Professional criminal networks now provide infrastructure-as-a-service for crypto money laundering, creating systemic risks despite illicit transaction percentages dropping from 0.70% to 0.14%.
Stablecoins have overtaken Bitcoin as criminals’ preferred asset due to price stability and liquidity, while regulatory pressure pushes activity toward DeFi protocols.
North Korean hackers stole $1.46 billion in 2024, including a major Bybit attack, demonstrating sophisticated coordination that bypassed multi-signature wallet security systems.
Explore how organized cybercrime networks are professionalizing illicit crypto activities, with stablecoins replacing Bitcoin and North Korean hackers stealing $1.46 billion from major exchanges.
RANSOMWARE ON THE RISE: IS THE CRYPTO-CHAIN MARKET ENABLING THE NEXT WAVE OF CYBERCRIME?
As the cryptocurrency market becomes mainstream and cryptocurrency acceptance increases over time, illegal activities on the chain have become more diverse. For example, the most well-known money laundering has also moved from off-chain to on-chain. In addition, there are also stolen funds, dark web markets, and ransomware.
However, as crypto crime diversifies, the on-chain illegal ecosystem for all types of crime continues to become more professional, the scope of illegal activities continues to expand, and the complexity of their operations also increases.
In particular, we have seen the emergence of large-scale on-chain services that help many types of illicit actors launder their ill-gotten gains in cryptocurrency.
Image source: Chainalysis
Professionalized On-Chain Crime Reshapes the Crypto-Chain Market
The surge in activity associated with organized illicit actors in 2024 marks a significant shift in the crypto market.
These are not isolated cyber criminals, but coordinated networks that provide infrastructure-as-a-service for money laundering, extortion, and fraud.
The shift to structured and repetitive criminal activity introduces systemic risks that threaten the credibility, compliance, and long-term viability of the crypto-chain market.
Illegal Activities in the Crypto-Chain Market Are Increasing Rapidly
The above chart shows the five-year trend of illicit cryptocurrency flows within the crypto market, rising sharply from $11 billion in 2020 to a peak of $54.3 billion in 2022. It is expected to grow from an initial $40.9 billion to $51.3 billion in 2024, although it will decline slightly to $46.1 billion in 2023.
The Types of Crimes in the Crypto-Chain Market Are Diverse
The crypto-chain market has continued to be exploited by various criminals in recent years, including core categories such as fraud, theft of funds and extortion, which have long been among the top crime types, but the value flowing to illegal actor organizations increased significantly in 2024, indicating the professionalization of crypto-related criminal methods.
Additionally, sanctioned entities and jurisdictions account for a significant share, especially in 2022, highlighting that crypto on-chain markets have become a tool for circumventing international controls.
Regulation Is Pushing Illicit Financial Flows to the Margins of the Crypto Market
Although total ransomware revenue fell 35% in 2024, criminals are adapting to the pressure by migrating to privacy coins, decentralized finance (DeFi), and cross-chain bridges.
These shifts suggest that law enforcement efforts are shifting (rather than eliminating) risk, dispersing illicit activity to less regulated areas of the crypto market, and challenging the effectiveness of traditional AML strategies.
TRANSPARENCY IN THE CRYPTO MARKET IS A DOUBLE-EDGED SWORD
Transparency is at the core of the crypto market, but it also highlights the vulnerabilities that exist in the cryptochain market. As centralized exchanges strengthen compliance, criminals increasingly exploit DeFi protocols and non-custodial wallets, while fake identities and interoperability limit visibility.
Without proactive cross-chain analysis and regulation, these gaps will continue to erode trust in the crypto market.
The Risks in the Crypto-Chain Market Remain Unchanged, and a Decrease in Illegal Shares Does Not Mean a Decrease in Risks
The picture shows that in 2020, illegal transactions accounted for 0.70% of the total cryptocurrency trading volume, which was the year with the most rampant on-chain crime in recent years. In 2024, the proportion was further reduced from 0.61% to 0.14%, which shows a significant decline.
Image source: Chainalysis
However, as mentioned earlier: a significant decline does not mean that market risks have been reduced, and the on-chain market still poses long-term threats.
The data analyzed so far are likely to be significantly changed due to the disclosure of new illegal addresses, which is what Chainalysis emphasizes. As more illegal addresses are discovered over time, historical data will usually be revised upward.
STABLECOINS BECOME THE TOP ASSET TRANSFER OPTION IN THE CRYPTO-CHAIN MARKET
From the chart, we can see that between 2020 and 2024, the cryptochain market has undergone a significant shift in the asset composition of on-chain crimes.
In 2020, Bitcoin (BTC) dominated criminal activity, accounting for more than 75% of all illegal transactions. However, its share has been steadily declining year after year.
Image source: Chainalysis
By 2022, stablecoins will become the most commonly used asset in illicit flows, surpassing Bitcoin and accounting for criminal transaction volume. Ethereum (ETH) and alternative tokens (Alts) have also made progress and seen usage and stability growth.
The decline in BTC’s share is not only due to the money laundering organizations’ decreased preference for the process and difficulty of money laundering on the BTC chain, but also due to their shifting preferences to stable coins with stable prices and high liquidity.
THEFT OF FUNDS IN THE CRYPTO-CHAIN MARKET CONTINUES
In 2024, stolen funds in the crypto-chain market rose by approximately 21% year-over-year, reaching $2.2 billion. While the majority of stolen cryptocurrency was taken from DeFi platforms, centralized exchanges were the most frequently targeted during Q2 and Q3.
Notably, North Korean hackers exploited private key leaks to steal a record $1.46 billion, accounting for 61% of all stolen cryptocurrency that year.
Lazarus, the Mysterious North Korean Hacker Group That Stole Bybit Exchange
Lazarus, the notorious North Korean hacker group, launched a major attack on the Bybit exchange. At 1:30 PM on February 21, 2025, Lazarus once again made headlines in the global financial media.
They used a phishing website to obtain the credentials of Safe personnel and bypassed Bybit’s multi-signature wallet system (Safe{Wallet}). Ultimately, 401,000 ETH, 90,000 ETH staked, and other assets were stolen in one night, causing Bybit to lose $1.46 billion overnight.
Read more: Crypto Security Wake-Up Call: Bybit Hit by $140 Million Large-Scale Hack
Image source : Arkham
On the day of the incident, Arkham alerted Bybit on Twitter about the abnormal outflow of funds on the chain, but it was too late.
On March 24, Ben published an executive summary of hacker funds on Twitter, which showed that the total amount of funds attacked by hackers was US$1.4 billion, about 500,000 ETH, 77% was still traceable, 20% had turned black, 3% had been frozen, 417,348 ETH (about US$1 billion) had been converted to BTC, involving 6,954 wallets (an average of 1.71 BTC per wallet)
Read more: From the 2025 Bybit $1.5 Billion Hack to the Top 15 Crypto Security Incidents in History
THE FUTURE OF THE CRYPTO-CHAIN MARKET DEPENDS ON TRUST, REGULATION, AND RESILIENCE
The Rise of Professional On-Chain Crime – This is a critical moment for the crypto-chain market. While the volume of transactions associated with illicit activity has statistically declined, the true scope of risk continues to expand insidiously due to evolving strategies, multi-chain chaos, and regulatory blind spots.
The Bybit attack is a stark reminder that no platform is immune to deeply coordinated, high-value cyber attacks. As criminal networks become more agile and sophisticated, the industry must respond with equal force — through cross-chain surveillance, more robust wallet infrastructure, and global compliance coordination.
〈Crime Is Rampant in the Crypto-Chain Market: How Chain Crime Reshapes Trust, Risk and Infrastructure〉這篇文章最早發佈於《CoinRank》。
