Decline in crypto crime by 19.6% highlights maturing digital assets ecosystem

Legitimate activity is growing more quickly than illicit activity, but stolen funds and ransomware activity continued to rise in 2024

In addition to the SEC’s approval of Spot Bitcoin ETFs in January, and the unveiling of the Central Bank of the UAE’s stablecoin regulations last month, the crypto sector has been bolstered by another significant development.

New research by Chainalysis, the blockchain data company, has shown that while the year to date (YTD) flow of crypto funds to legitimate services has reached their highest levels since 2021, while aggregate illicit activity over the same period fell by an impressive 19.6 per cent, dropping from $20.9bn to $16.7bn.

“It is highly encouraging to see that criminal activity continues to become an ever-shrinking share of the crypto ecosystem. The growth of legitimate activity outpacing that of illicit activity on-chain demonstrates the continued transition of cryptocurrencies to the mainstream. Just as with traditional financial systems, it is unlikely that illicit activity will be entirely eradicated. But advanced blockchain analysis tools, such as those provided by Chainalysis, are empowering law enforcement agencies and enterprises to counter the threat ever more effectively. This places crypto and blockchain on track to revolutionise the exchange of value, much like the internet did for the exchange of information,” said Eric Jardine, Cybercrime Research Lead at Chainalysis.

Ransomware continues to rise

While overall, there was a decline in illicit transactions compared to the same period last year, ransomware was a notable exception.

At this point last year, Chainalysis reported cumulative ransomware payments of around $449.1m through the end of June 2023. This year through the same period, the researchers recorded a total of $459.8m in ransoms paid, setting 2024 firmly on track to be the worst year on record.

Another concerning finding is the ballooning of the maximum ransom payment observed in a given year.

Thus far, 2024 saw the largest single payment ever recorded at approximately $75m to a ransomware group known as Dark Angels. This increase in the maximum payment size signifies a 96 per cent YoY growth from 2023 and a 335 per cent rise compared to the maximum payment in 2022.

Bitcoin back in cryptocriminals’ crosshairs

After a 50 per cent drawdown in crypto value stolen in 2023 compared to 2022, this year has also seen a resurgence in hacking activity.

The cumulative value stolen YTD in 2024 has already crested $1.58bn, which is around 84.4 per cent greater than the value stolen over the same period last year.

Interestingly, the number of hacking incidents in 2024 has only marginally outpaced that of 2023, rising at just 2.76 per cent YoY.

Much of the change in the value compromised, therefore, is attributable to rising asset prices, particularly Bitcoin which accounted for 40 per cent of the transaction volume associated with the post-hack movement of stolen funds.

This also suggests that crypto thieves are ‘returning to their roots’ by targeting centralised exchanges with greater frequency rather than prioritising DeFi protocols, which are less popular vehicles for trading BTC.

Attackers, including those linked to North Korea, are leveraging increasingly sophisticated social engineering tactics — including applying for IT jobs — to steal crypto by infiltrating centralised exchanges.

Commenting on the divergence of ransomware and hacks from the overall decline in illicit on-chain activities, Jardine said, “These two types of crime are often perpetrated by organised groups that leverage sophisticated cyber infrastructure. The key to disrupting cybercrime is disrupting its supply chains, including attackers, affiliates, partners, infrastructure services providers, launderers, and cashout points. Because the operations for crypto heists and ransomware operate almost entirely on the blockchain, law enforcement armed with the right solutions can follow the money to better understand and disrupt these actors’ operations.”