Category deep-dive: Overall 2024 figures and declining illicit crypto volume on TRON

Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. To read the report in full and download your copy, click here.

Crypto transaction volume grew 56% YoY

In 2024, crypto transaction volume grew to over USD 10.6 trillion, up 56% since 2023. Illicit volume currently appears to have dropped to USD 45 billion, down 24% since 2023. This represents 0.4% of overall crypto volume — a decline from 0.9% in 2023, marking a 51% decrease year over year.

The top categories of illicit activity on the blockchain currently remain largely the same as in 2023: Sanctions (33% of illicit volume), Blocklisted (29% of illicit volume), and Scams and Fraud (24% of illicit volume). 

TRM expects overall illicit volume figures to be revised upwards

These overall figures represent TRM’s current estimates of illicit volume based on our latest available intelligence. However, due to the inherent complexities of detecting and attributing illicit transactions — and delayed reporting — we expect overall figures for illicit volume to increase over time as new data emerges. 

At the time of publication of this annual report in early 2024, TRM’s estimates for illicit volume were USD 34.8 billion for 2023. TRM now estimates the figure to be USD 58.7 billion, reflecting an upward revision of 69%. It is important to note that even the revised figure may not be final, as attribution is likely to expand across the coming years. In line with attribution expanding over time, the illicit volume for 2022 has been revised upwards from USD 49.6 billion reported last year to USD 56.6 billion based on our current estimate — two years after the end of 2022. 

Given the high likelihood of future upward revisions to overall illicit volumes, readers should consider the figures in this report as a dynamic baseline. The final estimate for 2024 illicit volume will most likely be well above USD 44.7 billion reported here, and may even be above USD 75 billion if we carry forward our upward revision for the 2023 figure so far. We anticipate that category-specific trends and assessments of threat actor tactics, techniques, and procedures (TTPs) will remain more consistent and provide reliable insights into evolving risk patterns.

Methodology 

Our estimate of total illicit crypto volume is based on the USD value of funds stolen in crypto hacks (USD value at time of hack), combined with the USD value of transfers to blockchain addresses on Bitcoin, Ethereum, TRON, Binance Smart Chain, and Polygon that we have linked to entities in illicit categories such as investment schemes, sanctions, and darknet marketplaces. We consider our estimate as the minimum, or "floor," for the volume of illicit cryptocurrency, and expect figures to increase over time with delayed attribution and reporting. 

The following are excluded from our estimate of illicit cryptocurrency volume: 

1. Proceeds from crimes initially conducted in fiat currency and subsequently converted into cryptocurrency: These proceeds are typically converted into crypto through on-ramp services and are challenging to identify with on-chain data alone. Accurately assessing the value of these proceeds would require additional data from virtual asset service providers and national financial intelligence units.
2. Transfers to blockchain addresses that have not been linked to illicit activities: We estimate the potential maximum volume of such transfers by analyzing transactions with unattributed addresses that do not appear to represent internal transfers within a single entity.
3. Transfers related to the laundering of illicit crypto proceeds: Our figure of illicit crypto USD volume estimates the crypto revenue generated by illicit entities; it excludes the laundering of these proceeds. In calculating illicit crypto volume as a percentage of total crypto volume, we only consider incoming transaction volume linked to attributed entities, excluding transfers that appear to be internal to entities such as peeling chains and certain swaps on decentralized exchanges.

TRON saw the largest drop in illicit volume in 2024

In 2024, the largest percentage of illicit crypto activity occurred on the TRON blockchain (58% of illicit volume), followed by Ethereum (24% of illicit volume), Bitcoin (12% of illicit volume), Binance Smart Chain (3% of illicit volume), and Polygon (3% of illicit volume), reflecting continued preference for blockchains that have low transaction fees, smart contracts, and popular stablecoins. 

However, of all the blockchains analyzed, TRON saw the most significant decline in illicit volume, dropping by USD 6 billion and halving its proportion of illicit volume. 49% of TRON's illicit volume was linked to sanctioned entities, while 32% involved blocklisted funds — assets that have been effectively neutralized and are no longer accessible to threat actors. Of the subset of blocklisted funds in USDT on TRON, roughly 20% has been reissued to victims and government accounts. 

This reduction in illicit volume reflects, in part, TRON’s focus on rooting out illicit actors on its blockchain. In August 2024, TRON, Tether, and TRM announced the establishment of the T3 Financial Crime Unit (T3 FCU), a first-of-its-kind initiative aimed at facilitating public-private collaboration to combat illicit activity associated with the use of USDT on the TRON blockchain. 

In the months since launch, the initiative — in collaboration with law enforcement — facilitated the freezing of over USD 130 million in illicit proceeds. This includes a recent seizure by Spain’s Guardia Civil, in which USD 26.4 million in stolen funds linked to a sophisticated money laundering operation was stolen.

{{horizontal-line}}

Next up in this series: We take a closer look at sanctioned entities’ contributions to illicit crypto volumes in 2024.

Ready to dive into the full 2025 Crypto Crime Report? Get your copy here.