An estimated $75 billion in cryptocurrency linked to criminal activity remains visible and traceable on public blockchains, according to a Binance Research report published May 15, 2026. The figure, corroborated by Chainalysis and TRM Labs data, represents a 28% increase from 2024 levels — not be...
"The ledger remembers every hop. Traceability doesn't stop at the first wallet. It follows the money indefinitely." — Binance Research, May 2026 Key Trends Report
An estimated $75 billion in cryptocurrency linked to criminal activity remains visible and traceable on public blockchains, according to a Binance Research report published May 15, 2026. The figure, corroborated by Chainalysis and TRM Labs data, represents a 28% increase from 2024 levels — not because more crime is occurring as a share of total activity, but because less of it is being successfully laundered.
The illicit share of total on-chain transaction volume remains below 1%, according to all three analytics providers. The apparent paradox — rising absolute dollar balances alongside a shrinking proportional footprint — reflects two concurrent dynamics: the overall crypto market has grown faster than criminal adoption, and the compliance infrastructure surrounding blockchain networks has tightened to the point where laundering bottlenecks now exceed 100 days for large-scale operations.
This report examines the data behind the $75 billion figure, the mechanics constraining laundering capacity, the role of stablecoin issuers as de facto compliance enforcement agents, and the implications for the broader crypto ecosystem's risk profile.
Binance Research's May 2026 report estimates that wallets linked directly or indirectly to criminal activity held over $75 billion in crypto assets as of year-end 2025. Of that total, more than $40 billion is attributed to darknet market operators and vendors. The remaining balance is distributed across hacking proceeds, sanctions evasion wallets, scam operations, and ransomware-linked addresses.
The 28% year-over-year increase in trapped criminal balances occurred despite no corresponding increase in the illicit share of total transaction volume. The mechanism is straightforward: as off-ramp compliance tightens — exchange KYC requirements, stablecoin freezing capabilities, and analytics-driven KYT (Know Your Transaction) screening — criminal actors face greater difficulty converting crypto holdings to fiat currency. The assets accumulate on-chain rather than exiting the system.
Over 80% of illicit funds have moved beyond their original crime-linked wallet addresses, according to the Binance report. Every transfer, however, remains permanently recorded on-chain, creating a forensic trail that does not degrade over time.
The Binance Research report identifies a fundamental capacity constraint in crypto laundering infrastructure. Combined daily volume across major privacy tools — including Wasabi Wallet, CryptoMixer, and similar services — averages approximately $10 million. At that throughput, fully obscuring $1 billion in stolen funds through mixer services alone would require more than 100 days.
This bottleneck is structural, not temporary. Privacy tools operate within capacity limits dictated by their liquidity pools and user bases. Unlike traditional money laundering through shell companies or real estate — which can process large sums in parallel — mixer-based obfuscation is serial and bandwidth-constrained.
The March 2026 policy shift by the U.S. Treasury, which acknowledged that crypto mixers can serve legitimate privacy purposes while still raising law-enforcement concerns, has not materially expanded mixer throughput. The technical bottleneck remains regardless of regulatory posture.
The Tornado Cash sanctions were lifted in March 2025 following a federal appeals court ruling that OFAC could not sanction immutable smart contracts under the International Emergency Economic Powers Act. However, Roman Storm, a Tornado Cash co-founder, was convicted in August 2025 of operating an unlicensed money-transmitting business, and federal prosecutors filed for a retrial on unresolved counts in March 2026. The legal ambiguity surrounding mixer operations continues to suppress developer participation in the space.
Stablecoin issuers have emerged as a de facto enforcement layer within the crypto ecosystem. The data is significant:
The 30:1 ratio in freezing activity between Tether and Circle reflects different compliance philosophies, but the combined effect creates a meaningful deterrent. Stablecoins now account for roughly 84% of all illicit transaction volumes, according to Chainalysis. The ability of centralized issuers to freeze assets mid-transfer introduces a compliance checkpoint that did not exist in earlier Bitcoin-dominated criminal infrastructure.
Tron dominates enforcement activity — of Tether's 370 recent blacklisted addresses, 328 were on Tron — a finding consistent with the network's disproportionate use in illicit stablecoin transfers, particularly in Southeast Asian fraud operations.
Binance Research identifies four primary mechanisms that have progressively tightened around illicit crypto flows:
These layers operate independently but compound in effect. A criminal actor who evades KYT screening at one exchange may still be blocked at another, or have stablecoins frozen by the issuer, or face direct seizure through law enforcement coordination.
Binance separately reported that its AI-powered security systems prevented an estimated $10.5 billion in potential user losses from fraud and phishing between January 2025 and March 2026. In Q1 2026 alone, the exchange claims to have intercepted 22.9 million scam attempts, safeguarding $1.98 billion. AI-driven decisioning now powers 57% of Binance's fraud controls.
The three major blockchain analytics providers present broadly consistent but methodologically distinct pictures:
| Metric | Binance Research | Chainalysis | TRM Labs | |--------|-----------------|-------------|----------| | Illicit balances on-chain | $75B+ | ~$75B (Oct 2025) | Not reported as stock | | Illicit volume received (2025) | Not reported as flow | $154B | $158B | | Illicit share of total volume | <1% | <1% | 1.2% (down from 1.3%) | | Primary driver of increase | Tighter off-ramps | Sanctions (694% surge) | Russia-linked (400% surge) |
The divergence between the "stock" figure ($75 billion in trapped balances) and the "flow" figures ($154–158 billion in annual illicit volume) reflects the distinction between cumulative trapped assets and annual throughput. TRM Labs introduced a new metric in 2026 framing illicit activity as a share of VASP outflows rather than total on-chain volume. Under this measure, illicit entities siphoned 2.7% of available crypto liquidity — higher than the headline <1% figure but still representing a minority of flows.
Chainalysis attributed the surge in 2025 illicit volume largely to sanctions evasion, which grew 694% year-over-year, driven primarily by Russia-linked networks. Russia's ruble-backed A7A5 token, launched in February 2025, transacted over $93.3 billion in under a year. Iran-aligned organizations, including Hezbollah, Hamas, and the Houthis, used cryptocurrency at previously unobserved scales, according to Chainalysis.
DPRK-linked hackers stole approximately $2 billion in 2025, including the $1.5 billion Bybit exploit — the largest single digital heist in crypto history.
Bitcoin accounts for approximately 75% of illicit balances held on-chain, according to the Binance report. However, stablecoins have overtaken Bitcoin in terms of transaction flow, now comprising 84% of illicit transaction volumes per Chainalysis data.
This divergence is notable. Criminal operators increasingly transact in stablecoins for their dollar-denominated stability and liquidity, but accumulated holdings remain disproportionately in Bitcoin — likely reflecting legacy holdings from earlier darknet market activity and the difficulty of liquidating large Bitcoin positions through tightened off-ramps.
Bitcoin's share of illicit transaction flows has dropped to approximately 7%, according to BanklessTimes reporting on the Binance data. The shift toward stablecoins creates a structural vulnerability for criminal actors: unlike Bitcoin, stablecoins can be unilaterally frozen by issuers, introducing counterparty risk into criminal financial operations.
Law enforcement seizures of cryptocurrency totaled $2.4 billion in 2024, a 17% increase from the prior year. Chainalysis reported that it has assisted law enforcement partners with the seizure and freezing of approximately $34 billion worth of cryptocurrency cumulatively through year-end 2025.
The FBI's Operation Level Up prevented an estimated $562 million in losses as of April 2026 by notifying nearly 9,000 potential victims before they could be defrauded. A coordinated international operation involving the FBI, Dubai Police Department, and Chinese Ministry of Public Security resulted in at least 276 arrests and the dismantlement of nine scam centers.
In October 2025, the DOJ executed the largest digital asset seizure on record — 127,217 BTC worth approximately $15 billion. The U.S. Secret Service, Tether, and Coinbase collaborated to freeze approximately $225 million in USDT from a Southeast Asian pig-butchering network.
The data carries implications for institutional risk assessment. The sub-1% illicit transaction share provides a quantitative counterpoint to the perception that crypto networks are primarily vehicles for criminal activity. For institutions evaluating crypto exposure under compliance frameworks — banks considering stablecoin reserve management, asset managers integrating digital assets into portfolios — the declining proportional illicit footprint is a relevant risk metric.
The growing enforcement capability of stablecoin issuers also introduces a compliance primitive that maps, imperfectly but recognizably, to the SWIFT messaging controls and correspondent banking restrictions that traditional financial institutions rely upon. Tether's $3.29 billion in cumulative freezes and 7,268 blacklisted addresses represent a level of asset-level control that did not exist five years ago.
The risk that remains is concentrated: state-sponsored actors (DPRK, Russia-linked networks, Iran-aligned groups) represent a disproportionate share of illicit volume growth. This is a geopolitical risk vector rather than a systemic crypto infrastructure failure.
The $75 billion in illicit crypto trapped on public blockchains represents a paradox for the industry. The absolute figure is large enough to sustain regulatory concern, but the proportional share — below 1% of total activity — is lower than comparable estimates for traditional financial systems, where the UN estimates 2–5% of global GDP is laundered annually.
The data suggests that blockchain transparency is functioning as designed: not preventing crime, but making it increasingly difficult to profit from. The permanent, public nature of on-chain records, combined with the tightening compliance stack at exchanges and stablecoin issuers, has created a system where criminal assets accumulate rather than exit. The ledger, as Binance Research states, remembers every hop.
For institutional participants, the declining laundering success rate is a structural feature, not a temporary condition. The enforcement toolkit is expanding — AI-driven screening, stablecoin freezing, cross-border coordination — while the laundering infrastructure remains bandwidth-constrained. Whether this asymmetry continues to widen depends on the regulatory frameworks now being written in Washington, Brussels, and Singapore. The data, for now, favors the compliance side.