New research by Chainalysis, the blockchain data company, has shown that while the year to date (YTD) flow of crypto funds to legitimate services has reached their highest levels since 2021, aggregate illicit activity over the same period fell by an impressive 19.6%, dropping from US$20.9 billion to US$16.7 billion. 
“It is highly encouraging to see that criminal activity continues to become an ever-shrinking share of the crypto ecosystem. The growth of legitimate activity outpacing that of illicit activity on-chain demonstrates the continued transition of cryptocurrencies to the mainstream. Just as with traditional financial systems, it is unlikely that illicit activity will be entirely eradicated. But advanced blockchain analysis tools, such as those provided by Chainalysis, are empowering law enforcement agencies and enterprises to counter the threat ever more effectively. This places crypto and blockchain on track to revolutionise the exchange of value, much like the internet did for the exchange of information,” said Eric Jardine, Cybercrime Research Lead at Chainalysis.
Ransomware Continues to Rise
While overall, there was a decline in illicit transactions compared to the same period last year, ransomware was a notable exception. At this point last year, Chainalysis reported cumulative ransomware payments of around US$449.1 million through the end of June 2023.
This year through the same period, the researchers recorded a total of US$459.8 million in ransoms paid, setting 2024 firmly on track to be the worst year on record.
Another concerning finding is the ballooning of the maximum ransom payment observed in a given year. Thus far, 2024 saw the largest single payment ever recorded at approximately US$75 million to a ransomware group known as Dark Angels.
This increase in the maximum payment size signifies a 96% YoY growth from 2023 and a 335% rise compared to the maximum payment in 2022.
Bitcoin Back in Cryptocriminals’ Crosshairs
After a 50% drawdown in crypto value stolen in 2023 compared to 2022, this year has also seen a resurgence in hacking activity. The cumulative value stolen YTD in 2024 has already crested US$1.58 billion, which is around 84.4% greater than the value stolen over the same period last year. Interestingly, the number of hacking incidents in 2024 has only marginally outpaced that of 2023, rising at just 2.76% YoY.
Much of the change in the value compromised, therefore, is attributable to rising asset prices, particularly Bitcoin which accounted for 40% of the transaction volume associated with the post-hack movement of stolen funds.
This also suggests that crypto thieves are ‘returning to their roots’ by targeting centralised exchanges with greater frequency rather than prioritising DeFi protocols, which are less popular vehicles for trading BTC. Attackers, including those linked to North Korea, are leveraging increasingly sophisticated social engineering tactics — including applying for IT jobs — to steal crypto by infiltrating centralised exchanges.
Commenting on the divergence of ransomware and hacks from the overall decline in illicit on-chain activities, Jardine said, “These two types of crime are often perpetrated by organised groups that leverage sophisticated cyber infrastructure. The key to disrupting cybercrime is disrupting its supply chains, including attackers, affiliates, partners, infrastructure services providers, launderers, and cashout points. Because the operations for crypto heists and ransomware operate almost entirely on the blockchain, law enforcement armed with the right solutions can follow the money to better understand and disrupt these actors’ operations.”
