Is crypto primarily used by criminals

Summary ( TL;DR )

Best available measurements show illicit activity is a small fraction of total crypto volume—~0.14% in 2024, down from ~0.61% in 2023, per Chainalysis. (Chainalysis)
Cash still dominates money laundering globally, with UN/Europol estimating 2–5% of global GDP laundered each year through traditional channels. (UNODC)
Criminal use exists (ransomware, scams, sanctions evasion), with 2024 hacks at ~$2.2B and stablecoins used more often by illicit actors—but blockchain transparency enables seizures, sanctions, and tracing. (Reuters)
Terrorist groups experimented more with crypto in 2024, yet traditional methods (cash, banks, hawalas) remain the majority of terrorist financing. (TRM Labs)

Introduction: Why this question won’t go away

Crypto’s open ledgers make the bad headlines easy to see: a hacked exchange here, a ransomware payout there. But visibility isn’t the same as prevalence. If we want a serious answer to “Is crypto primarily used by criminals?”, we need to compare measured illicit on-chain activity with total crypto activity, and then compare that with illicit finance in the traditional system. (Chainalysis)

What the latest numbers say about illicit crypto activity

Illicit share of on-chain volume

Chainalysis’ 2025 report (covering 2024 activity) estimates that illicit on-chain activity accounted for ~0.14% of attributed crypto transaction volume in 2024, down from ~0.61% in 2023. As with every year, these are lower-bound estimates that may be revised upward as more illicit addresses are identified, but historically the share remains below 1%. (Chainalysis)

Other analytics firms have long reported the same order of magnitude: illicit flows are well under 1% of activity, a dramatic decline from crypto’s early days. (elliptic.co)

Absolute dollars vs. percentages

In dollar terms, Chainalysis currently pegs 2024 illicit inflows to known illicit addresses at ~$40.9B (with eventual updates possible, as 2023’s estimate later doubled as more addresses were identified). The key context: overall crypto activity grew in 2024, and the illicit share still shrank. (Chainalysis)

What types of crime are most common on-chain?

Ransomware & hacks: 2024 saw ~$2.2B stolen in hacks, a YoY increase, with North Korea-linked groups a major driver. (Reuters)
Scams and “pig butchering”: Industrial-scale fraud hubs moved billions and exploited stablecoins; platforms like Huione have processed tens of billions tied to scam infrastructure since 2021. (Chainalysis)
Sanctions evasion & stablecoins: The mix of illicit assets shifted—stablecoins now form the majority of illicit transaction volume as criminals chase dollar stability while trying to bypass controls (issuers frequently freeze flagged funds). (Chainalysis)

The other side of the ledger: cash (still) rules criminal finance

If you zoom out to all money, not just crypto, the United Nations estimates 2–5% of global GDP is laundered annually—hundreds of billions to trillions of dollars—mostly through cash and the traditional financial system, not blockchains. Europol’s long-running assessment is blunt: “cash is still king” for criminals. (UNODC)

This scale difference matters. Even at the highest blockchain-analytics estimates, illicit crypto is measured in the tens of billions, while illicit fiat flows are measured in trillions. The visibility of blockchains makes crypto crime look big, but relative prevalence is much smaller than sensational headlines suggest. (UNODC)

Why criminals use crypto at all (and why it’s often a mistake for them)

Speed, borderlessness… and a public paper trail

Crypto can move value globally without banks—attractive for hackers, scammers, and sanctions evaders. But unlike cash, most blockchains are permanent, public ledgers. That transparency enables tracing, clustering, and attribution, often culminating in seizures and arrests. For example, the U.S. Department of Justice recovered ransom paid in the Colonial Pipeline attack by following the money on-chain. (Department of Justice)

Regulatory pressure and takedowns

Authorities use sanctions and enforcement to make laundering harder:

OFAC sanctioned the Sinbad mixer for laundering funds from DPRK-linked heists. (U.S. Department of the Treasury)
Courts and regulators continue to debate the scope of sanctions on other mixers, but the direction is clear: traceable on-chain activity is increasingly risky for criminals. (Reuters)

Terrorist financing: growing experiments, but still not dominant

In 2024, some terrorist organizations expanded crypto use, including ISIS-K and networks linked to Hamas—notably with stablecoins. Yet independent analysis stresses that cash, banks, money service businesses, and hawalas remain the majority of terrorist financing; crypto is a growing, visible slice, not the core. U.S. congressional analysts also note that crypto’s transparency can limit its appeal to such groups. (TRM Labs)

The compliance picture: crypto is getting harder for bad actors

Global standards: FATF’s 2024–2025 updates push countries and exchanges to implement the Travel Rule and stronger controls across VASPs, targeting stablecoin risks and DeFi compliance challenges. (FATF)
Freezing & blacklists: Stablecoin issuers and exchanges freeze addresses tied to crime or sanctions, making “dirty” stablecoins less useful over time. (Chainalysis)
Forensics maturity: Analytics firms constantly add new illicit address clusters, which is why historical illicit totals are often revised upward—and then acted upon by law enforcement. (Chainalysis)

So… is crypto primarily used by criminals?

No. The best available measurements show that illicit activity is a small share of on-chain volume—far below 1% in 2024—despite notable spikes in specific categories like ransomware or pig-butchering scams. Meanwhile, the traditional financial system and cash still carry the vast majority of criminal proceeds worldwide. Crypto crime is real and evolving, but “mostly for criminals” is not supported by the data. (Chainalysis)

Common myths vs. facts

Myth 1: “You can’t trace crypto.”
Fact: Most crypto movements are public and traceable with the right tools. That’s how the U.S. recovered the Colonial Pipeline ransom. (Department of Justice)

Myth 2: “All stablecoin transactions are anonymous.”
Fact: Issuers and exchanges freeze suspicious addresses, and stablecoins now dominate illicit flows precisely because criminals chase dollar-stability—making them easier targets for compliance and sanctions. (Chainalysis)

Myth 3: “Crypto crime is exploding as a % of use.”
Fact: The share of illicit crypto activity remains well under 1% even when dollar totals swing with markets or when new address clusters are identified. (Chainalysis)

Myth 4: “Terrorists mostly rely on crypto now.”
Fact: 2024 showed more experimentation, but cash and legacy channels remain dominant. (TRM Labs)

How law-abiding users and businesses can reduce risk

Choose compliant platforms. Use exchanges and custodians with strong KYC/AML, Travel Rule support, and rapid response to freezes/sanctions. FATF guidance gives a clear blueprint for what “good” looks like. (FATF)
Hygiene for self-custody.
- Use hardware wallets and secure backups.
- Keep seed phrases offline; enable multi-factor wherever possible.
Wallet screening. Before receiving high-value transfers, screen counterparty wallets (via a compliance-aware exchange or analytics partner) to avoid taint from known bad actors. (Chainalysis)
Be scam-aware. “Get-rich-quick,” romance/pig-butchering, and fake investment portals are rampant. Verify domains, never sign unknown transactions, and treat unsolicited outreach as hostile by default. (WIRED)
Incident response. If funds are compromised, act immediately: contact the platform, file police and financial-intelligence reports, and provide transaction hashes to speed tracing. Past cases show rapid coordinated action can recover value. (Department of Justice)

Frequently Asked Questions

Q1: If illicit crypto is “only” ~0.14% in 2024, why do we hear about it constantly?
Because blockchains are public, every large theft or sanction creates a visible, media-friendly trail. In traditional finance, most laundering happens out of sight—but it’s also orders of magnitude larger in aggregate. (Chainalysis)

Q2: Are stablecoins “bad” because criminals use them?
No. Stablecoins are widely used for remittances, trading, and payments; criminals follow liquidity. Crucially, freezing and blacklisting make stablecoins easier to interdict than cash. (Chainalysis)

Q3: Do mixers make crypto untraceable?
Mixers complicate tracing, but not perfectly; many have been sanctioned or disrupted, and analytics keep improving. (U.S. Department of the Treasury)

Q4: Are ransomware losses getting worse?
2024 hack losses rose (~$2.2B) even as the overall illicit share fell. Organizations are paying fewer and smaller ransoms, and law enforcement has executed major takedowns—but the threat remains. (Reuters)

Q5: How reliable are these estimates?
Firms like Chainalysis update figures as new illicit clusters are identified, so totals often rise later. Still, across years, the percentage share remains consistently <1%. (Chainalysis)

Bottom line

Crypto is not primarily a tool for criminals. It does get abused—especially for scams, hacks, and some sanctions evasion—but on-chain data shows this activity is a small slice of the whole, and it’s increasingly detectable and disruptable. The world’s biggest illicit finance problem remains what it has long been: cash and the legacy financial system, not blockchains. (Chainalysis)

Sources & Further Reading

Chainalysis, 2025 Crypto Crime Trends (shares & volumes; stablecoin shift). (Chainalysis)
Reuters, Losses from crypto hacks jump to $2.2B in 2024 (annual hack tally). (Reuters)
Europol, Cash is still king (cash dominance in laundering). (Europol)
UNODC, Money-laundering Overview (2–5% of global GDP laundered). (UNODC)
TRM Labs, Use of Crypto in Terrorist Financing (2024/2025) (growing experimentation; traditional methods still majority). (TRM Labs)
OFAC, Sanctions on Sinbad mixer (DPRK laundering tool). (U.S. Department of the Treasury)
DOJ, Colonial Pipeline ransom seizure (on-chain recovery example). (Department of Justice)