Retail and institutional interest in crypto may have dropped amid a plunge in the asset class last year, but the value of criminal activity in digital assets rose to a record high in 2022.
Illicit crypto wallets received $20.1 billion in crypto assets last year, Chainalysis found, double the prior year’s share as a portion of total crypto volume.
This amount still accounts for less than 1% of total crypto activity. Last year’s surge is due mostly to the rise of sanctioned crypto addressed.
As a share of total crypto activity, criminal flows made up 0.24% of all crypto transactions in 2022, up from last year’s revised reading of 0.12%, the lowest reading as a portion of crypto flows in last six years. Still, the total value of crypto received due to criminal activity has risen each year since 2020.
“In spite of it being an all time high for criminal activity, a lot of crimes are down. Scamming and ransomware are down, but hacks and sanctions are not,” Kim Grauer, Chainalysis’ head of research, told.
Despite the downturn in cryptocurrency prices — which led to shrinking illicit volumes for most crypto crime including scams and darknet market flow — transactions to and from sanctioned wallet addresses grew sharply, accounting for 44% of the year’s criminal activity.
While crypto addresses have been sanctioned in past years, the pace of sanction designations by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) grew rapidly following the outbreak of the Russia-Ukraine war.
“This was the year OFAC leaned in and started using crypto sanctions as a tool to stop some of this activity,” said Grauer.
The majority of those illicit volumes came from Garantex, a little-known crypto exchange sanctioned by the U.S. Treasury Department in April of last year. This business, which operated out of Federation Tower in Moscow as of the day Treasury imposed penalties, accounted for the majority of sanctions-related crypto volumes.
Other notable sanctioned addresses included those belonging to North Korea’s hacking team Lazarus Group, as well as the privacy software Tornado Cash. Since OFAC first started including crypto addresses in sanction designations in 2018, it has only sanctioned ten different crypto-related entities.
However, starting in 2021, OFAC began designating entire crypto services instead of individuals. The outcome has led to a tripling in the number of sanctioned crypto addresses over the past year.
“I think we as an industry need to think about what’s the implication of all the sanctioning activity and what’s going to happen next year,” Grauer added.
By comparison, illicit transactions for all other crypto-related crime fell on a year-over-year basis with the exception of stolen funds from hacks, which increased 7% to over $3 billion.
Chainalysis did note two key stipulations to their illicit crypto transaction data which could lead to future revisions of the findings.
First, the company can’t capture criminal proceeds from non-crypto crime, such as drug trafficking that can be laundered through crypto but not traced without further investigation, according to Grauer.
Second, the firm also chooses not to count current pending fraud cases.
This excludes the up to $7 billion that former FTX CEO Sam Bankman-Fried is alleged to have taken from FTX customers. Chainalysis’ figures also don’t count the $1.2 billion in missing funds from Celsius Network as of its July bankruptcy petition.
“It’s not our place to call these [cases] definitive crimes or not,” said Grauer, who added the company routinely releases studies related to such cases that showcase where crimes could have been committed.