In a startling revelation, Chainalysis has unveiled its latest Crypto Crime Report, shedding light on the considerable presence of illicit activity within the cryptocurrency landscape. According to their findings, criminals and their vast networks collectively control around an astounding $75 billion in cryptocurrency, a figure that underscores the ongoing challenges in regulating this rapidly evolving sector.
The report highlights that as of July 2025, nearly $15 billion in balances across Bitcoin (BTC), Ethereum (ETH), and various stablecoins can be traced back to illicit entities. Even more alarming is the observation that wallets connected to these criminals—defined as those receiving over 10% of their funds from illegal sources—hold more than $60 billion. This marks a staggering 359% increase in illicit cryptocurrency holdings compared to just three years earlier.
This data beckons the question: why is the cryptocurrency space so attractive to illicit actors? As it turns out, a significant portion of these assets is concentrated within online ecosystems that have long been synonymous with illegal activities. The report notes that participants in darknet markets alone hold a staggering $46.2 billion in on-chain value, suggesting an ingrained resilience in these networks that was initiated with the advent of Bitcoin on platforms like Silk Road back in 2011. Furthermore, with the appreciation of cryptocurrency prices over the years, many wallets in this category have amassed considerable wealth.
Moreover, platforms facilitating money laundering, such as Black U, play a crucial role in these networks, acting as conduits that transfer value through a vast array of infrastructures. This indicates that the total illicit cryptocurrency holdings could be substantially higher than currently reported— an alarming thought considering the ripple effects such sums could generate.
Experts suggest that while the tactics of scammers and darknet operators are ever-evolving, hackers often face unique challenges when it comes to laundering vast sums of cryptocurrency. For instance, the infamous $1.5 billion Bybit hack, attributed to North Korean actors, illustrates how complex it can be to off-ramp significant amounts without attracting unwanted attention. In most categories of illicit activity—such as theft, ransomware, and darknet offerings—it’s noteworthy that a striking 50% of wallet balances are concentrated in just the three largest wallets. In stark contrast, categories like terrorist financing tend to see assets spread across multiple wallets, showcasing the transient and less stable nature of these operations.
Since May 2023 — when PulseChain went live:USDT: ~$843 million frozenUSDC: ~$120 million frozen$pDAI: $0 frozenTether and Circle have proven their stablecoins can be frozen (halted), blacklisted (access revoked), or locked — denying holders control over their funds.✅… pic.twitter.com/F0t4GocOnd— DAI on PulseChain (@PulseChainDAI) July 22, 2025
Despite stringent Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, centralized exchanges have surprisingly remained the go-to platforms for criminals wishing to convert cryptocurrencies into fiat currency. In fact, data from the first half of 2025 revealed that conversions from illicit sources to exchanges approached $7 billion, with an average annual flow exceeding $14 billion since 2020. However, there’s a notable shift: direct transfers from illicit wallets to exchanges have plummeted from over 40% to about 15%. This change underscores an adaptation to compliance efforts, as criminals implement additional layers of obfuscation—namely, utilizing mixers and cross-chain bridges.
Darknet markets, for instance, typically operate for a span of 807 to 959 days, leveraging established reputations and network effects. In contrast, operations related to terrorist financing are usually much shorter-lived due to rapid law enforcement intervention, often surviving for just 54 days. Interestingly, once illicit operations conclude, these actors demonstrate different liquidation behaviors depending on the type of cryptocurrency they hold. Stablecoins, for example, are often liquidated in a hurry—about 95% are drained within 90 days post-inflow, with fewer than 30% of wallets managing to retain balances after a year.
On the other hand, Ethereum exhibits a more consistent behavior, with about 87% of ETH moving within 90 days. However, approximately 35.6% of wallets continue to hold their ETH balances for over a year, indicating a level of confidence in its stability. Comparatively, Bitcoin displays extraordinary retention, with only 52% of BTC being moved in the same timeframe, while 36.7% of wallets maintain balances for an entire year. This reflects a deep-rooted complexity in the patterns of illicit crypto behavior across different asset types.
So, what can law enforcement do in the face of these daunting challenges? The report from Chainalysis makes some pressing recommendations. While centralized stablecoins can be frozen, confiscating Bitcoin and other permissionless cryptocurrencies demands a more sophisticated approach, often requiring access to private keys or seizing funds at centralized off-ramps. To apprehend these illicit assets effectively, it’s crucial for authorities to enhance their capabilities in blockchain analytics, establish expedited seizure powers for urgent cases, and foster robust frameworks for international cooperation.
In a realm rife with challenges, the potential for seizing billions in illicit proceeds from public blockchains exists—but it hinges on the concerted efforts and innovative responses of authorities and regulators alike. As the landscape continues to evolve, so too must the strategies employed to combat cybercrime in the crypto world.