March 8, 2023 By Jonathan Reed 4 min read

Cryptocurrency crime is flourishing, according to multiple year-end reports. For starters, cryptocurrency losses due to cyber theft rose to $3.7 billion last year. That’s a 58% increase over the $2.3 billion malicious actors stole from investors and exchanges in 2021, according to a new report by Immunefi.

Meanwhile, illicit cryptocurrency activity reached an all-time high of $20.1 billion in 2022, a $2.1 billion increase from the previous year. The escalating U.S. sanctions targeting digital currencies have contributed to that rise, as per a recent report released by Chainalysis.

These two reports reflect different aspects of cryptocurrency-related crime. On the one hand, you have criminals stealing crypto funds. On the other, criminals can use cryptocurrency to anonymously fund illicit activities. Across the board, nefarious businesses are booming.

Cryptocurrency theft continues to rise

According to Immunefi, 95% of all cryptocurrency theft stems from hacking incidents. The remaining losses were a result of fraud and other scams. In 2022, researchers tracked a total of 134 hacking cases, a major increase from the 104 incidents recorded in 2021.

Analysts had been tracking the growing wave of hacking attempts on digital currencies as the year progressed. In fact, Chainalysis proclaimed October 2022 as “the biggest month in the biggest year ever for hacking activity,” with the total cryptocurrency stolen reaching $718 million. By October, hackers had already amassed a total of $3 billion from 125 successful hacks.

One of the worst incidents in 2022 was the theft of $625 million worth of assets from Ronin Bridge, a platform that enables currency movement between blockchains. The U.S. government later identified the perpetrators of this attack as a North Korean group. The incident underscored growing national security concerns about weaknesses in the crypto industry. Similarly, blockchain analytics firm Elliptic also linked North Korean attackers to the $100 million Horizon Bridge heist in June.

“Two years ago, I wouldn’t even think about some hacker reaching over $100 million,” said Adrian Hetman, tech lead at Immunefi. “But in the last two years, we’ve seen multiple cases like that.”

An overview of cryptocurrency-related crime

Criminals don’t only steal cryptocurrency — they also use it to fund illicit activity. As a response to this ongoing problem, the U.S. government has become more assertive in curbing illegal activities by imposing sanctions on entities and individuals. Chainalysis reported that almost 44% of the $20 billion in illicit transactions can be traced back to sanctioned entities.

The report classified a wide range of activities as illicit, including transactions linked to child sexual abuse materials, human trafficking, ransomware, stolen funds, terrorism financing, scams, cyber criminal administrators and dark net markets.

Despite the U.S. government’s efforts, the effectiveness of these sanctions has been mixed. Chainalysis found that the impact of OFAC sanctions has been uneven. For instance, inflows to Tornado Cash decreased significantly after it was sanctioned. But transactions on the Russian exchange Garantex — sanctioned for its role in money laundering — grew significantly, as per CyberScoop. Meanwhile, transactions on the sanctioned Hydra Marketplace dark web market dropped to zero. Notably, German police also seized Hydra’s infrastructure.

For perspective, illicit activity occupies a tiny, but growing, percentage of overall cryptocurrency activity. Only 0.24% of all cryptocurrency transactions in 2022 were tied to illicit activity. This was up from 0.12% in 2021, according to Chainalysis.

Government response to rising cryptocurrency crime

In response to these incidents, the Treasury Department continues to take action, such as the sanctions on Tornado Cash in August. Also, in September, the Justice Department’s National Cryptocurrency Enforcement Team established a nationwide network of federal prosecutors dedicated to tackling the illegal use of digital assets.

Meanwhile, the White House recently released its “Comprehensive Framework for Responsible Development of Digital Assets.” Part of the Framework’s focus is on enhanced measures to fight illicit finance. For example, the U.S. government will evaluate whether to call upon Congress to amend the Bank Secrecy Act (BSA), anti-tip-off statutes and laws against unlicensed money transmitting. These measures could apply explicitly to digital asset service providers — including digital asset exchanges and nonfungible token (NFT) platforms.

The White House’s Framework also suggests raising penalties for unlicensed money transmitting to match the penalties for similar crimes under other money-laundering statutes. Plus, there could be a push for the DOJ to prosecute digital asset crimes in any jurisdiction where a victim of those crimes is found.

Industry response to rising cryptocurrency crime

The private sector is also stepping up its efforts to combat cryptocurrency-related crime. For example, in 2022, companies specializing in auditing code for cryptocurrency projects saw a surge in business. Immunefi reported that cryptocurrency bounty payments through its platform increased from $13 million in 2021 to over $52 million in 2022. This shows that organizations are becoming more proactive in identifying and addressing vulnerabilities in their systems.

Then there’s Tigran Gambaryan, Global Head of Intelligence and Investigations at Binance. Before coming to Binance, Gambaryan was a Special Agent at the Internal Revenue Service-Criminal Investigation (IRS-CI) Cyber Crimes Unit for over a decade. In a recent post, the former U.S. agent stated that in 2022 Binance:

  • Responded to over 47,000 law enforcement requests
  • Increased security and compliance headcount by more than 500%
  • Participated in over 70 anti-cyber crime workshops with global law enforcement
  • Became the first blockchain and crypto company to join the National Cyber-Forensics and Training Alliance (NCFTA).

Binance’s Global Law Enforcement Training Program helps law enforcement and prosecutors across the world detect financial cyber crimes. They also assist in the prosecution of bad actors. During 2022, the program shared its insider knowledge and expertise in more than 70 workshops and training sessions with law enforcement and prosecutors across the globe.

The IRS steps in

The IRS is also looking to collaborate with cryptocurrency firms to combat crime in the industry. According to The Wall Street Journal, a top IRS official stated that the agency wants to work more closely with crypto companies.

Thomas Fattorusso, a special agent in charge of the IRS’s New York field office, said that the criminal investigations unit of the IRS is recruiting more personnel to this end. He emphasized that the IRS does not view the asset class as hostile. And the IRS aims to establish a mutually beneficial relationship with crypto companies.

Not long ago, one of the main drivers for cryptocurrency was to avoid government oversight. Time will only tell if this kind of synergy comes to fruition.

More from News

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

CISA and FBI release secure by design alert on cross-site scripting 

3 min read - CISA and the FBI are increasingly focusing on proactive cybersecurity and cyber resilience measures. Conjointly, the agencies recently released a new Secure by Design alert aimed at eliminating cross-site Scripting (XSS) vulnerabilities, which have long been exploited to compromise both data and user trust. Cross-site scripting vulnerabilities occur when a web application improperly handles user input, allowing attackers to inject malicious scripts into web pages that are then executed by unsuspecting users. These vulnerabilities are dangerous because they don't attack…

Has BlackCat returned as Cicada3301? Maybe.

4 min read - In 2022, BlackCat ransomware (also known as ALPHV) was among the top malware types tracked by IBM X-Force. The following year, the threat actor group added new tools and tactics to enhance BlackCat's impact. The effort paid off — literally. In March 2024, BlackCat successfully compromised Change Healthcare and received a ransom payment of $22 million in Bitcoin. But here's where things get weird: Immediately after taking payment, BlackCat closed its doors, citing "the feds" as the reason for the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today