Chainalysis Maps $75 B in Illicit Crypto Hidden in Plain Sight

This revelation arrives amid accelerating crypto crime in 2025, including record exchange heists and shifting laundering techniques. The new data reframes the narrative: the crime is not just in movement but in stasis.

Stolen Funds

Chainalysis’s report on static on-chain balances attributes this $75 billion to wallets tied to stolen funds, darknet markets, and criminal networks. Bitcoin comprises roughly 75 percent of these balances, reflecting its enduring role as a store of value for criminals. The prominence of Bitcoin in the static sum contrasts with recent trends in active illicit flows, where stablecoins now dominate transaction volume in criminal use.

Interestingly, only about 15 percent of these criminal-linked holdings move directly into exchanges. That drop suggests actors are increasingly relying on mixers, cross-chain bridges, and layering strategies to avoid detection or blocking. In effect, criminal capital is lurching inward toward deeper obfuscation before ever touching regulated venues.

Trends Over Time: a shift in the landscape

In earlier periods, studies tracked mostly movement; how much illicit crypto was flowing through addresses in a given year. In 2021, for instance, illicit transactions reached a peak of $14 billion, while they still represented a fraction, about 0.15 percent, of total crypto transaction volume. Back then, alerts were centered on flows, exchanges, ransomware, DeFi hacks, and darknet trading.

But recent reports show that transaction volume tied to illicit addresses has declined. In 2023, Chainalysis observed that inbound flows to known criminal addresses dropped from $39.6 billion in 2022 to around $24.2 billion. That corresponds to a share of 0.34 percent of total crypto activity.

At the same time, the static holdings, those “sleeping” wallets, may reflect a stockpile effect. Criminal actors may prefer to hold assets and only move them selectively, especially under growing pressure from regulation and blockchain tracking. In effect, the paradigm is shifting: the crime may be in accumulation as much as movement.

Comparisons with Other Crypto Crime Trends

Past headlines emphasized high-velocity activity: scams, hacks, ransomware. But this new analysis forces us to look at enduring holdings. Whereas active flows are episodic and traceable, static balances may represent the “bank vaults” of illicit actors.

While Bitcoin dominates in static holdings, stablecoins now dominate active illicit flows. Chainalysis indicates that in 2024, stablecoins accounted for 63 percent of illicit transaction volume. The data suggests a clear pattern: criminals stash their wealth in Bitcoin but rely on stable, liquid tokens for laundering and transfers.

2025 has already seen audacious thefts. Over $2.17 billion has been stolen from crypto services year to date, surpassing the full 2024 total. One of the largest single incidents is the $1.5 billion ByBit hack, attributed by authorities to North Korea’s Lazarus Group. Those types of flows contrast starkly with the stationary balances now revealed.

Criminal operations must juggle both fast flows and long game holdings. The static $75 billion figure may understate the real universe, as some addresses remain unidentified or beyond attribution.

Enforcement, Regulation, and Friction

Revealing these balances is one thing; recovering them is another.

• Legal processes across borders are slow and inconsistent.
• Wallets tied to innocent parties or mixed funds can complicate seizure.
• Criminals may preemptively split or disperse assets across jurisdictions.
• Some jurisdictions lack asset forfeiture laws robust enough to tackle crypto.

Mapping these holdings allows authorities and compliance teams to prioritize targets and trace exit routes. Exchanges and custodians may freeze inflows before laundering pathways fully mature.

Moreover, by focusing on static holdings, investigators can shift from chasing every small illicit flow toward targeting the vaults that underpin criminal power.

What About Markets and Policy?

Investors, compliance officers, and regulators must recalibrate their perspective. The size of the static illicit asset base reveals systemic scale. It invites questions about how much hidden risk is embedded in the crypto ecosystem.

Policymakers should view this as strong justification for stronger coordination. Cross-border cooperation, improved legal frameworks, and domain expertise in crypto asset investigation are vital. Industry firms must strengthen wallet analytics, freeze protocols, and “know your funds” tools.

For readers, the headline isn’t that illicit flows have overtaken legitimate activity; they have not.

The headline is that the criminal economy of crypto is holding and hoarding at scale, lurking beneath the surface.