Cryptocurrency crime trends in 2023: decrease in illicit activity and the rise of stablecoins.

The cryptocurrency industry saw a significant drop in value received by illicit cryptocurrency addresses. The share of all crypto transaction volume associated with illicit activity also decreased. Stablecoins have become the preferred choice for cybercriminals, while Bitcoin remains prominent in darknet market sales and ransomware.

Cryptocurrency trading, Computer Keyboard, Electronics, Hardware, Monitor, Screen, Person,

In 2023, there was a notable decrease in the value received by illicit cryptocurrency addresses, amounting to $24.2 billion. The estimate for illicit transaction volume in 2022 increased from $20.6 billion last year to $39.6 billion this year, primarily due to the identification of previously unknown active addresses hosted by sanctioned services. This is highlighted in the Chainalysis report: 2024 Crypto Crime Trends. In addition to the decrease in absolute value of illicit activity, the estimate for the share of all crypto transaction volumes associated with illicit activity also decreased from 0.42% in 2022 to 0.34% in 2023.

A significant trend in cryptocurrency-based crime is the shifting preference for assets. Bitcoin, previously the preferred choice among cybercriminals due to its high liquidity, has been surpassed by stablecoins for illicit transactions. This coincides with the overall growth in stablecoins’ share of all crypto activity, including legitimate transactions. However, Bitcoin remains dominant in certain forms of crypto crime, such as darknet market sales and ransomware extortion.

Crypto scamming

Crypto scamming and hacking revenue witnessed significant declines in 2023, down by 29.2% and 54.3% respectively. Scammers have shifted towards romance scams, targeting individuals and building relationships to pitch fraudulent investment opportunities. Although reported crypto investment scams in the US have increased, on-chain metrics suggest a declining trend globally since 2021. Crypto hacking, on the other hand, is more difficult to hide, with unusual outflows easily detectable by industry observers. The decline in stolen funds is primarily driven by a decrease in decentralized finance (DeFi) hacking, potentially indicating improved security practices.

Ransomware and darknet markets

Ransomware and darknet markets, on the other hand, saw revenue growth in 2023, contrary to the overall trend. This growth follows a decline in revenue in 2022 due to the shutdown of Hydra, the dominant darknet market at the time. Although no single market has taken its place, the sector as a whole is rebounding, approaching revenue levels seen in 2021.


A notable trend in illicit transaction volume is the prominence of sanctions-related transactions, accounting for $14.9 billion or 61.5% of all illicit transaction volume in 2023. This is primarily driven by cryptocurrency services that are sanctioned by the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) or located in sanctioned jurisdictions where US sanctions are not enforced. While some of this volume is associated with nefarious purposes, it also includes activity from average crypto users residing in these jurisdictions. Compliance concerns arise for crypto platforms subject to US or UK jurisdiction, as exposure to sanctioned entities like Garantex, a Russia-based exchange sanctioned for money laundering facilitation, poses risks.