According to the latest “2024 Cryptocurrency Crime Report” published by crypto-tracking firm Chainalysis, 2023 marked a recovery year for the cryptocurrency industry. After the scandals and market crashes of 2022, the market gradually rebounded, reigniting interest in crypto. However, with this resurgence, cryptocurrency-related cybercrime also saw a resurgence.
$40 Billion in Illegal Stablecoin Transactions
Stablecoins accounted for 59% of all cryptocurrency transaction volume in 2023. While stablecoins have become increasingly popular among legitimate users, a major trend in crypto-related cybercrime is the replacement of Bitcoin by stablecoins as the primary currency for illicit activities.
According to the report, between 2022 and 2023, the total illegal stablecoin transaction volume reached $40 billion. The largest category of illegal stablecoin transactions was sanctions evasion. Among all crypto transactions observed by Chainalysis in 2023, over $24.2 billion was linked to sanctions evasion, with stablecoins being the dominant currency used.
Key Activities Involving Stablecoins in 2023:
- 70% of crypto scam transactions
- 83% of crypto payments to sanctioned countries like Iran and Russia
- 84% of crypto payments to specially designated individuals and companies
Additionally, according to a United Nations report (link at the end), illegal gambling and underground banking operations in Southeast Asia have also been heavily reliant on stablecoins.
Bitcoin vs. Stablecoins in Cybercrime Transactions
From the data above, Bitcoin remains the primary currency for ransomware payments, darknet markets, and other cybercrime activities. However, stablecoins have become the dominant currency for sanctions evasion and online fraud.
According to Andrew Fierman, Head of Sanctions Strategy at Chainalysis, stablecoins are particularly attractive to sanctioned individuals and countries because they enable them to bypass U.S. dollar restrictions.
“Whether it’s individuals in Iran or money launderers, they seek stablecoins to maintain the value stability of the U.S. dollar.”
— Andrew Fierman, Chainalysis
Examples of Sanctioned Crypto Exchanges Using Stablecoins
- Nobitex – The largest crypto exchange in Iran, a sanctioned country.
- Stablecoin usage is 9 times higher than Bitcoin on Nobitex.
- Garantex – A Russia-based crypto exchange that was specifically sanctioned due to its criminal use cases.
- Stablecoin usage is 5 times higher than Bitcoin on Garantex.
By contrast, on mainstream (non-sanctioned) exchanges, the ratio of stablecoins to Bitcoin is typically 1:1, highlighting a clear difference in trading behavior on sanctioned platforms.
Three Major Trends in Cryptocurrency Crime for 2024
The 2024 Cryptocurrency Crime Report highlights three key trends that have shaped the crypto crime landscape this year and are expected to continue into 2025:
1. Sharp Decline in Scam & Theft Revenues
In 2024, revenues from cryptocurrency scams and thefts saw a significant decline, dropping by 29.2% and 54.3%, respectively. While this may seem like good news at first glance, the details reveal a more complex picture.
🔹 Scammers are becoming more sophisticated
- Instead of casting a wide net, criminals have shifted to more deceptive tactics, such as romance scams.
- In these scams, fraudsters build emotional connections with victims before persuading them to invest in fake projects.
- This method is harder to detect and more devastating for individual victims.
🔹 Why theft revenues dropped
- Hackers now struggle to hide their tracks, as large fund movements trigger industry-wide alerts.
- The main reason for the decline is the sharp decrease in DeFi hacking incidents, which may indicate improved security measures in DeFi projects.
- However, theft figures can be highly volatile—a single major hacking event could drastically shift the trend.
2. Ransomware & Darknet Markets Are Making a Comeback
Unlike the overall trend, revenues from ransomware attacks and darknet markets rebounded in 2024.
🔹 Ransomware attacks surged after a 2023 decline
- The steep drop in ransomware revenue in 2023 was seen as a positive sign.
- However, this year’s resurgence suggests cybercriminals have adapted to stronger enterprise security defenses.
🔹 Darknet market revenue is recovering
- The shutdown of Hydra, the world’s largest darknet market in 2022, led to a steep decline in illegal market activity.
- No single marketplace has fully replaced Hydra, but the overall industry is recovering.
- By 2024, darknet market revenues are approaching their 2022 peak levels.
3. Sanctioned Entities Dominate Illegal Crypto Transactions
One of the most alarming trends in 2024 is the massive increase in transactions linked to sanctioned entities and regions.
🔹 Sanctioned transactions reached $26 billion
- These transactions accounted for 61.5% of all illegal crypto activity reported in 2024.
🔹 Where do these transactions occur?
- The majority of sanctioned transactions involve crypto service providers targeted by the U.S. Treasury’s Office of Foreign Assets Control (OFAC).
- Many sanctioned exchanges continue to operate because they are based in countries that do not enforce U.S. sanctions.
🔹 Not all transactions are criminal
- Some of the $14.9 billion in sanctioned transactions include legal crypto activity from users living in sanctioned regions.
- A large portion of this volume comes from Russia-based exchange Garantex, which was sanctioned by the U.S. and UK for facilitating ransomware and money laundering activities.
🔹 Compliance risks for global exchanges
- Not all transactions on Garantex are tied to illicit activities.
- However, for crypto platforms operating under U.S. or UK jurisdiction, any dealings with Garantex pose severe compliance risks.
- These exchanges must remain vigilant and actively screen transactions to ensure regulatory compliance.
Final Thoughts
The 2024 crypto crime landscape reflects a dynamic shift:
Declining scam & theft revenues due to evolving tactics and improved security.
Rising ransomware & darknet activities, indicating cybercriminal adaptation.
Surging illicit transactions tied to sanctioned entities, posing major compliance risks.
As crypto markets continue to evolve, so too will the tactics of cybercriminals, making compliance and security efforts more critical than ever.
