An in-depth report published this week by TRM Labs which analyzed the flow of funds deemed “illicit” across 20 different blockchains suggests that the amount of money being spent in darknet markets did not diminish in 2022 along with coin prices in the ongoing “crypto winter.” The report also found that Bitcoin is no longer the dominant coin for illicit crypto transactions, which include transactions related to 40 types of criminal activity, such as dark web commerce, fraud, scams, theft, terrorist financing, and money laundering.
TRM’s analysis found that darknet markets accounted for about $1.5 billion in crypto transactions in 2022, while Ponzi or pyramid schemes totaled $7.8 billion, and hacks and exploits totaled $3.7 billion. In what is referred to as “a new multi-chain reality,” the report details the transition in cybercrime crypto transactions away from Bitcoin to Ethereum, BSC, and even TRON.
Chart detailing the flow of darknet market vendor funds to two crypto exchanges. Source: TRM Labs
Unlike most other forms of criminal activity noted in the report, darknet market transactions still remain dominated by Bitcoin, which the authors say is due to the fact that most Russian-language markets – accounting for over 80% of all DNM volume worldwide – support only Bitcoin as a payment option.
“The collapse in cooperation between Russia and the West on cybercrime matters since the start of the Ukraine war has created the perception among criminals that Russian-language DNMs have become a safe-haven from US and European law enforcement. As such, a wide range of criminals… have been observed depositing cryptocurrency to DNMs in order to obscure their original source: once crypto funds are withdrawn from DNM’s escrow accounts, they are no longer the same coins as those originally deposited.” – TRM Labs
The report also noted a strong relationship between darknet markets and largely-unregulated cryptocurrency exchanges that have light or non-existent KYC requirements. Such exchanges include “parasite VASPS,” which use the infrastructure of bigger exchanges to perform coin swaps on behalf of their customers, and “high-risk VASPS,” which are exchanges headquartered in jurisdictions with “lax compliance controls” or “weak regulatory oversight.” TRM Labs claims to have tracked over 500 high-risk exchanges in 2022, through “tens of billions of dollars” in crypto transactions have been processed.
Also explored in the report was the use of mixers to launder darknet market proceeds, the impact of sanctions of “high-risk VASPS” on darknet markets, and the role of cryptocurrency in human trafficking, terrorist funding, and contract killings.