Illicit Crypto Activity Shifts Away From Bitcoin as Tron and Ethereum Become New Battlegrounds, TRM Labs Report Reveals

A groundbreaking report released on June 28, 2023, by blockchain analytics firm TRM Labs revealed a dramatic shift in how cybercriminals use cryptocurrency, with Bitcoin’s share of illicit crypto volume plummeting from 97% in 2016 to just 19% in 2022. The findings paint a complex picture of an evolving digital underground where illicit actors are increasingly turning to networks like Tron and Ethereum, forcing law enforcement agencies to adapt their strategies for a multi-chain reality.

TL;DR

• Bitcoin’s share of illicit crypto volume dropped from 97% in 2016 to 19% in 2022
• Ethereum accounted for 68% of hack-related illicit volume, Binance Smart Chain for 19%
• Tron dominated terrorist financing, representing 92% of total volume in that category
• Tether on Tron saw a 240% increase in use for terrorist financing over the prior year
• The DOJ announced a new cyber section within its national security division

The Decline of Bitcoin in Illicit Finance

For years, Bitcoin carried the reputation as the cryptocurrency of choice for dark web markets, ransomware operators, and money launderers. But TRM Labs’ 2023 Illicit Crypto Ecosystem Report demonstrates just how outdated that narrative has become. According to the report, Bitcoin’s dominance in illicit crypto transactions has been in freefall, dropping from an overwhelming 97% of all identified criminal crypto volume in 2016 to a mere 19% by 2022.

Ari Redbord, TRM Labs’ global head of policy and a former Department of Justice prosecutor and U.S. Treasury undersecretary, characterized the shift as a fundamental change in the landscape. “We lived in a world again, just a few years ago, where really all you needed was to track and trace the flow of funds on Bitcoin,” Redbord told Fortune. “Tracing certainly has changed.”

Ethereum and BSC Dominate Hack Volume

While Bitcoin has receded from its position as the primary vehicle for crypto crime, other blockchains have filled the void — particularly when it comes to hacks and exploits. TRM Labs found that Ethereum accounted for 68% of overall illicit volume related to hacks, while Binance Smart Chain contributed another 19%. The proliferation of decentralized finance protocols and cross-chain bridges on these networks has created a vast attack surface that cybercriminals have been quick to exploit.

The shift reflects the broader evolution of the crypto ecosystem itself. As decentralized applications, smart contracts, and token swaps have moved to networks beyond Bitcoin, criminals have followed the liquidity. The complexity of DeFi protocols, combined with often rudimentary security measures, has made them attractive targets for sophisticated hacking groups, including those linked to North Korean state actors.

Tron Emerges as Terrorist Financing Hub

Perhaps the most striking finding in the TRM Labs report was the near-total dominance of Tron in terrorist financing activity. According to the data, 92% of all identified terrorist financing volume in cryptocurrency flowed through the Tron network. The blockchain, founded by Justin Sun, has become particularly popular among illicit actors due to its low transaction fees and the perception that it operates outside the regulatory perimeter.

The growing use of Tether (USDT) on Tron has compounded concerns. TRM Labs documented a 240% increase in the use of Tether on Tron for terrorist financing over the previous year. As a stablecoin pegged to the U.S. dollar, Tether offers criminals the stability of fiat currency with the speed and pseudonymity of blockchain transfers, making it an especially appealing tool for moving illicit funds across borders.

“We have seen Russian cybercriminals, drug cartels, and even North Korean state actors look to Tron, where there is an ecosystem of noncompliant crypto businesses ready to convert funds,” Redbord explained. The confluence of Tether and Tron — two entities that have faced their own regulatory scrutiny — has created what some analysts describe as a perfect storm for illicit financial activity.

Law Enforcement Fights Back

Despite the evolving tactics of cybercriminals, Redbord maintained that law enforcement and regulators are largely keeping pace. The Treasury Department’s Office of Foreign Assets Control made headlines in 2022 when it sanctioned cryptocurrency addresses and mixers — including Tornado Cash — for the first time, marking a significant escalation in the government’s ability to directly target on-chain infrastructure used for money laundering.

The sanctions represented a new frontier in financial regulation, extending traditional tools like asset freezes to the blockchain itself. While controversial among privacy advocates, the move signaled that U.S. authorities were willing to take unprecedented steps to disrupt the financial networks supporting state-sponsored cybercrime, terrorism, and organized crime.

Adding to the enforcement buildup, the Department of Justice announced a new cyber section within its national security division around the same time the TRM Labs report was released. The specialized unit was designed to enhance the government’s capacity to investigate and prosecute cyber-enabled national security threats, including those involving cryptocurrency.

An Ongoing Arms Race

The TRM Labs report makes clear that the battle between law enforcement and cybercriminals in the cryptocurrency space is a constantly evolving arms race. As blockchain analytics firms develop more sophisticated tracing tools, criminals respond by migrating to new networks, employing mixers and privacy coins, and exploiting regulatory gaps between jurisdictions. Illicit actors are also using decentralized mixers like Tornado Cash and privacy-focused coins like Monero and Zcash in attempts to evade detection.

For the legitimate crypto industry, the report underscores the importance of robust compliance infrastructure and the need for continued cooperation between blockchain analytics firms, exchanges, and regulators. As Bitcoin traded at approximately $30,086 and Ethereum at $1,828 on June 28, 2023, the market’s attention may have been focused on the spot ETF race — but beneath the surface, a quiet war over the future of illicit finance in crypto continued to unfold across multiple blockchains.

Why This Matters

The dramatic migration of illicit activity from Bitcoin to networks like Tron and Ethereum represents a fundamental challenge for regulators and law enforcement. It demonstrates that targeting a single blockchain or cryptocurrency is insufficient — criminals will follow the path of least resistance across an ever-expanding multi-chain landscape. The findings also highlight the growing systemic risk posed by stablecoins on lightly regulated networks, where the combination of dollar-denominated value and weak oversight creates ideal conditions for money laundering and terrorist financing. As governments worldwide race to implement crypto regulatory frameworks, the TRM Labs report serves as a stark reminder that the rules must be chain-agnostic and internationally coordinated to be effective.

Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions.