Chainalysis reports that $75 billion in illicit crypto is sitting on blockchains

Chainalysis reported that more than $75 billion in illicit crypto is sitting on blockchains, ripe for possible government action if enforcement agencies coordinate effectively.

The company said it has already worked with authorities worldwide to seize $12.6 billion in illegal funds, and now it sees an even larger pool of wealth that could be captured.

The analysis shows that illicit actors are holding billions directly in wallets and billions more downstream. Unlike its usual reports that follow the flow of funds, this study looked at balances that remain static in wallets linked to stolen funds, scams, and darknet markets.

Chainalysis said that as of right now, criminal-linked wallets holding bitcoin, ether, and stablecoins reached nearly $15 billion, which is a 359% surge in five years, with most of it coming from stolen funds.

Source: Chainalysis

Hackers often sit on their loot while trying to figure out how to cash out, unlike scam operators and darknet vendors who move money faster. The Chainalysis report pointed to the historic $1.5 billion Bybit hack to explain that laundering that much crypto is difficult, forcing funds to remain on-chain.

Crypto balance levels also follow market cycles, so criminal holdings in dollars hit all-time high during the 2021 bull run, tumbled during the infamous 2022 crypto winter, and then surged again in 2024 after Trump won the presidential election again, an outstanding rally that has lasted throughout 2025 too.

While the share of Bitcoin fell compared to 2020, Ethereum and stablecoin balances grew. Bitcoin still makes up most of the value because of its price increase.

Chainalysis found that the real shadow economy lies downstream. Wallets connected indirectly to illicit entities hold more than $60 billion, almost four times the direct holdings.

Darknet markets are the largest share, with vendors and administrators controlling over $46.2 billion in crypto.

Money laundering platforms such as Black U move value through networks, making the total even higher, with darknet markets showing over 200% compound annual growth, followed by fraud shops.

Exchanges, cash-out methods, and law enforcement windows

Criminals are changing their methods of converting crypto to fiat, with Chainalysis data showing that inflows to exchanges from illicit sources reached nearly $7 billion in the first half of this year, meaning they’ve averaged $14 billion annually since 2020.

Flows are trending down as criminals use crypto itself as a payment method and store of value, reducing the need to convert to fiat.

Direct transfers to exchanges have dropped sharply. They made up over 40% of illicit flows in 2021 and 2022 but only about 15% in 2025. Criminals now rely on mixers and cross-chain bridges to hide trails. Chainalysis said its Reactor tool helps investigators map those flows.

The company also noted that in most illicit categories, over half the balances are concentrated in just three wallets. Exceptions are terrorist financing, which is spread thin, and child abuse material, where new vendors in China are adding to the ecosystem.

Stablecoins are spread more widely because issuers can freeze them, so criminals try to limit losses by using many wallets.

Cash-out patterns are split. Some groups spread across more exchange deposit addresses, while others stick to a smaller set. Darknet markets saw 146% growth in concentration of their top addresses, followed by malware at 60% and scams at 44.8%.

Meanwhile, sanctioned entities saw an 86% drop, and stolen funds a 70% fall, reflecting stricter compliance. Criminals also change addresses more often. In 2020, up to 46% of cash-out addresses were reused a year later. Now, reuse has plummeted, showing that turnover is accelerating as they try to avoid detection.

Chainalysis also looked at how long criminal entities operate. Some, like ransomware, last just a day. Market-based entities such as darknet markets, fraud shops, and online pharmacies can survive 807 to 959 days. Terror financing is shorter, averaging about 54 days.

Once operations end, the way criminals liquidate varies. Stablecoins are drained the fastest, with 95% gone within 90 days. Ether is slower, with 87% moved in 90 days and more than a third still there after a year. Bitcoin lingers longest, with only 52% moved in 90 days and 36.7% still in wallets after a year.