The Growing Landscape of Seizable Crypto Assets: On-Chain Balances Linked to Criminal Activity Exceed $75 Billion

Key findings

Criminal balances

• Illicit entities maintain almost $15 billion in 2025, with stolen funds representing the most important class.
• Wallets downstream from these entities, outlined as those who obtained funds from illicit sources in extra of 10% of whole inflows, maintain over $60 billion — roughly 4 occasions the quantity held by illicit entities themselves.
• Darknet market directors and distributors alone management over $40 billion in on-chain worth.
• Bitcoin maintains dominance over different cryptocurrencies at 75% of whole illicit entity balances due to its enhance in worth over time, however stablecoins and ether have grown considerably.

Concentration and cash-out patterns

• Balances are normally extremely concentrated in just a few wallets.
• Illicit actors are quickly evolving their laundering methodologies and cash-out infrastructure, usually leveraging extra cashout addresses and utilizing them for shorter durations.
• Direct transfers from illicit entities to exchanges have collapsed from a quarterly worth of roughly 40% in 2021 – 2022 to round 15% in Q2 2025.

Enforcement timing insights

• Illicit entities differ considerably of their predicted lifespan, with market-based providers working the longest
• After illicit entities have stopped receiving worth on-chain, they have an inclination to empty any remaining balances at totally different speeds relying on whether or not they maintain BTC, ETH or stablecoins.

The seizable asset panorama

With the institution of a Strategic Bitcoin Reserve (SBR) and a Digital Assets Stockpile (DAS), the United States declared that it intends to add to its pool of digital capital via extra asset seizures. And certainly, the cryptocurrency ecosystem presents regulation enforcement with an unprecedented alternative: billions of {dollars} in illicit proceeds are sitting on public blockchains, and are theoretically seizable if authorities can coordinate action.

To date, Chainalysis has helped regulation enforcement companies worldwide seize greater than $12.6 billion in illicit funds via our knowledge, software program, and providers. Building on this confirmed monitor report of profitable seizures, we’ve carried out a complete evaluation of doubtlessly seizable belongings at present sitting on public blockchains.

Overall, our evaluation reveals a fancy panorama the place illicit actors maintain substantial balances. The report exhibits:

1. The scale of the belongings being held on-chain by illicit entities and downstream wallets;
2. The distribution of these balances throughout wallets and belongings, with implications for regulation enforcement goal choice;
3. The alternatives for seizures whereas illicit entities are nonetheless working or earlier than they’ve cashed out.

While our annual Crypto Crime Report focuses on transaction flows and the motion of illicit funds throughout the cryptocurrency ecosystem, this evaluation takes a special method by inspecting static balances — the precise cryptocurrency holdings sitting in wallets related to illicit exercise. This distinction is essential: move evaluation helps us perceive the amount and patterns of legal exercise, whereas stability evaluation reveals the gathered wealth that would doubtlessly be seized by regulation enforcement.

There are two necessary observations about how illicit cryptocurrency strikes throughout the blockchain. First, not all illicit exercise entails preserving massive quantities of cash in a single crypto pockets. Some entities, equivalent to cash laundering platforms, transfer cash rapidly from one place to one other with out holding onto it. Second, the full worth in cryptocurrency wallets will be closely influenced by modifications in worth, particularly for bitcoin. Given that bitcoin’s worth has grown from nearly nothing to tens of 1000’s of {dollars}, the full stability in wallets has elevated. This implies that wallets holding stablecoins haven’t skilled a dramatic appreciation over time.

Illicit entities: A $15 billion goal pool

As of July 2025, illicit entity balances of BTC, ETH, and stablecoins have reached nearly $15 billion. This represents a dramatic 359% surge from the comparatively modest balances noticed as lately as 2020.

Stolen funds dominate the stability panorama, representing the one largest class of illicit entity balances. While darknet markets and rip-off operators usually preserve decrease on-chain balances due to rapidly shifting funds to money out or distribute to distributors or rip-off runners, stolen fund operators usually maintain belongings whereas figuring out how to swap, launder, or liquidate the funds. It’s necessary to be aware that whereas scams and different illicit actions could have increased general transaction volumes, their decrease balances mirror their speedy fund motion patterns. Additionally, some refined crypto thieves, as exemplified by the current $1.5B DPRK hack of Bybit, have challenges shifting these massive quantities to off-ramps, given the volumes that want to be laundered, which may end up in bigger balances being held on-chain.

The knowledge additionally reveal a transparent correlation with market cycles. Balance accumulation in USD peaked beforehand in 2021 over the last main bull run, declined via the 2022 bear market, and surged once more all through 2024 to 2025 as costs recovered. Interestingly, not all cryptocurrencies observe the identical sample. While the quantity of bitcoin held by unlawful entities has decreased since 2020, ether and stablecoin holdings have been growing. However, regardless of this lower, bitcoin nonetheless represents the bulk of the full worth of these holdings as of the time of this writing, primarily as a result of of its important worth enhance over time.

The downstream $60 billion shadow financial system

Following funds downstream, we recognized a wider community of wallets linked to these illicit actions, which maintain balances of over $60 billion. This whole is roughly 4 occasions the quantity held instantly by the illicit entity wallets themselves.

Wallets downstream from darknet markets and scams maintain the bulk of the $60 billion stability. These sizable sums mirror elementary variations in how numerous illicit economies function.

Darknet markets, which facilitate transactions between consumers and sellers, naturally generate substantial wealth for his or her distributors and directors. In reality, these darknet market contributors alone management over $46.2 billion in on-chain worth, representing the one largest class of illicit downstream pockets holdings. This isn’t stunning, on condition that darknet markets have been among the many first to use cryptocurrency, beginning with Silk Road again in 2011. Many of these downstream pockets balances have benefited from years of speedy worth appreciation – and targets of successful seizures.

Additionally, some cash laundering platforms, such as Black U launderers, act as transit factors for funds, shifting worth via a spread of infrastructure factors, which implies that the full quantity of downstream pockets holdings might be even increased than this evaluation suggests.

Overall, the expansion charge of the balances held by these illicit downstream wallets is staggering. Darknet market admin and vendor wallets present a compound annual progress charge (CAGR) exceeding 200%, adopted intently by fraud retailers.

Exchange flows: A declining however persistent off-ramp

Centralized exchanges (CEXs) stay the popular alternative for criminals looking for to convert crypto to fiat, however how they do that is evolving quickly. When funds from a bootleg pockets are despatched to a CEX, they’re doubtlessly seizable if the CEX can establish and act on them. Chainalysis KYT is constructed to alert compliance groups in actual time when such funds arrive, enabling sooner intervention and potential seizure by regulation enforcement. To quantify this seizable whole, we will measure inflows to exchanges from all illicit sources. Overall, flows from illicit sources to CEXs neared $7B billion within the first half of 2025 and have averaged over $14 billion in inflows from illicit sources per yr since 2020.

Two different important developments emerge from the information. First, flows to exchanges are trending downward over time (notably into 2025), suggesting that illicit actors more and more acknowledge that crypto gives utility as a cost methodology and might act as a retailer of worth. Both utilities cut back the necessity to convert ill-gotten positive aspects into fiat currencies by way of exchanges.

Second, the share of direct transfers from illicit entities to exchanges has declined considerably over time. Starting from over 40% of flows in 2021 to 2022, direct transfers now characterize round 15% of illicit alternate deposits. This dramatic shift signifies that criminals have tailored to exchange compliance efforts by introducing extra layering steps between their operations and cash-out factors, such because the use of mixers and cross-chain bridges. Fortunately, investigators can use Reactor to clearly map cross-chain flows.

Where are balances being held?

Entities and actors behind differing kinds of illicit actions maintain their balances in numerous methods. In most illicit exercise classes (e.g. stolen funds, ransomware, and darknet markets), over 50% of balances are concentrated in a listing of prime three wallets. There are solely two exceptions: terrorist financing, which is usually distributed throughout a number of wallets, doubtlessly as a result of of its transient nature and funding mechanisms, and baby abuse materials, which lately noticed a major enhance in Chinese language CSAM vendors, making a extra regionalized CSAM ecosystem.

Asset sort provides one other dimension to focus patterns. Stablecoins constantly present much less focus than BTC or ETH throughout classes. This seemingly displays a level of threat administration by criminals — stablecoins will be frozen by centralized issuers if linked to illicit exercise, incentivizing criminals to unfold holdings throughout extra wallets to reduce potential losses from any single level of failure. Additionally, they could be incentivized to convert stablecoin balances both to fiat or different permissionless belongings, equivalent to bitcoin.

Illicit actor cashout infrastructure exhibits adaptive habits

When we have a look at cashout infrastructure, we see that criminals are evolving rapidly, seemingly to preserve tempo with enforcement strain. Our evaluation reveals that over time some criminals are distributing their funds throughout extra deposit addresses inside CEXs to money out, whereas others are shifting in the wrong way, relying an increasing number of closely on a concentrated money out infrastructure.

Overall, solely six classes present rising focus of their use of the highest 10 alternate deposit addresses. Darknet markets lead with 146% progress in focus, adopted by malware at 60% and scams at 44.8%. This means that these operations have recognized dependable cash-out routes. The concentrated use of deposit addresses seen in these classes may also be a downstream consequence of the focus of exercise inside the illicit entities themselves. For instance, the darknet market ecosystem is notoriously centralized, with one market (at present Kraken Darknet market) normally making up the bulk of transaction exercise on-chain.

Conversely, many classes of illicit exercise present important declines in deposit tackle focus since 2019. In our centralized alternate class, sanctioned entities present the steepest decline at -86%, adopted by stolen funds at -70%. These declines seemingly mirror each elevated enforcement consideration on these classes and improved alternate compliance applications flagging suspicious focus patterns and inflows from illicit sources.

The pattern towards deconcentration aligns with the decline in direct transfers famous earlier. Criminal operations will not be solely including layering steps to their laundering efforts, but in addition diversifying their cash-out infrastructure to keep away from detection and account closures.

Deposit tackle turnover accelerates

Perhaps no metric higher captures criminals’ adaptation to enforcement than the dramatic decline in deposit tackle reuse. Looking at cohorts of addresses by once they have been first used for illicit cash-outs reveals a putting sample.

For addresses first utilized in 2020, between 24% and 46% have been nonetheless getting used to money out illicit funds one yr later, with some variation relying on the asset. This comparatively high reuse charge means that illicit entities discovered steady cash-out infrastructure throughout this era and reused that infrastructure repeatedly. However, for more moderen cohorts, reuse charges have trended downward. The implication is that quite than re-using particular alternate accounts, legal cash-out infrastructure now turns over at a better charge than earlier than, doubtlessly in an effort to evade CEX compliance efforts.

The sample holds throughout all main belongings — bitcoin, ether, altcoins, and stablecoins — suggesting that this can be a systemic adaptation quite than an asset-specific phenomenon. For regulation enforcement, which means that the window for figuring out and freezing belongings at exchanges continues to slim, requiring sooner data sharing and response occasions, all of which will be facilitated by devoted compliance groups deploying automated alerting instruments. Chainalysis helps this effort via KYT, which permits real-time compliance alerts, and Reactor, which gives investigative instruments to hint and reply to illicit exercise extra successfully. Additionally, our group options inside these merchandise allow clients to share intelligence extra effectively.

Windows of Opportunity: Data-driven insights for asset seizure

Beyond understanding what criminals maintain, blockchain analysis gives distinctive insights into when enforcement actions may be doable. Below we talk about how lengthy regulation enforcement may find a way to count on illicit entities to function and the way lengthy these entities may take to money out their ill-gotten positive aspects after shutting down operations.

Operational lifecycles differ by crime sort

Understanding how lengthy illicit entities usually function gives essential context for enforcement timing. The longer a bootleg entity makes use of on-chain infrastructure, the bigger the concentrating on window for regulation enforcement. The chart beneath exhibits the big selection of predicted lifespans of illicit entities by class. In some classes, 50% of illicit entities are anticipated to reside on-chain for less than the identical day as their preliminary exercise. In different classes, the lifespan for 50% can attain as high as 959 days.

Episodic crimes, equivalent to stolen fund exercise or ransomware assaults, present the shortest lifespans with 50% of wallets receiving no extra inflows after the preliminary heist or use as a laundering waypoint. This displays the on-chain nature of these crimes, the place pockets infrastructure isn’t reused past the preliminary incident.

Market-based illicit entities present exceptional persistence. Darknet markets, on-line pharmacies, and fraud retailers generally function for 807 to 959 days, with 50% nonetheless lively throughout these time frames. These entities profit from community results and established reputations that incentivize longevity. The survival curves present gradual decline quite than sharp drops, suggesting that the entities inside these classes usually persist for longer durations till they both shut voluntarily, are shuttered by regulation enforcement, or exit rip-off with person funds.

Other classes, equivalent to terrorist financing operations, fall between these extremes, exhibiting 50% survival charges at 54 days. Relative to some of the market-based crimes famous above, this means short-lived efforts, usually ensuing from the high stage of consideration terror financing campaigns garner, and fast regulation enforcement actions to disrupt.

Post-operation liquidation velocity varies by asset and actor

We may also time stamp when illicit entities final obtained funds and calculate how lengthy it took to drain any balances that have been inherited on the time when the entity stopped utilizing its on-chain pockets infrastructure. After ceasing operations, illicit entities present markedly totally different behaviors, relying on which cryptocurrencies they maintain. As our evaluation reveals, stablecoins are liquidated with urgency — almost 95% of these belongings are drained inside simply 90 days after the final influx, with solely 29.5% of wallets sustaining any stablecoin stability after one yr.

Ethereum follows a extra measured sample, with roughly 87% of ETH holdings moved inside 90 days, although a major 35.6% of wallets retain ETH balances past the one-year mark. Most notably, bitcoin demonstrates distinctive endurance, with criminals shifting solely about 52% of their BTC inside the first 90 days, and 36.7% of wallets nonetheless sustaining bitcoin balances after a full yr.

These divergent liquidation velocities recommend that, whereas criminals deal with stablecoins as high-risk belongings requiring rapid conversion, they seem to view bitcoin — and to a lesser extent ether — as potential long-term worth shops, regardless of their traceability. For investigators, this creates a crucial however slim window of alternative for stablecoin restoration, whereas doubtlessly permitting a extra prolonged timeframe for pursuing bitcoin holdings.

Implications for regulation enforcement and coverage

The scale of seizable belongings — $15 billion in illicit entity balances and $60 billion in downstream wallets — presents a major alternative for asset restoration, albeit with distinct challenges. While centralized stablecoins will be frozen by issuers, confiscating BTC and different permissionless cryptocurrencies requires both acquiring personal keys or intercepting funds at centralized off-ramps.

To successfully seize these belongings, governments and authorities want complete methods together with:

• expedited seizure powers for time-critical investigations;
• sturdy cross-border cooperation frameworks and information-sharing agreements;
• and technical capability constructing with blockchain analytics instruments and specialised experience.

Without these components — clear authorized authority, streamlined worldwide cooperation, and funding in technical capabilities — the substantial restoration alternatives recognized on this analysis will stay largely unrealized.

Given this, Chainalysis acknowledges the rising want for a data-driven method to monitoring illicit funds and risk actors at scale. With finite sources, companies should give attention to probably the most impactful leads. Chainalysis Data Solutions, one of our fastest-growing choices, empowers organizations to analyze total risk landscapes, establish strategic alternatives, and prioritize actionable leads. Once leads are triaged, investigators can dive deeper in Reactor to hint funds and construct instances. In addition to our merchandise, leveraging our Global Services staff, which has supported regulation enforcement and authorities companions for years with hands-on asset seizure assist and professional investigative steerage, has yielded significant results.

Ready to converse to somebody at Chainalysis immediately about our knowledge capabilities? Request a demo here.

 

This web site comprises hyperlinks to third-party websites that aren’t below the management of Chainalysis, Inc. or its associates (collectively “Chainalysis”). Access to such data doesn’t suggest affiliation with, endorsement of, approval of, or advice by Chainalysis of the positioning or its operators, and Chainalysis is just not accountable for the merchandise, providers, or different content material hosted therein. 

This materials is for informational functions solely, and isn’t supposed to present authorized, tax, monetary, or funding recommendation. Recipients ought to seek the advice of their very own advisors earlier than making these varieties of choices. Chainalysis has no duty or legal responsibility for any resolution made or every other acts or omissions in reference to Recipient’s use of this materials.

Chainalysis doesn’t assure or warrant the accuracy, completeness, timeliness, suitability or validity of the data on this report and won’t be accountable for any declare attributable to errors, omissions, or different inaccuracies of any half of such materials.

The submit The Growing Landscape of Seizable Crypto Assets: On-Chain Balances Linked to Criminal Activity Exceed $75 Billion appeared first on Chainalysis.