Criminals and Their Networks Hold $75B in Crypto Assets, Says Chainalysis

Unlock the Secrets of Ethical Hacking!
Ready to dive into the world of offensive security? This course gives you the Black Hat hacker’s perspective, teaching you attack techniques to defend against malicious activity. Learn to hack Android and Windows systems, create undetectable malware and ransomware, and even master spoofing techniques. Start your first hack in just one hour!
Enroll now and gain industry-standard knowledge: Enroll Now!

Chainalysis’ latest Crypto Crime Report has revealed that criminals and their downstream networks hold approximately $75 billion in crypto assets obtained through illicit means.

According to data tracked through July 2025, illicit entity balances of BTC, ETH, and stablecoins have reached nearly $15 billion. Wallets downstream from these entities, defined as those receiving over 10% of funds from illicit sources, hold over $60 billion.

Criminals and Their Networks Hold $75B in Crypto Assets, Says Chainalysis — Source: Chainalysis

This represents a 359% surge from illicit crypto holdings observed in 2020.

Darknet Markets Dominate Criminal Crypto Asset Holdings

Darknet market participants alone control over $46.2 billion in on-chain value, representing the single largest category of illicit downstream wallet holdings.

This isn’t surprising, given that darknet markets were among the first to adopt cryptocurrency, starting with Silk Road in 2011. Additionally, many of these wallets have benefited from years of price appreciation.

Money laundering platforms, such as Black U, also act as transit points, moving value through various infrastructure, which means total downstream holdings could be even higher than reported.

Chainalysis suggests that while scammers and darknet markets move money quickly, hackers face operational challenges in laundering large volumes, forcing them to hold assets on-chain longer.

The $1.5 billion Bybit hack linked to North Korea illustrates the difficulty of off-ramping large sums without detection.

In most illicit activity categories, such as stolen funds, ransomware, and darknet markets, over 50% of balances are concentrated in the top three wallets.

Exceptions include terrorist financing and child abuse material, which are distributed across multiple wallets due to their transient nature.

The asset type also affects concentration patterns. Stablecoins show less concentration than BTC or ETH across categories, likely reflecting risk management by criminals, as stablecoins can be frozen by centralized issuers if linked to illicit activity.

Centralized Exchanges Remain Primary Cash-Out Points

Despite KYC and AML oversight, centralized exchanges remain the preferred choice for criminals to convert crypto to fiat, but their tactics are evolving rapidly.

Flows from illicit sources to CEXs neared $7 billion in the first half of 2025 and have averaged over $14 billion annually since 2020.

However, direct transfers from illicit entities to exchanges have declined substantially, from over 40% in 2021-2022 to around 15% now. This shift indicates that criminals have adapted to compliance efforts by introducing additional layering steps, such as mixers and cross-chain bridges.

Data shows that occasional crimes, such as stolen funds or ransomware, have the shortest lifespans, with 50% of wallets receiving no additional inflows after the initial incident.

Darknet markets, online pharmacies, and fraud shops commonly operate for 807 to 959 days, benefiting from network effects and established reputations.

Terrorist financing operations show 50% survival rates at just 54 days, indicating short-lived efforts due to high attention and quick law enforcement action.

Additionally, after operations, illicit entities exhibit different behaviors depending on the cryptocurrency they hold.

Stablecoins are liquidated urgently; nearly 95% are drained within 90 days after the last inflow, with only 29.5% of wallets maintaining balances after one year.

Ethereum follows a more measured pattern, with approximately 87% of ETH moved within 90 days; however, 35.6% of wallets retain ETH for over one year.

Bitcoin demonstrates exceptional staying power, with criminals moving only 52% of BTC within 90 days, and 36.7% of wallets maintaining bitcoin balances after a full year.

What Law Enforcement Can Do

While centralized stablecoins can be frozen by issuers, confiscating BTC and other permissionless cryptocurrencies requires obtaining private keys or intercepting funds at centralized off-ramps.

To effectively capture these assets, Chainalysis suggests that authorities require expedited seizure powers for time-sensitive investigations, a robust framework for cross-border cooperation, and technical capacity with blockchain analytics tools.

If authorities coordinate action and implement necessary measures, these billions in illicit proceeds sitting on public blockchains are theoretically seizable.

The post Criminals and Their Networks Hold $75B in Crypto Assets, Says Chainalysis appeared first on Cryptonews.