Illicit crypto activity decreases, but stolen funds and ransomware payments increase

Blockchain analytics firm Chainalysis has reported a nearly 20% decrease in illicit crypto activity year-to-date, indicating a positive trend towards the growing legitimacy of the sector. However, the firm also highlighted worrying trends in specific types of cybercrime. Funds stolen in crypto thefts have nearly doubled to $1.58 billion, and ransomware inflows are up 2% to $459.8 million in the first half of 2024.

The increase in stolen funds is attributed to a resurgence of attacks on centralized exchanges, reversing an earlier trend where hackers had focused on decentralized finance. While the total number of hacking incidents has only slightly exceeded that of 2023, the average value stolen per event has soared by nearly 80% in 2024, partly due to rising cryptocurrency prices. The average value compromised per event has increased from $5.9 million per event from January to July 2023 to $10.6 million per event through 2024, based on the value of assets at the time of the theft.

Ransomware remains a persistent threat, with 2024 on track to surpass last year's record $1 billion in ransom payments. This year saw the largest ever recorded ransomware payout of around $75 million to the Dark Angels ransomware group. The ransomware landscape has fragmented following law enforcement actions against major players, with some affiliates migrating to less effective strains or releasing new ones, increasingly targeting larger companies.

Despite the overall decline in illicit activity, the continued increase in stolen funds and ransomware payouts highlights the evolution of cybercriminals' tactics. Centralized crypto exchanges are not only frequent targets for hackers, but also play an important role in laundering stolen assets. Trading platforms have received nearly $100 billion in crypto from known illicit addresses since 2019, pointing to a worrying lack of international cooperation in anti-money laundering efforts. Almost 30% of all illicit address crypto ends up on sanctioned services, including the Russian exchange Garantex. The peak was in 2022, when $30 billion of “dirty crypto” interacted with these services, highlighting the persistent challenges in the fight against crypto-based money laundering.