The Chainalysis 2024 Crypto Crime Report: Key Findings and Trends

                                                                                             LISTEN TO THIS ARTICLE

“The Chainalysis 2024 Crypto Crime Report” was recently published which contains important investigations regarding the various crimes committed with crypto assets, such as ramsomware, darknet, money laundering, terrorist financing, among others.

Among the main conclusions the following stand out - 

1. DECREASE IN ILLICIT ACTIVITY WITH CRYPTOCURRENCIES

2023 saw a significant drop in the value received from illicit cryptocurrency addresses, to a total of $24.2 billion.

In addition to the reduction in the absolute value of illicit activity, the estimate of the share of all crypto transaction volume associated with illicit activity also fell, from 0.42% in 2022 to 0.34% in 2023

Estimates of illicit transaction activity include funds sent to addresses they identified as illicit and funds stolen in cryptocurrency hacks.

It is highlighted that the estimates do not include the following concepts:

• Funds sent to addresses that have not yet been identified as illicit, since it is not yet known if they are illicit.
• Funds derived from non-crypto native crimes, except in cases where clients have been informed.
• Funds associated with crypto platforms accused of fraud, without judicial convictions.
• Transaction volume associated with possible market manipulation. This is because the investigation techniques are designed to detect suspected cases of market manipulation based on chain behavior, but they are not definitive.
• Funds associated with cryptographic money laundering. These funds are included in a specific section of the report.

2. CHANGE IN CRYPTO ASSETS USED FOR CRIME

The report reflects a shift in the types of assets involved in cryptocurrency-based crimes.

Until 2021, Bitcoin reigned as the preferred cryptocurrency among cybercriminals, likely due to its high liquidity.

But that has changed in the last two years, and stablecoins now account for the majority of all illicit transaction volume.

This change is also accompanied by recent growth in the involvement of stablecoins in all crypto activity in general, including legitimate activity.

Sanctioned entities, as well as those operating in sanctioned jurisdictions or involved in terrorist financing, also have a greater incentive to use stablecoins, as they may face more challenges accessing the US dollar through traditional means, but still want benefit from the stability they provide.

However, stablecoin issuers can freeze funds when they become aware of their illicit use, as Tether recently did with addresses linked to terrorism and war in Israel and Ukraine.

The report highlights that the dominance of stablecoins does not apply to all forms of cryptocurrency-based crimes.

Some forms of illicit cryptocurrency activity, such as darknet market sales and ransomware extortion, are still predominantly carried out in Bitcoin.

3. THREE TRENDS IN 2023

The report three key trends that defined crypto crimes in 2023 and will be important to watch in the future.

1) Scams and theft of funds fell in a big way. Revenue from crypto scams and hacking fell significantly in 2023, with total illicit revenue from each falling by 29.2% and 54.3% respectively.

Many cryptocurrency scammers have now adopted new scam tactics by targeting and building relationships with people to present them with fraudulent investment opportunities, rather than advertising them widely, which often makes them more difficult. to discover

Cryptocurrency hacking, on the other hand, is much more difficult for criminals to hide, as unusual outputs from a given service or protocol can be quickly detected when a hack occurs.

2) Ransomware and darknet market activity is increasing. Ransomware and darknet markets, on the other hand, are two of the most prominent forms of crypto crime whose revenues increased in 2023, in contrast to general trends. The growth in ransomware revenue suggests that perhaps ransomware attackers have adapted to organizations' cybersecurity improvements, a trend that has been previously reported.

3) Transactions with sanctioned entities drive the vast majority of illicit activities. Perhaps the most obvious trend that emerges when analyzing the volume of illicit transactions is the prominence of sanctions-related transactions. The sanctioned entities and jurisdictions together accounted for a combined total of $14.9 billion in transaction volume in 2023, representing 61.5% of all illicit transaction volume measured in the year.

4. MONEY LAUNDERING

In 2023, illicit addresses sent $22.2 billion in cryptocurrency to services, representing a significant decrease from the $31.5 billion sent in 2022.

Part of this drop can be attributed to an overall decrease in the volume of cryptocurrency transactions, both legitimate and illicit.

However, the drop in money laundering activity was steeper, at 29.5%, compared to the 14.9% drop in total transaction volume.

Overall, centralized exchanges remain the primary destination for funds sent from illicit addresses, at a rate that has remained relatively stable over the past five years.

Over time, the role of illicit services has reduced, while the proportion of illicit funds going to DeFi protocols has increased.

The year 2023 largely resembled 2022 in terms of the breakdown of the types of services used for money laundering, but highlights a slight decrease in the proportion of illicit funds going to types of illicit services and an increase in funds that go to gambling services and bridging protocols.

Fiat exit services are important because it is where criminals can convert their cryptocurrencies into cash, the culmination of the money laundering process.

While there are thousands of outbound services in operation, the majority of money laundering activity is concentrated in a few select services. Of all illicit funds sent to outbound services in 2023, 71.7% went to just five services, slightly up from 68.7% in 2022.

A large part of crypto money laundering activity is relatively unsophisticated and consists of bad actors simply sending funds directly to exchanges.

However, crypto criminals with more sophisticated chain laundering skills, such as the notorious North Korean cybercriminals associated with hacking gangs like the Lazarus Group, tend to use a greater variety of cryptographic services and protocols.

According to data from Chainalysis, about a third of all YoMix entries come from wallets associated with cryptocurrency hacks. The growth of YoMix and its adoption by Lazarus Group is a prime example of the ability of sophisticated players to adapt and find replacement obfuscation services when previously popular ones are shut down.

Cross-chain bridges allow users to move funds from one blockchain to another. The use of bridging protocols by illicit actors for money laundering purposes grew substantially in 2023, particularly among cryptocurrency thieves.

Overall, bridging protocols received $743.8 million in cryptocurrency from illicit addresses in 2023, up from just $312.2 million in 2022. Hackers affiliated with North Korea have been among those most heavily using bridging to money laundering

Finally the report highlights that changes in money laundering strategy by crypto criminals like Lazarus Group serve as an important reminder that the most sophisticated illicit actors are always adapting their money laundering strategy and exploiting new types of crypto services.

Therefore, financial intelligence units and other control agencies can be more effective if they study these new laundering methods and become familiar with the chain patterns associated with them.

Disclaimer: Content posted is for informational and knowledge sharing purposes only, and is not intended to be a substitute for professional advice related to tax, finance or accounting. The view/interpretation of the publisher is based on the available Law, guidelines and information. Each reader should take due professional care before you act after reading the contents of that article/post. No warranty whatsoever is made that any of the articles are accurate and is not intended to provide, and should not be relied on for tax or accounting advice.