March 8, 2023 By Jonathan Reed 4 min read

Cryptocurrency crime is flourishing, according to multiple year-end reports. For starters, cryptocurrency losses due to cyber theft rose to $3.7 billion last year. That’s a 58% increase over the $2.3 billion malicious actors stole from investors and exchanges in 2021, according to a new report by Immunefi.

Meanwhile, illicit cryptocurrency activity reached an all-time high of $20.1 billion in 2022, a $2.1 billion increase from the previous year. The escalating U.S. sanctions targeting digital currencies have contributed to that rise, as per a recent report released by Chainalysis.

These two reports reflect different aspects of cryptocurrency-related crime. On the one hand, you have criminals stealing crypto funds. On the other, criminals can use cryptocurrency to anonymously fund illicit activities. Across the board, nefarious businesses are booming.

Cryptocurrency theft continues to rise

According to Immunefi, 95% of all cryptocurrency theft stems from hacking incidents. The remaining losses were a result of fraud and other scams. In 2022, researchers tracked a total of 134 hacking cases, a major increase from the 104 incidents recorded in 2021.

Analysts had been tracking the growing wave of hacking attempts on digital currencies as the year progressed. In fact, Chainalysis proclaimed October 2022 as “the biggest month in the biggest year ever for hacking activity,” with the total cryptocurrency stolen reaching $718 million. By October, hackers had already amassed a total of $3 billion from 125 successful hacks.

One of the worst incidents in 2022 was the theft of $625 million worth of assets from Ronin Bridge, a platform that enables currency movement between blockchains. The U.S. government later identified the perpetrators of this attack as a North Korean group. The incident underscored growing national security concerns about weaknesses in the crypto industry. Similarly, blockchain analytics firm Elliptic also linked North Korean attackers to the $100 million Horizon Bridge heist in June.

“Two years ago, I wouldn’t even think about some hacker reaching over $100 million,” said Adrian Hetman, tech lead at Immunefi. “But in the last two years, we’ve seen multiple cases like that.”

An overview of cryptocurrency-related crime

Criminals don’t only steal cryptocurrency — they also use it to fund illicit activity. As a response to this ongoing problem, the U.S. government has become more assertive in curbing illegal activities by imposing sanctions on entities and individuals. Chainalysis reported that almost 44% of the $20 billion in illicit transactions can be traced back to sanctioned entities.

The report classified a wide range of activities as illicit, including transactions linked to child sexual abuse materials, human trafficking, ransomware, stolen funds, terrorism financing, scams, cyber criminal administrators and dark net markets.

Despite the U.S. government’s efforts, the effectiveness of these sanctions has been mixed. Chainalysis found that the impact of OFAC sanctions has been uneven. For instance, inflows to Tornado Cash decreased significantly after it was sanctioned. But transactions on the Russian exchange Garantex — sanctioned for its role in money laundering — grew significantly, as per CyberScoop. Meanwhile, transactions on the sanctioned Hydra Marketplace dark web market dropped to zero. Notably, German police also seized Hydra’s infrastructure.

For perspective, illicit activity occupies a tiny, but growing, percentage of overall cryptocurrency activity. Only 0.24% of all cryptocurrency transactions in 2022 were tied to illicit activity. This was up from 0.12% in 2021, according to Chainalysis.

Government response to rising cryptocurrency crime

In response to these incidents, the Treasury Department continues to take action, such as the sanctions on Tornado Cash in August. Also, in September, the Justice Department’s National Cryptocurrency Enforcement Team established a nationwide network of federal prosecutors dedicated to tackling the illegal use of digital assets.

Meanwhile, the White House recently released its “Comprehensive Framework for Responsible Development of Digital Assets.” Part of the Framework’s focus is on enhanced measures to fight illicit finance. For example, the U.S. government will evaluate whether to call upon Congress to amend the Bank Secrecy Act (BSA), anti-tip-off statutes and laws against unlicensed money transmitting. These measures could apply explicitly to digital asset service providers — including digital asset exchanges and nonfungible token (NFT) platforms.

The White House’s Framework also suggests raising penalties for unlicensed money transmitting to match the penalties for similar crimes under other money-laundering statutes. Plus, there could be a push for the DOJ to prosecute digital asset crimes in any jurisdiction where a victim of those crimes is found.

Industry response to rising cryptocurrency crime

The private sector is also stepping up its efforts to combat cryptocurrency-related crime. For example, in 2022, companies specializing in auditing code for cryptocurrency projects saw a surge in business. Immunefi reported that cryptocurrency bounty payments through its platform increased from $13 million in 2021 to over $52 million in 2022. This shows that organizations are becoming more proactive in identifying and addressing vulnerabilities in their systems.

Then there’s Tigran Gambaryan, Global Head of Intelligence and Investigations at Binance. Before coming to Binance, Gambaryan was a Special Agent at the Internal Revenue Service-Criminal Investigation (IRS-CI) Cyber Crimes Unit for over a decade. In a recent post, the former U.S. agent stated that in 2022 Binance:

  • Responded to over 47,000 law enforcement requests
  • Increased security and compliance headcount by more than 500%
  • Participated in over 70 anti-cyber crime workshops with global law enforcement
  • Became the first blockchain and crypto company to join the National Cyber-Forensics and Training Alliance (NCFTA).

Binance’s Global Law Enforcement Training Program helps law enforcement and prosecutors across the world detect financial cyber crimes. They also assist in the prosecution of bad actors. During 2022, the program shared its insider knowledge and expertise in more than 70 workshops and training sessions with law enforcement and prosecutors across the globe.

The IRS steps in

The IRS is also looking to collaborate with cryptocurrency firms to combat crime in the industry. According to The Wall Street Journal, a top IRS official stated that the agency wants to work more closely with crypto companies.

Thomas Fattorusso, a special agent in charge of the IRS’s New York field office, said that the criminal investigations unit of the IRS is recruiting more personnel to this end. He emphasized that the IRS does not view the asset class as hostile. And the IRS aims to establish a mutually beneficial relationship with crypto companies.

Not long ago, one of the main drivers for cryptocurrency was to avoid government oversight. Time will only tell if this kind of synergy comes to fruition.

More from News

CISA Malware Next-Gen Analysis now available to public sector

2 min read - One of the main goals of the Cybersecurity and Infrastructure Security Agency (CISA) is to promote security collaboration across the public and private sectors. CISA firmly believes that partnerships and effective coordination are essential to maintaining critical infrastructure security and cyber resilience.In faithfulness to this mission, CISA is now offering the Malware Next-Generation Analysis program to businesses and other organizations. This service has been available to government and military workers since November 2023 but is now available to the private…

Change Healthcare attack expected to exceed $1 billion in costs

3 min read - The impact of the recent Change Healthcare cyberattack is unprecedented — and so are the costs. Rick Pollack, President and CEO of the American Hospital Association, stated, “The Change Healthcare cyberattack is the most significant and consequential incident of its kind against the U.S. healthcare system in history.”In a recent earnings call, UnitedHealth Group, the parent company of Change Healthcare, speculated on the overall data breach costs. When all is said and done, the total tally may reach $1 billion…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today