According to TRM Labs’ 2025 Crypto Crime report[1], the global cryptocurrency market showed impressive growth in 2024, with total transaction volumes exceeding USD 10.6 trillion. This marks a 56% increase from 2023[2]. This surge underscores the increasing mainstream acceptance and integration of digital assets into the global financial system. However, this expansion is accompanied by persistent challenges related to illicit activities, which, while decreasing in proportion, continue to demand vigilant attention.[3]
Despite the overall growth, illicit cryptocurrency transactions experienced a notable decline, falling by 51 percent to USD 45 billion and representing approximately 0.4 percent of the total transaction volume. This decrease is a positive indicator, suggesting that enhanced regulatory measures and improved enforcement actions are beginning to have a tangible impact. However, it's important to approach these figures with caution, as TRM Labs anticipates potential upward revisions as more data emerges and attribution efforts expand. Consequently, the dynamic nature of illicit activities necessitates continuous monitoring and adaptation of strategies to stay ahead of evolving threats.[4]
The composition of illicit crypto activity remained largely consistent with previous years, highlighting the persistent nature of specific types of crime within the crypto ecosystem. The primary categories included:
Several notable trends emerged in the illicit cryptocurrency landscape in 2024, warranting a more detailed examination:
Despite accounting for 58% of total illicit transactions, TRON experienced the most significant reduction in illicit volume among major blockchains. This decline is attributed to TRON's proactive efforts to root out illicit actors on its blockchain. The establishment of the T3 Financial Crime Unit (T3 FCU), a collaborative initiative involving TRON, Tether, and TRM, has played a significant role in freezing illicit proceeds and disrupting criminal operations. This public-private partnership serves as a model for future collaborations aimed at combating crypto crime.[8]
While sanctioned entities continued to play a key role in illicit crypto transactions, their inflows dropped by 33% compared to the previous year. This decrease suggests that sanctions are becoming more effective in curbing illicit activity. The report highlights the impact of Office of Foreign Assets Control (OFAC) sanctions designations on centralised and peer-to-peer exchanges, leading to significant reductions in transaction volumes for targeted entities. However, the report also acknowledges the potential use of alternative services and the uncertainty of regime support for cryptocurrency use in heavily sanctioned jurisdictions, thus suggesting the need for continuous monitoring and adaptation of sanctions strategies.[9]
The use of cryptocurrency in terrorist financing saw an upward trend, with groups such as Islamic State of Iraq and ash-Sham (ISIS) and Hamas increasingly leveraging digital assets for their activities. Of particular concern is the growing role of cryptocurrency for ISIS’ affiliate in Afghanistan, Islamic State Khurasan Province (ISKP). The report details instances of ISKP using cryptocurrency to finance attacks, solicit donations, and support fundraising campaigns.[10] While stablecoins remain the primary choice for terrorist financing organizations, there is growing interest in Monero, a privacy-focused cryptocurrency. The increasing sophistication of terrorist groups in their use of cryptocurrency, including the use of unhosted wallets, mixers, and fake credentials, poses a significant challenge to law enforcement.[11]
Crypto-related ransomware attacks reached an all-time high, with USD 2.2 billion stolen, indicating a persistent and evolving threat from cybercriminal groups. The report highlights the increasing boldness and sophistication of threat actors, exemplified by a record USD 75 million payment made to the Dark Angels ransomware group.[12] The report also notes a decline in the use of cryptocurrency mixers for laundering ransomware proceeds, with threat actors increasingly leveraging cross-chain bridges to obfuscate transactions. The emergence of new ransomware groups and the rebranding of existing groups further complicate the landscape, requiring continuous monitoring and adaptation of defense strategies.[13]
Illicit drug sales through cryptocurrency increased by over 19%, with a shift away from darknet marketplaces towards encrypted chat applications and social media platforms for transactions. This decentralisation of the drug trade poses new challenges for law enforcement, as it becomes more difficult to track and disrupt illicit activities. The report highlights the growing use of encrypted communication apps like Telegram and Signal for vendor shops and direct deals, reducing barriers to access for drug buyers. In contrast to Western darknet marketplaces, which have struggled under sustained law enforcement action and exit scams, Russian-language darknet marketplaces continue to thrive, driven by innovation and a lower threat of action from Russian law enforcement.[14]
One of the most concerning trends highlighted in the report is the increasing use of artificial intelligence (AI) by threat actors to defraud victims. Financial groomers and other scammers are leveraging large language models (LLMs) to create more realistic personas, generate live voice and video deepfakes, send phishing messages, create pornographic images for extortion, and bypass KYC requirements. The potential for AI to amplify the scale and sophistication of crypto crime is significant, requiring proactive measures to counter this threat.[15]
The decline in illicit transaction volume suggests that improved regulatory measures and enforcement actions are having an impact.[16] However, experts caution that these figures may be revised upwards as additional data emerges.[17] The adaptability of illicit networks, coupled with the evolving tactics employed by bad actors, underscores the need for ongoing vigilance and collaboration between regulators, law enforcement agencies, and private sector stakeholders.[18]
A comprehensive and proactive approach is essential to combating illicit crypto activities. Enhanced blockchain analytics, international cooperation, and stringent compliance frameworks will be key to ensuring that legitimate cryptocurrency adoption is not overshadowed by illicit use.[19] As the market continues to grow, so too must the strategies employed to mitigate the risks associated with its misuse.[20]
Based on the findings of the TRM Labs 2025 Crypto Crime Report, several recommendations can be made to foster a safer and more secure crypto ecosystem:
1. Strengthen Regulatory Frameworks: Governments and regulatory bodies should continue to develop and implement clear and comprehensive regulatory frameworks for cryptocurrencies. These frameworks should address issues such as KYC/AML compliance, consumer protection, and the prevention of illicit activities.
2. Enhance International Cooperation: International cooperation is crucial for combating crypto crime, as illicit actors often operate across borders. Law enforcement agencies, regulatory bodies, and private sector stakeholders should collaborate to share information, coordinate investigations, and develop joint strategies.
3. Promote Public-Private Partnerships: Public-private partnerships can play a vital role in combating crypto crime by leveraging the expertise and resources of both sectors. Collaborative initiatives like the T3 FCU can help to freeze illicit proceeds, disrupt criminal operations, and develop innovative solutions.
4. Invest in Blockchain Analytics: Advanced blockchain analytics tools are essential for tracing illicit transactions, identifying threat actors, and supporting enforcement actions. Governments, financial institutions, and cryptocurrency businesses should invest in these tools to enhance their ability to detect and prevent crypto crime.
5. Increase Public Awareness: Educating the public about the risks of crypto crime is crucial for preventing scams and fraud. Governments, consumer protection agencies, and industry stakeholders should launch public awareness campaigns to inform individuals about common scams and provide tips for staying safe.
6. Foster Innovation in Security Technologies: The crypto industry should continue to foster innovation in security technologies to protect digital assets and prevent hacks. This includes developing more robust key management solutions, improving smart contract security, and exploring new methods of authentication and authorization.
7. Address the Use of AI in Crypto Crime: Given the increasing use of AI by threat actors, proactive measures are needed to counter this threat. This includes developing AI-powered tools to detect and prevent fraud, as well as working to identify and disrupt AI-enabled criminal operations.Author:
Disclaimer: This publication is for informational purposes only and does not constitute legal or financial advice. Please consult with a qualified legal or financial advisor before making any decisions based on the information provided in this article.
[1] TRM Labs, 'Now Live: The 2025 Crypto Crime Report' (TRM Insights, 10 February 2025) https://www.trmlabs.com/post/now-live-the-2025-crypto-crime-report accessed 17 February 2025.
[2] TRM 2025 Crypto Crime Report, p.2
[3]TRM Labs, '2025 Crypto Crime Report' (TRM Labs, 2025) http://www.trmlabs.com accessed 17 February 2025.
[4]Ibid
[5] Europol, 'Operation Onymous' (Europol, 7 November 2014) https://www.europol.europa.eu/operations-services-and-innovation/operations/operation-onymous accessed 17 February 2025.
[6] Ibid 1
[7] Chainabuse Fraud Reports, https://www.chainabuse.com/ accessed 17 February 2025
[8]TRM Labs, 'TRON, Tether and TRM Labs Establish T3 Financial Crime Unit' (2024) https://www.trmlabs.com/post/tron-tether-and-trm-labs-establish-first-ever-private-sector-financial-crime-unit-to-combat-crypto-crime. Accessed 17 February 2025
[9]Ibid p.7
[10]TRM Labs, 'Cryptocurrency Use in Terrorist Financing Expanded' (2024) http://www.trmlabs.com. Accessed 17 February 2025
[11]Ibid
[12]TRM Labs, 'Ransomware in 2024: Latest Trends, Mounting Threats, and the Government Response' (2024) https://www.trmlabs.com/post/ransomware-in-2024-latest-trends-mounting-threats-and-the-government-response. Accessed 17 February 2025
[13]Europol, 'Massive Blow to Criminal Dark Web Activities After Globally Coordinated Operation' (2024) https://www.europol.europa.eu/media-press/newsroom/news/massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-operation. 17 February 2025
[14]TRM Labs, ‘How Russian-Style Dead Drops Are Transforming Online Drug Sales’ (TRM Labs, 2024) https://www.trmlabs.com/post/how-russian-style-dead-drops-are-transforming-online-drug-sales accessed 17 February 2025
[15]TRM Labs, ‘The Rise of AI-Enabled Crime: Exploring the Evolution, Risks, and Responses to AI-Powered Criminal Enterprises’ (TRM Labs, 2024) https://www.trmlabs.com/post/the-rise-of-ai-enabled-crime-exploring-the-evolution-risks-and-responses-to-ai-powered-criminal-enterprises accessed 17 February 2025
[16]Federal Bureau of Investigation, 'Operation Endgame: Coordinated Worldwide Law Enforcement Action Against Network of Cybercriminals' (FBI, 30 May 2024) https://www.fbi.gov/news/press-releases/operation-endgame-coordinated-worldwide-law-enforcement-action-against-network-of-cybercriminals accessed 17 February 2025.
[17]National Crime Agency, 'The NCA Announces the Disruption of LockBit with Operation Cronos' (National Crime Agency, 20 February 2024) https://www.nationalcrimeagency.gov.uk/the-nca-announces-the-disruption-of-lockbit-with-operation-cronos accessed 17 February 2025.
[18]Ibid 11
[19]Ibid10
[20]TRM Labs, 'The Illicit Crypto Economy' (TRM Insights, 11 April 2024) https://www.trmlabs.com/the-illicit-crypto-economy-report accessed 17 February 2025.