Chainalysis maps $75b illicit crypto hidden in plain sight
Chainalysis has pinpointed a massive $75 billion in criminal cryptocurrency sitting untouched in publicly viewable wallets. The findings reveal a vast digital treasure trove that remains theoretically seizable by global law enforcement agencies.
Summary
- Chainalysis reveals $75 billion in illicit crypto held in public wallets, mostly tied to stolen funds and darknet markets.
- Bitcoin accounts for 75% of all criminal balances, as hackers increasingly treat it as a store of value.
- Direct transfers to exchanges have dropped to 15%, signaling a shift toward mixers and cross-chain bridges to evade detection.
In a report dated Oct. 9, blockchain analytics firm Chainalysis published a groundbreaking analysis of static on-chain balances, revealing that illicit entities and their downstream networks collectively control over $75 billion in cryptocurrency.
The study distinguishes between wallets directly linked to criminal activity, which hold nearly $15 billion, and the sprawling ecosystem of downstream wallets that have received significant portions of illicit funds, holding the remaining $60 billion.
Criminal balances surge as Bitcoin retains its grip on illicit finance
According to the report, the combined balance of Bitcoin, Ethereum, and stablecoins held directly by illicit entities has surged by 359% since 2020, reaching nearly $15 billion as of July 2025. Stolen funds dominate this landscape, representing the single largest category.
Chainalysis suggests that while scammers and darknet markets move money quickly, hackers often face operational challenges in laundering such large volumes, forcing them to hold assets on-chain for longer periods. Recent mega-hacks, such as the $1.5 billion Bybit theft linked to North Korea, illustrate the difficulty of off-ramping large sums without drawing attention.
The report also shines a light on the sprawling downstream network of wallets connected to illicit actors, which collectively hold over $60 billion in crypto, roughly four times the value stored in the primary illicit wallets themselves.
Darknet market administrators and vendors alone control a colossal $46.2 billion, a testament to the long-term, lucrative nature of these marketplaces that have operated since the Silk Road era. According to Chainalysis, this downstream total could be even higher, as money laundering platforms acting as transit points can obscure the full trail of funds.
Illicit actors prefer holding Bitcoin
Bitcoin remains the criminal asset of choice, accounting for 75% of all illicit entity balances. Its dominance is largely attributed to its significant price appreciation over time, which has massively inflated the value of balances held in older wallets.
Criminals also appear to treat Bitcoin as a long-term store of value; the report found that over a third of illicit BTC wallets still hold balances a full year after their last transaction. In contrast, stablecoins show less concentration across wallets, likely because criminals recognize they can be frozen by centralized issuers and therefore spread their risk.
The Chainalysis report further highlights a significant shift in how criminals are cashing out, with direct transfers from illicit entities to centralized exchanges falling from over 40% to around 15%. This indicates a major shift toward using mixers and cross-chain bridges for obfuscation.
For law enforcement, these behavioral changes complicate the timing and execution of asset recovery operations. Yet the transparency of blockchain still presents a rare advantage. Chainalysis said that its data has already helped authorities seize more than $12.6 billion in illicit funds worldwide.
