Crypto Crime Fell in Volume but Evolved in Tactics in 2024: TRM Labs Report

Calvin James

In 2024, TRM Labs reported that cryptocurrency crime dropped in raw transaction volume, but threat actors shifted methods, expanded targets, and adapted faster. The overall crypto transaction volume reached $10.6 trillion, increasing 56% from 2023. Despite that growth, the illicit crypto volume fell to $45 billion, a 24% drop from the previous year.

Source: TRM Labs (Illegal Crypto Volume)

That figure represented 0.4% of total volume, compared to 0.9% in 2023. While lower percentages signal improvement, the size and speed of evolving threats remained significant across the global crypto ecosystem.

Sanctions, Scams, and Blocklisted Addresses Led Illicit Activity

Sanctioned entities accounted for 33% of all illicit volume in 2024. Blocklisted addresses, many linked to stablecoin issuers or flagged by regulators, represented 29%. Scams and fraud followed at 24%. These three categories dominated blockchain-based crime, with smaller shares attributed to ransomware, terrorist financing, and drug sales. TRON carried the largest share of illicit activity at 58%, followed by Ethereum at 24%, Bitcoin at 12%, and both Binance Smart Chain and Polygon at 3%.

Source: TRM (Blocklisted Adresses)

Despite its lead, TRON saw the sharpest drop in criminal activity. Illicit volume on TRON fell by $6 billion in 2024. Almost half of that was tied to sanctioned entities, while a third involved blocklisted funds. A portion of frozen USDT was later returned to victims or government wallets. TRON, Tether, and TRM formed a financial crime unit in August 2024. That joint initiative helped freeze $130 million in illicit funds by year-end.

Ransomware Payments and Hacks Set New Records

Ransomware incidents totaled 5,635 in 2024, exceeding the 5,223 cases in 2023. The largest single payment reached $75 million, paid to the group Dark Angels in March. A new trend saw criminals shift away from mixers and toward cross-chain bridges to obscure funds. These tools allowed quicker swaps between coins and avoided many tracing methods. Bitcoin remained the top choice for ransomware payments, though laundering tactics diversified.

Groups such as Brain Cipher, RansomHub, and Trinity emerged in 2024. Existing groups like Qilin and Lynx rebranded to escape law enforcement. Trinity targeted critical sectors such as healthcare. Most groups operated under the Ransomware-as-a-Service model, enabling widespread affiliate participation. Law enforcement responded with coordinated takedowns including Operation Cronos and Operation Endgame. Sanctions also hit affiliates of Evil Corp. These efforts disrupted some operations but did not eliminate the threat.

Crypto Hacks Rose to $2.2 Billion with North Korea Involved

In total, $2.2 billion was stolen in crypto hacks in 2024, up 17% from the previous year. This brought the three-year loss to $7.7 billion. Almost 70% of thefts stemmed from compromised private keys or seed phrases. Attackers used phishing, malware, and poor wallet security to steal credentials.

Source: TRM (Total Cryptocurrency Hacks)

Funds were then quickly moved through laundering tools to evade tracking. North Korea was responsible for nearly $800 million of the stolen crypto. Its attacks averaged five times larger than those by other threat actors.

These operations used bridges and obscure protocols that law enforcement struggled to intercept. Law enforcement efforts shut down several major crypto mixers, including Samourai Wallet. North Korean-linked actors then switched to JoinMarket, Mixero, and smaller Wasabi coordinators.

Fraud Losses Dropped but Still Posed Major Risks

Crypto fraud volume dropped to $10.7 billion in 2024, a 40% decrease from 2023. Ponzi and pyramid schemes saw fewer major operations, with only six schemes receiving more than $100 million. That was down from 14 in 2023. These schemes relied on word-of-mouth and viral spread, which appeared to decline.

Source: TRM (Fraud Adresses)

Financial grooming scams, also known as “pig butchering,” dropped to $2.5 billion, falling 58% year-over-year. Despite the decrease, TRM assessed that many losses went unreported. The reduction was partly due to greater law enforcement action, increased USDT freezes, and shifts in criminal behavior. Offenders began using other stablecoins like DAI and switched to more decentralized methods to obscure fund movement.

Self-reported scams remained common. Chainabuse, a reporting tool used by the public, saw high volumes of complaints. TRM also recorded ongoing deployments of phishing sites and investment scams throughout the year. Bitcoin was the top payment method used by fraudsters, although its dominance declined over time.

Drug Sales Moved to Encrypted Platforms and Vendor Shops

Illicit drug sales using cryptocurrency grew to $2.4 billion in 2024, a 19% rise from the prior year. Russian-language darknet markets led the activity, generating over $1.7 billion and accounting for more than 97% of the total. Western DNMs declined under pressure from enforcement and exit scams. Markets like Bohemia, Nemesis, and Incognito shut down or were seized.

Western drug vendors began moving to encrypted apps like Telegram, Signal, and WhatsApp. TRM recorded a rise in crypto use on vendor shops and personal sites. Crypto sent to vendor shops more than doubled in 2024, surpassing $600 million compared to $289 million the year before.

Chinese drug precursor manufacturers saw crypto payments drop from $27.6 million to $17 million. After the Biden-Xi summit in late 2023, China imposed new bans on fentanyl precursors. These restrictions forced producers to seek alternative payment methods and substances. Vendors also became less likely to share crypto addresses directly, to avoid blockchain tracing.

Crypto Crime Tactics Shifted and Became More Sophisticated

Threat actors used AI to increase scam effectiveness. In 2024, TRM observed deepfakes used to impersonate CEOs and family members. AI tools created fake profiles to bypass identity checks on exchanges. Large language models helped scammers write more convincing phishing messages and scam dialogue.

Improved operational security was noted across terrorist financing and fraud cases. Criminals used unhosted wallets, mixers, and fake credentials to avoid identification. Fraud groups changed fund flows, embraced new stablecoins, and relied on more complex decentralized services. These shifts reflected rising awareness of enforcement tactics and a push for anonymity.

TRM reported that delayed attribution and underreporting remained major issues. Illicit volumes for previous years were revised upward months after initial estimates. The final 2024 illicit figure could exceed $75 billion based on previous patterns. Global efforts including financial freezes, intelligence sharing, and protocol bans contributed to measurable progress. But illicit actors continued adjusting quickly. As they exploit new tools and platforms, ongoing analysis, regulation, and technical action will remain necessary to keep pace.

Source