Chainalysis, a leading blockchain intelligence firm, has uncovered a staggering $75 billion in cryptocurrency linked to illicit activities, all residing in public crypto wallets visible on the blockchain. This digital fortune, while concealed in plain sight, is theoretically within reach of global law enforcement thanks to blockchain transparency.
In its October 9 report, Chainalysis conducted a detailed analysis of static on-chain balances, distinguishing between wallets directly tied to criminal operations and those indirectly associated through downstream transactions. Approximately $15 billion is held in wallets with a direct connection to illicit actions, while a broader network of downstream wallets—accounts that have received significant amounts of tainted funds—controls the remaining $60 billion.
The report reveals a sharp growth in the value of crypto held by illicit actors. Since 2020, the combined holdings in Bitcoin, Ethereum, and stablecoins linked directly to criminal entities have surged by 359%, reaching nearly $15 billion as of July 2025. Stolen assets, particularly from high-profile hacks, dominate this category. Such events include the notorious Bybit breach, which saw $1.5 billion siphoned off in an incident attributed to North Korean actors.
One reason for the accumulation of criminal funds on-chain is the logistical complexity of laundering large sums. While scammers and darknet operators tend to move funds swiftly, cybercriminals behind major hacks often struggle to obscure or off-ramp immense amounts without attracting regulatory scrutiny. As a result, these funds remain stranded on-chain for extended durations.
The downstream wallet ecosystem—those indirectly associated with illicit transactions—presents an even greater concern. Chainalysis estimates these wallets collectively hold over $60 billion in tainted crypto. Notably, darknet markets and their operators account for $46.2 billion of this total. These marketplaces, some in operation since the days of Silk Road, continue to thrive despite law enforcement crackdowns, suggesting a resilient underground economy.
Bitcoin remains the top choice for criminal use, comprising roughly 75% of all holdings by illicit entities. This preference is not just due to Bitcoin’s liquidity and global recognition, but also its immense price growth over time. Older wallets, originally holding smaller amounts, have appreciated significantly in value. Interestingly, over a third of wallets associated with criminal activity still maintain Bitcoin balances at least a year after their last transaction—indicating a tendency among criminals to treat BTC as a long-term asset.
In contrast, stablecoins like USDT or USDC are notably less concentrated in illicit wallets. This is likely due to their centralized nature—issuers can freeze assets—prompting criminals to distribute their holdings more widely to reduce the risk of seizure.
Chainalysis also observed a significant evolution in how criminals launder and cash out illicit funds. Previously, over 40% of tainted crypto was directly transferred to centralized exchanges. Today, that figure has dropped to about 15%. Instead, criminals increasingly rely on obfuscation tools like crypto mixers and cross-chain bridges, which make tracing transactions more difficult by blending or moving assets across different blockchains.
This shift presents new challenges for law enforcement agencies globally. The decentralized, anonymized nature of these tools complicates the process of identifying, tracking, and recovering illicit assets. However, blockchain’s inherent transparency still offers an edge. Chainalysis reports that its data and tools have assisted authorities in recovering more than $12.6 billion in illegal funds to date.
The findings underscore the growing sophistication of cybercriminals, who are evolving faster than many regulatory frameworks. As decentralized finance (DeFi) platforms grow and new technologies like zero-knowledge proofs become mainstream, tracking illicit flows will require increasingly advanced analytics and closer cooperation between public and private sectors.
Moreover, the report raises questions about the effectiveness of current regulations and the speed at which law enforcement can adapt. With billions in illicit assets sitting idle, global authorities face a race against time to build technological and legal infrastructure capable of intercepting and seizing these funds efficiently.
The role of mixers and cross-chain bridges has become particularly controversial. While these tools serve legitimate purposes, such as enhancing privacy for everyday users, they are increasingly misused by bad actors. Regulatory bodies are now exploring ways to distinguish between legitimate privacy-focused users and those seeking to launder money. Some jurisdictions have begun targeting developers and operators of such tools, sparking debates around censorship and code neutrality.
Another emerging risk lies in the use of decentralized exchanges (DEXs) for laundering. Without centralized oversight and with smart contracts executing trades automatically, DEXs offer criminals a seemingly safer exit route. However, blockchain analytics firms are improving their capabilities to monitor activity even within these decentralized ecosystems.
The growing use of privacy-centric cryptocurrencies, such as Monero and Zcash, is also on law enforcement’s radar. While these coins offer robust privacy features that protect user data, they also pose significant barriers to forensic analysis. As a result, regulators are increasingly wary of exchanges that list these assets without implementing stringent know-your-customer (KYC) protocols.
Going forward, collaboration between cybersecurity experts, blockchain analysts, and global law enforcement will be critical. As criminals refine their tactics, so too must those seeking to stop them. Chainalysis’ report is a stark reminder that while blockchain is transparent by design, harnessing that transparency to fight crime requires constant innovation and vigilance.
In conclusion, the $75 billion in illicit crypto assets mapped by Chainalysis isn’t just a number—it’s a reflection of the scale, complexity, and persistence of digital financial crime. While blockchain offers unprecedented tools for transparency and accountability, it also provides new avenues for exploitation. The battle over the future of crypto legitimacy is far from over, and the next moves by regulators, technologists, and criminals will determine the shape of tomorrow’s financial landscape.