Overview of Chainalysis Annual Crypto Crime Report: Significant Decrease in Fraud and Stolen Funds

Original Author: Chainalysis Team

Original Compilation: Luffy, Foresight News

2023 is a year of recovery for cryptocurrency, as the industry gradually rebounds from a series of scandals, collapses, and price declines in 2022. With the rebound in cryptocurrency prices and increased market activity in 2023, many believe that the crypto winter has ended and a new growth phase may be on the horizon.

But what does this mean for cryptocurrency crime? Let’s first observe the trends from an overall industry perspective.

In 2023, the value of cryptocurrency received by wallet addresses associated with illegal activities significantly decreased, totaling $24.2 billion. As always, we must remind that these numbers are based on the inflows to wallet addresses identified as related to illegal activities, which represents a lower bound of our estimated values. In the coming year, as we identify more illegal addresses and incorporate their historical activities into our statistics, the total results will almost certainly be higher. For example, when we released our cryptocurrency crime report last year, we estimated that the value of illegal cryptocurrency transactions in 2022 was $20.6 billion. A year later, our latest estimate for this data from 2022 has increased to $39.6 billion. This increase largely stems from the identification of previously unknown highly active addresses associated with sanctioned services, as well as the addition of transaction volumes related to services in sanctioned jurisdictions to our total statistics.

In addition to discovering new illegal wallet addresses, another key reason for the high new total is that we have now included the $8.7 billion creditor claims against FTX in our 2022 data calculations. In last year’s report, we stated that we would delay including transaction volumes related to FTX and other companies that collapsed that year due to alleged fraud in our total illegal activity statistics until the legal proceedings were formally concluded. Subsequently, a jury found former FTX CEO SBF guilty of fraud.

Typically, we only include measurable on-chain activity in our statistics on illegal activities. In the case of FTX, it is impossible to measure the extent of fraudulent activity using on-chain data alone, as the illegal flow of user funds cannot be isolated. Therefore, we consider the $8.7 billion creditor claims against FTX to be the best estimate. Given the scale and impact of the FTX incident, we view it as an exception to our usual on-chain methodology. If courts convict in similar ongoing cases, we plan to include such incidents in our illegal transaction data statistics in the future.

All other totals do not include revenues from crimes in non-cryptocurrency native domains, such as traditional drug trafficking that uses cryptocurrency as a payment method. Such transactions are essentially indistinguishable from legitimate transactions in on-chain data. Of course, law enforcement agencies with off-chain contexts can still use Chainalysis solutions to investigate this data. When we can confirm such information, we will treat these transactions as illegal in our data, but it is almost certain that in many cases this is not the case, so these numbers will not be reflected in the totals of our annual report statistics.

In addition to the absolute decline in the value of assets involved in illegal activities, our estimate of the proportion of cryptocurrency transaction volume associated with illegal activities has also decreased, from 0.42% in 2022 to 0.34% in 2023. [ 1 ]

We also see a change in the types of assets involved in cryptocurrency-related crime.

Throughout 2021, Bitcoin dominated as the cryptocurrency of choice for cybercriminals, likely due to its high liquidity. However, this has changed over the past two years, with stablecoins now accounting for the majority of all illegal transaction volumes. This shift has also coincided with a recent increase in the share of stablecoins in all cryptocurrency activities (including legitimate activities). However, the dominance of stablecoins does not apply to all forms of cryptocurrency-related crime.

Certain forms of illegal cryptocurrency activity, such as darknet market sales and ransomware extortion, still primarily occur in Bitcoin. [ 2 ] But in other areas, such as scams and transactions related to sanctioned entities, there has been a gradual shift towards stablecoins. By transaction volume, these are also precisely the most prominent forms of cryptocurrency crime, driving a larger trend. Sanctioned entities and those operating in sanctioned jurisdictions or involved in terrorist financing are also more motivated to use stablecoins, as they may face more challenges in obtaining dollars through traditional means but still wish to benefit from the stability offered by the dollar. However, stablecoin issuers can freeze funds when they become aware of illegal use, as Tether recently did with addresses related to terrorism and war in Israel and Ukraine.

Next, we will explore three major trends that define cryptocurrency crime activity in 2023, which are crucial for the future development of the industry.

Significant Decrease in Fraud and Stolen Funds

In 2023, the income from cryptocurrency scams and hacks both saw significant declines, with illegal revenue decreasing by 29.2% and 54.3%, respectively.

As we will discuss later in the fraud section, many criminals engaged in cryptocurrency scams have now adopted targeted scam strategies (social engineering attacks), where they target specific individuals and build relationships with them before pitching fraudulent investment opportunities, rather than casting a wide net, which often makes them harder to detect. Although data released by the FBI shows that reports of cryptocurrency investment scams in the U.S. have increased year over year as of 2022, our on-chain indicators suggest that the revenue from scams has been on a downward trend globally since 2021. We believe this aligns with a long-term trend where scams are more likely to succeed when the market is rising, prosperity is high, and people fear missing out on quick wealth opportunities. Of course, emotional scams have a devastating impact on individual victims, and their consequences should not be underestimated. While the increase in reports (at least in the U.S.) is a good sign, we still believe that reporting on emotional scams remains severely lacking. We assume that the true damage from scams is greater than what is reported to the FBI and what our on-chain indicators show, but overall, considering broader market dynamics, scams have still declined.

On the other hand, cryptocurrency hacks are harder for criminals to hide, as industry observers can quickly detect unusual outflows of funds from a given service or protocol when a hack occurs. As we will discuss later, the decline in stolen funds is primarily due to a sharp decrease in DeFi hacks. This decline may represent a disturbing reversal of a long-term trend and may indicate that DeFi protocols are improving their security practices. That said, the stolen funds metric is largely driven by outliers, and a single large hack could change this trend again.

Increase in Ransomware and Darknet Market Activity

On the other hand, ransomware and darknet markets are two of the most prominent forms of cryptocurrency crime, with revenues increasing in 2023, contrasting sharply with the overall trend. Following the sharp decline in crime in this area reported last year, the growth in ransomware revenue is surprising, suggesting that ransomware attackers may have adapted to improvements in organizational cybersecurity, a trend we first reported earlier this year.

Similarly, the increase in darknet market revenue this year follows a decline in 2022. The previous decline was primarily caused by the shutdown of Hydra, which was the most dominant darknet market to date, accounting for over 90% of all darknet market revenue at its peak. Although no single market has yet emerged to replace it, the entire industry is rebounding, with total revenue climbing back to 2021 highs.

Transactions Related to Sanctioned Entities Drive the Vast Majority of Illegal Activity

Perhaps the most obvious trend observed in illegal transaction volumes is the unusually high activity related to sanctioned entities. In 2023, the transaction volume associated with sanctioned entities and jurisdictions totaled $14.9 billion, accounting for 61.5% of all illegal transaction volumes we recorded that year. Most of this was driven by cryptocurrency services sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) or located in sanctioned jurisdictions. These entities can continue to operate because they are situated in jurisdictions that do not enforce U.S. sanctions.

While these services may and have been used for criminal purposes, this also means that a portion of the $14.9 billion transaction volume associated with sanctioned entities includes activities of ordinary cryptocurrency users who happen to reside in these jurisdictions. For example, the exchange Garantex, based in Russia, is sanctioned by OFAC and the UK's OFSI for facilitating money laundering activities for ransomware attackers and other cybercriminals, making it one of the largest drivers of transaction volume related to sanctioned entities in 2023. Garantex continues to operate because Russia does not enforce U.S. sanctions. So, does this mean that all transaction volume from Garantex is related to ransomware and money laundering? Not necessarily. However, associating with Garantex poses serious sanction risks for cryptocurrency platforms under U.S. or UK jurisdiction, meaning these platforms must remain vigilant and screen for any associations with Garantex to remain compliant.

As we continue to release insights and reports on ransomware, hacks, cryptocurrency laundering, and more, stay tuned for further research on cryptocurrency-based crime.

Footnotes:

[ 1 ] Transaction volume is an indicator of all economic activity and a measure of the flow of funds. We remove transactions that are stripped chains, internal service transactions, change transactions, and any other types of transactions not considered economic transactions between different economic participants.

[ 2 ] These statistics do not include privacy coins such as Monero.