A groundbreaking report released on June 28, 2023, by blockchain analytics firm TRM Labs revealed a dramatic shift in how cybercriminals use cryptocurrency, with Bitcoin’s share of illicit crypto volume plummeting from 97% in 2016 to just 19% in 2022. The findings paint a complex picture of an evolving digital underground where illicit actors are increasingly turning to networks like Tron and Ethereum, forcing law enforcement agencies to adapt their strategies for a multi-chain reality.
TL;DR
- Bitcoin’s share of illicit crypto volume dropped from 97% in 2016 to 19% in 2022
- Ethereum accounted for 68% of hack-related illicit volume, Binance Smart Chain for 19%
- Tron dominated terrorist financing, representing 92% of total volume in that category
- Tether on Tron saw a 240% increase in use for terrorist financing over the prior year
- The DOJ announced a new cyber section within its national security division
The Decline of Bitcoin in Illicit Finance
For years, Bitcoin carried the reputation as the cryptocurrency of choice for dark web markets, ransomware operators, and money launderers. But TRM Labs’ 2023 Illicit Crypto Ecosystem Report demonstrates just how outdated that narrative has become. According to the report, Bitcoin’s dominance in illicit crypto transactions has been in freefall, dropping from an overwhelming 97% of all identified criminal crypto volume in 2016 to a mere 19% by 2022.
Ari Redbord, TRM Labs’ global head of policy and a former Department of Justice prosecutor and U.S. Treasury undersecretary, characterized the shift as a fundamental change in the landscape. “We lived in a world again, just a few years ago, where really all you needed was to track and trace the flow of funds on Bitcoin,” Redbord told Fortune. “Tracing certainly has changed.”
Ethereum and BSC Dominate Hack Volume
While Bitcoin has receded from its position as the primary vehicle for crypto crime, other blockchains have filled the void — particularly when it comes to hacks and exploits. TRM Labs found that Ethereum accounted for 68% of overall illicit volume related to hacks, while Binance Smart Chain contributed another 19%. The proliferation of decentralized finance protocols and cross-chain bridges on these networks has created a vast attack surface that cybercriminals have been quick to exploit.
The shift reflects the broader evolution of the crypto ecosystem itself. As decentralized applications, smart contracts, and token swaps have moved to networks beyond Bitcoin, criminals have followed the liquidity. The complexity of DeFi protocols, combined with often rudimentary security measures, has made them attractive targets for sophisticated hacking groups, including those linked to North Korean state actors.
Tron Emerges as Terrorist Financing Hub
Perhaps the most striking finding in the TRM Labs report was the near-total dominance of Tron in terrorist financing activity. According to the data, 92% of all identified terrorist financing volume in cryptocurrency flowed through the Tron network. The blockchain, founded by Justin Sun, has become particularly popular among illicit actors due to its low transaction fees and the perception that it operates outside the regulatory perimeter.
The growing use of Tether (USDT) on Tron has compounded concerns. TRM Labs documented a 240% increase in the use of Tether on Tron for terrorist financing over the previous year. As a stablecoin pegged to the U.S. dollar, Tether offers criminals the stability of fiat currency with the speed and pseudonymity of blockchain transfers, making it an especially appealing tool for moving illicit funds across borders.
“We have seen Russian cybercriminals, drug cartels, and even North Korean state actors look to Tron, where there is an ecosystem of noncompliant crypto businesses ready to convert funds,” Redbord explained. The confluence of Tether and Tron — two entities that have faced their own regulatory scrutiny — has created what some analysts describe as a perfect storm for illicit financial activity.
Law Enforcement Fights Back
Despite the evolving tactics of cybercriminals, Redbord maintained that law enforcement and regulators are largely keeping pace. The Treasury Department’s Office of Foreign Assets Control made headlines in 2022 when it sanctioned cryptocurrency addresses and mixers — including Tornado Cash — for the first time, marking a significant escalation in the government’s ability to directly target on-chain infrastructure used for money laundering.
The sanctions represented a new frontier in financial regulation, extending traditional tools like asset freezes to the blockchain itself. While controversial among privacy advocates, the move signaled that U.S. authorities were willing to take unprecedented steps to disrupt the financial networks supporting state-sponsored cybercrime, terrorism, and organized crime.
Adding to the enforcement buildup, the Department of Justice announced a new cyber section within its national security division around the same time the TRM Labs report was released. The specialized unit was designed to enhance the government’s capacity to investigate and prosecute cyber-enabled national security threats, including those involving cryptocurrency.
An Ongoing Arms Race
The TRM Labs report makes clear that the battle between law enforcement and cybercriminals in the cryptocurrency space is a constantly evolving arms race. As blockchain analytics firms develop more sophisticated tracing tools, criminals respond by migrating to new networks, employing mixers and privacy coins, and exploiting regulatory gaps between jurisdictions. Illicit actors are also using decentralized mixers like Tornado Cash and privacy-focused coins like Monero and Zcash in attempts to evade detection.
For the legitimate crypto industry, the report underscores the importance of robust compliance infrastructure and the need for continued cooperation between blockchain analytics firms, exchanges, and regulators. As Bitcoin traded at approximately $30,086 and Ethereum at $1,828 on June 28, 2023, the market’s attention may have been focused on the spot ETF race — but beneath the surface, a quiet war over the future of illicit finance in crypto continued to unfold across multiple blockchains.
Why This Matters
The dramatic migration of illicit activity from Bitcoin to networks like Tron and Ethereum represents a fundamental challenge for regulators and law enforcement. It demonstrates that targeting a single blockchain or cryptocurrency is insufficient — criminals will follow the path of least resistance across an ever-expanding multi-chain landscape. The findings also highlight the growing systemic risk posed by stablecoins on lightly regulated networks, where the combination of dollar-denominated value and weak oversight creates ideal conditions for money laundering and terrorist financing. As governments worldwide race to implement crypto regulatory frameworks, the TRM Labs report serves as a stark reminder that the rules must be chain-agnostic and internationally coordinated to be effective.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions.
BTC going from 97% to 19% of illicit volume in six years is actually a win for on-chain forensics. the problem is the criminals just found a softer target
btc going from 97% to 19% of illicit volume in 6 years is wild. criminals move faster than regulators
criminals moved faster than regulators but thats always the case. the real story is how quickly btc became less attractive for illicit use as chainalysis got better
chainalysis got better and on-chain forensics improved so btc became too risky for criminals. they migrated to chains with less surveillance infrastructure. cat and mouse game
btc dropping to 19% proves chainalysis works. criminals go where forensics are weakest. tron has zero privacy features but also zero enforcement interest
surveil_ 19pct BTC illicit share in 2022 was actually a huge win for chainalysis. the problem is the criminals just moved to a cheaper chain with zero forensics. whack a mole
tron dominating 92% of terrorist financing and tether on tron up 240%… cheap tx fees attract bad actors too
^ exactly. its not about the chain being bad, its about cost. tron tx fees are basically zero so of course it gets used
scrubchain_ its not just fees. tron has practically no monitoring tools compared to ethereum. chainalysis barely covers it. thats the real draw
giancarlo_r the chainalysis coverage gap is the real story. they built forensic tools for BTC and ETH but TRX might as well be invisible. enforcement will always lag behind
tron dominating terror financing at 92% and usdt on tron up 240%. justin sun built the perfect crime chain and nobody seems to care
92% of terror financing volume and TRX is still a top 20 coin. exchanges listing it are complicit at this point. the disconnect is staggering
chainwatch_pl exchanges wont delist TRX because the volume is too profitable. compliance teams get overruled by revenue teams every single time
sanc_check Binance makes millions in TRX trading fees daily. they will never delist regardless of what the TRM report says. money talks compliance walks
ETH at 68% of hack volume makes sense. more DeFi protocols, more smart contracts, more attack surface. the complexity tax is real
attack surface scales with TVL not chain count. eth has the most DeFi so it gets hit the most. when solana defi grew the same thing happened there
USDT on Tron up 240% for terrorist financing while the DOJ just now creates a cyber section. regulation is always five steps behind the actual threat