Chainalysis Crypto Crime Report 2025

Keypoints

• Annual cybersecurity reports like this one typically open with an executive summary and methodology, then break into major threat categories, case studies, statistical trends, law enforcement actions, and regional or sector-specific analysis before closing with policy and mitigation takeaways.
• In this report, Chainalysis estimates $40.9 billion in value received by illicit crypto addresses in 2024, noting that this is a lower-bound figure that will likely rise as more illicit addresses are identified over time.
• The report emphasizes that illicit crypto activity has become more diverse and professionalized, moving well beyond cybercrime into sanctions evasion, organized crime, trafficking, fraud, and financial infrastructure services that support multiple criminal types.
• Stablecoins now account for the majority of illicit transaction volume, representing 63% of illicit transactions, while BTC remains dominant in some categories such as ransomware and darknet market sales.
• Stolen funds rose about 21% year-over-year to $2.2 billion, with private key compromises making up 43.8% of stolen crypto and North Korean hackers responsible for $1.34 billion, or 61% of total stolen value.
• Ransomware payments fell about 35% year-over-year to roughly $813.55 million, reflecting stronger law enforcement pressure, lower victim payment appetite, and ecosystem fragmentation after major disruptions such as the LockBit takedown and ALPHV/BlackCat’s exit scam.
• Despite lower payments, ransomware incidents remained active, and data leak sites recorded more victims than in any prior year, suggesting more attacks but fewer successful payouts.
• Ransomware laundering patterns shifted away from mixers and toward centralized exchanges, personal wallets, and bridges, underscoring the impact of sanctions and enforcement on obfuscation tactics.
• Darknet market revenue declined, with DNMs receiving just over $2 billion in BTC, while fraud shop volume also dropped sharply after the takedown of UAPS and related infrastructure.
• Kraken DNM surpassed Mega as the leading Russia-based darknet market in 2024, with around $737 million in on-chain revenue and nearly 68% year-over-year growth.
• Fraud shops were heavily disrupted by the UAPS takedown; the report shows that many fraud shops depended on this processor, and its removal caused a swift decline in activity across the ecosystem.
• Market manipulation analysis suggests up to $2.57 billion in potential wash trading across Ethereum, BNB Smart Chain, and Base, using two heuristics designed to detect suspicious buy/sell patterns and dispersed controller-driven activity.
• Suspicious pump-and-dump activity was identified in 3.59% of the 2,063,519 tokens launched in 2024, showing that a small but meaningful share of new tokens exhibited manipulative patterns.
• Scams received at least $9.9 billion on-chain in 2024, with high-yield investment scams accounting for 50.2% of scam revenue and pig butchering accounting for 33.2%.
• Pig butchering revenue grew nearly 40% year-over-year and deposit counts surged nearly 210%, while average deposit size fell, suggesting scammers targeted more victims with smaller individual payments.
• Crypto drainers grew rapidly, with nearly 170% revenue growth, and address poisoning attacks exploded by more than 15,000% in crypto value sent, highlighting increasingly automated and high-volume scam techniques.
• Huione Guarantee emerged as a central scam-enablement hub, processing about $70 billion in crypto transactions since 2021 and supporting scam technology, laundering, data sales, social media services, and AI tools.
• The report links generative AI to scam scalability, including fake personas, synthetic content, and identity bypass tools, and notes that AI service vendors on Huione saw explosive revenue growth.
• Crypto ATM scams remain a major consumer harm vector, especially for elder fraud, with the FTC reporting more than $65 million in losses in the first half of 2024 alone.
• On sanctions, sanctioned jurisdictions and entities received $15.8 billion in cryptocurrency in 2024, representing about 39% of all illicit crypto transactions, with nearly 60% of sanctions-related activity tied to jurisdictions rather than individual entities by year-end.
• Iran stood out for sharp crypto outflows tied to capital flight and geopolitical uncertainty, while Russia-focused enforcement targeted exchanges, payment processors, money laundering networks, and war-economy infrastructure.
• Tornado Cash remained resilient despite sanctions and legal action, with inflows rising 108% year-over-year in 2024 and stolen funds driving much of the resurgence.
• Extremist financing via crypto remained relatively small overall, but Europe showed strong growth, especially for white nationalist, nationalist, anti-Semitic, and Holocaust denial narratives, while North America remained the largest source region.
• The report highlights that extremist groups often use debanking pressures, privacy coins like Monero, and platform migration to maintain fundraising channels, even as total donation sizes generally stay in the hundreds of dollars.
• Organized crime increasingly uses crypto for speed and cross-border transfers, but often with low crypto sophistication, making many operations easier to trace than criminals expect.
• Huione Guarantee is also portrayed as a major organized crime marketplace, linking money laundering, human trafficking, escort services, travel services, and other crime-as-a-service offerings across its ecosystem.
• Blockchain analysis exposed links between Mexican cartel laundering networks and Chinese fentanyl precursor suppliers, illustrating how on-chain tracing can reveal transnational supply chains behind the synthetic drug trade.
• The report also covers illicit IPTV piracy, gaming cheat markets, wildlife trafficking, and violent crypto-related kidnappings and home invasions, showing that crypto is now embedded across both cyber and physical crime.
• Recurring themes across the report include the rise of stablecoins in illicit finance, the growing importance of AI in fraud, the professionalization of criminal marketplaces, and the ongoing value of blockchain transparency for law enforcement and compliance teams.
• A major takeaway is that law enforcement disruption works: takedowns, sanctions, and coordinated international actions measurably reduced revenues for several criminal sectors, though adversaries continue to adapt quickly.