Report Teaser: Proportion of Illicit Volume of Crypto Dropped 51% in 2024

The 2024 crypto crime landscape showed significant shifts, marked by decreases in illicit volumes — yet still subject to persistent threats. As the crypto ecosystem continues to grow, so do both the opportunities and challenges for combating crime within the space. 

This blog features key highlights from TRM’s upcoming 2024 Crypto Crime Report. Be sure to check back in the coming weeks to get your complete copy.

Overall illicit crypto volume declined 

In 2024, crypto transaction volume grew to over USD 10.6 trillion, up 56% since 2023. Illicit volume dropped to USD 45 billion, down 24% since 2023. This represents 0.4% of overall crypto transactions, and marks a 51% decrease from 2023 — where TRM currently determines that illicit volume accounted for 0.86% of total crypto transactions.  

The largest categories of illicit activity on the blockchain remained largely the same as in 2023: 

• Sanctions (33% of illicit volume)
• Blocklisted (29% of illicit volume)
• Scam and Fraud (24% of illicit volume) 

TRON saw largest drop in illicit volume 

In 2024, the largest percentage of illicit crypto activity occurred on the TRON blockchain (58% of illicit volume) — followed by Ethereum (24% of illicit volume), Bitcoin (12% of illicit volume), Binance Smart Chain (3% of illicit volume), and Polygon (3% of illicit volume). This reflects a continued preference for blockchains that have low transaction fees, smart contracts, and popular stablecoins.

However, of all the blockchains analyzed, TRON experienced the most significant decline in illicit activity, with illicit volume dropping by USD 6 billion and the proportion of such activity nearly halving. Notably, 49% of TRON's illicit volume was linked to sanctioned entities, while 32% involved blocklisted funds — assets that have been effectively neutralized and are no longer accessible to threat actors.

This is, in part, due to TRON’s focus on rooting out illicit actors on its blockchain. In August 2024, TRON, Tether, and TRM announced the establishment of the T3 Financial Crime Unit (T3 FCU), a first-of-its-kind initiative aimed at facilitating public-private collaboration to combat illicit activity associated with the use of USDT on the TRON blockchain. 

In the months since launch, the initiative, in collaboration with law enforcement, facilitated the freezing of over USD 130 million in illicit proceeds.

Sanctions and fraud faced drops in volume, but remained the largest drivers of illicit volume

Sanctions

Inflows to sanctioned entities continued to drive illicit crypto volume in 2024, despite falling from USD 21.9 billion in 2023 to USD 14.8 billion in 2024. 

Garantex and Nobitex continued to account for over 85% of the inflows to sanctioned entities and jurisdictions. The US Office of Foreign Assets Control (OFAC) and global partners issued 13 sanctions designations in 2024 that included 86 cryptocurrency addresses, largely targeting Russia-linked entities, Hamas, and Hezbollah. 

Fraud

Fraud-related inflows dropped by 40% in 2024, but remain high at USD 10.7 billion (Note: TRM assesses that scam and fraud volumes are highly likely to increase with delayed fraud reports). Reduced Ponzi and pyramid scheme activity appear to be behind the decline. These schemes received over USD 4.3 billion, marking a 37% decrease from 2023 inflows.

Financial grooming scams, also known as “pig butchering,” also experienced a significant decline in 2024. Addresses associated with this fraud typology received an estimated USD 2.5 billion, a 58% decrease from 2023.

Terrorist financing, ransomware, hacks, and drug sales continued to expand

Terrorist financing

In 2024, terrorist financing groups continued to expand their use of cryptocurrency — predominantly turning to stablecoins due to their usability and stability. Islamic Stake Khurasan Province (ISKP) has increasingly relied on cryptocurrencies to fund operations, receive donations, and conduct attacks. And despite public announcements by Hamas that they would halt cryptocurrency donations, the group has received tens of thousands of dollars over the last twelve months, albeit more discretely. Related entities such as GazaNow and other Gaza-based groups have also raised thousands of dollars in cryptocurrency donations since the October 7, 2024 attack. 

Ransomware‍

Ransomware has remained a prolific and growing threat, with 5,635 publicly reported attacks — surpassing 5,223 in 2023. The financial demands of ransomware actors have reached unprecedented levels, exemplified by a record USD 75 million payment made to the Dark Angels ransomware group in March 2024. These escalating ransom demands highlight the increasing boldness and sophistication of threat actors, who are leveraging advanced tools and techniques to maximize their extortion efforts.

Note: This analysis is based on ransomware leak site data available as of January 6, 2025, and excludes underreported incidents.

Hacks

In 2024, USD 2.2 billion was stolen in crypto-related hacks — a 17% increase from 2023 — bringing the three-year theft total of over USD 7.7 billion. Infrastructure attacks, primarily involving private key and seed phrase theft, accounted for nearly 70% of stolen funds in 2024. North Korea played a significant role, responsible for 35% of stolen funds (approaching nearly USD 800 million in stolen cryptocurrency), conducting high-impact operations five times larger than those by other actors — emphasizing the critical need for robust security measures.

Illicit drugs

Cryptocurrency-enabled online sales of illicit drugs saw a year-on-year growth of over 20% between 2023 and 2024, nearing USD 2.4 billion. 

Despite the many challenges faced by darknet marketplaces (DNMs) over the course of 2024, these platforms have nevertheless seen a slight increase in income compared to 2023, generating over USD 1.7 billion. Russian-language darknet marketplaces continue to be responsible for the vast majority of profits garnered, contributing over 97% to the overall volume of illicit drug sales via DNMs that support cryptocurrencies without privacy features, up over 1 percentage point from 2023. 

Incoming volumes sent to the individual vendor shops have more than doubled. In 2023, these addresses received over USD 289 million. In 2024, this figure skyrocketed to over USD 600 million. This dramatic increase may reflect the decentralization of the drug trade away from traditional darknet markets, as vendors grow more adept at operating across multiple platforms on both the clearnet and darknet (including on e-commerce websites and social media platforms). 

Finally, incoming crypto volumes to Chinese drug precursor manufacturers have seen a significant decline, from USD 27.6 million in 2023 to USD 17 million in 2024 — likely in response to intensified law enforcement. 

Blockchain intelligence continued to drive disruption of crypto crime 

The evolving landscape of crypto crime in 2024 highlights a complex interplay between advancing security measures and increasingly adaptive illicit actors. While efforts to curb illegal activities have shown promising results, threat actors continue to innovate — exploiting vulnerabilities within decentralized finance, blockchain infrastructure, and emerging technologies.

Ultimately, the fight against crypto crime requires a proactive, collaborative approach. Regulatory bodies, law enforcement agencies, and private sector partners must continue to adapt, innovate, and cooperate to outpace increasingly sophisticated threat actors. Central to this effort is the use of advanced blockchain intelligence tools, which provide critical insights for tracing illicit transactions, identifying threat actors, and supporting enforcement actions.

{{horizontal-line}}

This blog features key highlights from TRM’s upcoming 2024 Crypto Crime Report. Be sure to check back in the coming weeks to get your complete copy.