TRM Labs’ Illicit Crypto Ecosystem Report Shows Crime Moving Beyond Bitcoin

TRM InsightsInsights
TRM Labs’ Illicit Crypto Ecosystem Report Shows Crime Moving Beyond Bitcoin

Only 19% of illicit crypto volume flows through Bitcoin blockchain, as criminals embrace other blockchains and “chain-hopping” to launder money

SAN FRANCISCO, Calif. Jun. 28, 2023 – TRM Labs, the leader in blockchain intelligence solutions, today released the Illicit Crypto Ecosystem Report, a detailed guide to the complex dynamics of crypto crime. The new report identifies over 40 types of criminal activity, and reveals that a seismic shift in crypto crime has begun – moving away from the Bitcoin blockchain on to a diverse array of other chains like Ethereum, Tron, Binance Smart Chain and more. Notably, TRM’s analysis showed that Bitcoin accounts for only 19% of illicit crypto volume today, as criminals look to new blockchains and tactics, like “chain-hopping" to launder money and evade detection.

The Illicit Crypto Ecosystem Report is delivered by TRM Labs’ specialized threat intelligence team that monitors and reports on the latest risks, synthesizing trillions of disparate data points into a clear view of the crypto crime landscape. The report examines everything from espionage to SIM swapping and pump and dump schemes. This holistic view provides a powerful resource for law enforcement and compliance professionals who need a comprehensive yet granular view of where to allocate investigation and technological resources. 

Key findings of TRM Labs’ Illicit Crypto Ecosystem Report, which analyzed data from the full year 2022 include:

Crypto crime has moved beyond Bitcoin

  • In 2016, Bitcoin accounted for 97% of total illicit crypto volume. In 2022, Bitcoin accounted for just 19%.
  • In 2016, two-thirds of crypto hack volume was on Bitcoin; in 2022, Bitcoin accounted for just under 3%, with Ethereum (68%) and Binance Smart Chain (19%) dominating the field.
  • Bitcoin was the exclusive currency for terrorist financing in 2016, but analysis shows it was all but replaced by  assets on the TRON blockchain, which accounted for 92% in 2022.

Additional flow of funds findings

  • Approximately USD 9.04 billion was sent to various types of fraud schemes in 2022, with the large majority going to apparent Ponzi and/or pyramid schemes.
  • Approximately USD 2 billion was stolen in 2022 through attacks on cross-chain bridges, which enable cryptocurrency to pass from one blockchain to another. 
  • As much as USD 1.49 billion was spent on Darknet markets (DNMs) in 2022, over 80% of which was spent on Russian-language DNMs.

“A sea change in illicit crypto activity is underway, and TRM is empowering everyone from law enforcement investigators to compliance professionals to disrupt this new era of crypto crime,” said Esteban Castaño, co-founder and CEO, TRM Labs. “The shift away from the Bitcoin blockchain on to other blockchains and tactics underscores the importance of our building the industry’s most comprehensive map of illicit financial flows on-chain. Investigators choose TRM because no matter how sophisticated the attempt to obfuscate the flow of funds, our blockchain intelligence platform allows them to follow the money and close cases.”

Read the full TRM Labs Illicit Crypto Ecosystem Report. To get started with TRM Labs today, please visit,

About TRM Labs 

TRM Labs provides blockchain intelligence to help financial institutions, cryptocurrency businesses and public agencies detect, investigate and mitigate crypto-related fraud and financial crime. TRM's risk management platform includes solutions for cryptocurrency anti-money laundering (AML), transaction monitoring and wallet screening, investigative tracing and entity risk scoring including Know-Your-VASP. These tools enable organizations around the world to safely embrace cryptocurrency-related transactions, products, and partnerships. TRM is based in San Francisco, CA and is hiring across engineering, product, sales, and data science. To learn more, visit

Media Contact:

Sondra Magness

This is some text inside of a div block.
Subscribe and stay up to date with our insights

Access our coverage of TRON, Solana and 23 other blockchains

Fill out the form to speak with our team about investigative professional services.

Services of interest
Transaction Monitoring/Wallet Screening
Training Services
Training Services
By clicking the button below, you agree to the TRM Labs Privacy Policy.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.