.
Below, we explore the three key trends that will define cryptocurrency criminal activity in 2023 and will be critical to the future growth of the industry.
Fraud and stolen funds plummet
In 2023, both cryptocurrency scams and hacker income will decline significantly, with total illegal income falling by 29.2% and 54.3% respectively.
As we will discuss later in the scams section, many criminals engaging in cryptocurrency scams now employ scam tactics that target specific individuals (social engineering attacks), where they target specific individuals and build a relationship with them, then Fraudulent investment opportunities are marketed to them rather than widely advertised, which often makes them harder to detect. Although data released by the FBI shows that reports of cryptocurrency investment scams in the United States have increased year by year through 2022, our on-chain indicators show that fraud revenue has been on a downward trend globally since 2021. We believe this is consistent with the long-term trend that when markets are rising, exuberance is high and people fear they are missing out on a chance to get rich quick, they are more impulsive and scams are most likely to succeed. Of course, the impact of emotional fraud on individual victims is devastating, and its consequences should not be underestimated. While the increase in coverage (at least in the United States) is a good sign, we still believe that romance scams are still woefully underreported. We assume the true damage from scams is greater than reported to the FBI and our on-chain metrics indicate, but overall, scam activity is still down given broader market dynamics.
Cryptocurrency hacks, on the other hand, are more difficult for criminals to hide because industry observers can quickly detect unusual outflows from a given service or protocol when a hack occurs. As we will discuss later, the decline in stolen funds is primarily due to a sharp decline in DeFi hacks. This decline may represent a reversal of a troubling long-term trend and may indicate that DeFi protocols are improving their security practices. That said, stolen funds metrics are largely driven by outliers, and a major hack could change that trend again.
Ransomware and darknet market activity are on the rise
On the other hand, ransomware and darknet markets, two of the most prominent forms of cryptocurrency crime, saw revenue growth in 2023, in stark contrast to the overall trend. The surprising increase in ransomware revenue follows the sharp decline in crime in this space that we reported last year, suggesting that ransomware attackers may have adapted to improvements in organizational cybersecurity, a trend we reported on earlier this year First reported.
Likewise, this years increase in darknet market revenue follows a decline in revenue in 2022. The previous decline was largely caused by the shutdown of Hydra, which was by far the most dominant darknet market in the world, accounting for more than 90% of all darknet market revenue at its peak. While a single market has yet to emerge to replace it, the industry as a whole is rebounding, with total revenue climbing to 2021 highs.
Transactions related to sanctioned entities drive the vast majority of illegal activity
Perhaps the most obvious trend that emerges when looking at illicit transaction volumes is the unusually high activity associated with sanctioned entities. In 2023, transaction volume from sanctioned entities and jurisdictions totaled $14.9 billion, accounting for 61.5% of all illicit transaction volume we counted that year. Much of this is driven by cryptocurrency services that are sanctioned by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) or located in sanctioned jurisdictions. These entities can continue to operate because they are located in jurisdictions that do not enforce U.S. sanctions.
While these services can and have been used for criminal purposes, it also means that a portion of the $14.9 billion in transaction volume associated with sanctioned entities includes the activity of ordinary cryptocurrency users who happen to reside in these jurisdictions. For example, Russia-based exchange Garantex is sanctioned by OFAC and the UKs OFSI. It is one of the biggest drivers of transaction volume related to sanctioned entities in 2023 as it facilitates money laundering activities by ransomware attackers and other cybercriminals. Garantex continues to operate because Russia does not enforce U.S. sanctions. So, does this mean that all of Garantex’s trading volume is related to ransomware and money laundering? Not so. However, association with Garantex poses serious sanctions risks for crypto platforms governed by the United States or the United Kingdom, meaning these platforms must remain more vigilant and screen for association with Garantex in order to comply.
Stay tuned for more of our research on cryptocurrency-based crime as we continue to roll out insights and reports on ransomware, hacking, cryptocurrency laundering, and more.
Endnote:
[ 1 ] Trading volume is a measure of all economic activity and an indicator of money changing hands. We remove stripping chains, internal service transactions, zero swaps, and any other type of transaction that is not considered an economic transaction between different economic actors.
[2] These statistics do not include privacy coins such as Monero.
