Cryptocurrency and Crime - Cyber Criminology

Cryptocurrency and crime examines the multifaceted relationship between blockchain-based digital currencies and criminal activity — encompassing the use of cryptocurrency as a payment mechanism for illicit transactions, as a target of theft and fraud, as a medium for money laundering, and as the financial infrastructure of the broader cybercrime ecosystem. Within Cyber Criminology, cryptocurrency has become central to the study and investigation of digital crime because virtual currencies provide the payment rails on which dark web marketplaces, ransomware operations, and online fraud schemes depend, while simultaneously generating the public transaction records that enable blockchain analysis and law enforcement tracing of criminal financial flows. Chainalysis (2024) estimated that illicit cryptocurrency transaction volume reached $24.2 billion in 2023, representing approximately 0.34 percent of total on-chain transaction volume — a figure that captures identified illicit activity and that the actual volume almost certainly exceeds. This article examines the role of cryptocurrency in criminal activity, the investigative and regulatory response, and the policy challenges that decentralized digital currencies create within the broader field of Criminology.

Introduction

The emergence of Bitcoin in 2009 — the first decentralized, peer-to-peer digital currency operating without a central authority — created a payment mechanism whose properties of pseudonymity, borderlessness, irreversibility, and resistance to seizure made it attractive for criminal transactions alongside its legitimate uses (Nakamoto, 2008). The Silk Road marketplace, launched in 2011, demonstrated the viability of cryptocurrency as a payment mechanism for illicit commerce, and the subsequent development of thousands of additional cryptocurrencies, decentralized finance (DeFi) protocols, and blockchain-based financial services has expanded both the legitimate and criminal applications of digital currency technology (Foley, Karlsen, & Putniņš, 2019).

The criminological significance of cryptocurrency extends beyond its use as criminal payment infrastructure. Cryptocurrency has generated entirely new categories of crime — smart contract exploits, DeFi protocol attacks, token fraud, exchange hacks — that have no pre-digital analogues. It has transformed existing crime categories — ransomware was a marginal threat before cryptocurrency enabled anonymous ransom collection; money laundering has been partially reconstructed around cryptocurrency conversion and mixing services. And it has created investigative opportunities — the permanent, public record of blockchain transactions enables analytical tracing that, under favorable conditions, can follow criminal funds from initial receipt through complex laundering chains to eventual conversion to fiat currency (Meiklejohn, Pomarole, Jordan, Levchenko, McCoy, Voelker, & Savage, 2013).

Cryptocurrency as Criminal Payment Infrastructure

Dark Web Commerce and Drug Markets

Cryptocurrency serves as the exclusive payment mechanism for dark web marketplaces, providing the pseudonymous transaction capability that enables buyers and sellers to exchange value without revealing their identities through traditional financial intermediaries. Bitcoin was the original currency of dark web commerce, adopted by Silk Road and its successors because its decentralized architecture eliminated the need for a trusted financial institution that could be compelled to disclose transaction records or freeze funds. The growth of dark web commerce has tracked the development of cryptocurrency markets: Christin’s (2013) measurement study of Silk Road estimated monthly revenues of approximately $1.2 million in 2012; by the time AlphaBay was seized in 2017, the platform was estimated to process hundreds of millions of dollars in annual transactions across multiple cryptocurrency types (Federal Bureau of Investigation, 2024).

The adoption of privacy-focused cryptocurrencies — particularly Monero — by dark web marketplaces reflects the recognition among criminal actors that Bitcoin’s public blockchain, while pseudonymous, is not anonymous. Blockchain analysis techniques have demonstrated that Bitcoin transactions can often be traced to real-world identities through exchange records, address clustering, and behavioral pattern analysis (Meiklejohn et al., 2013; Chainalysis, 2024). Monero’s cryptographic privacy features — ring signatures, stealth addresses, and confidential transactions — provide substantially greater transaction privacy than Bitcoin, making it the preferred cryptocurrency for actors seeking to minimize tracing risk. Several major dark web marketplaces have adopted Monero as their primary or exclusive payment currency, though Bitcoin remains widely accepted due to its greater liquidity and ease of acquisition.

Ransomware Payments

Cryptocurrency has been foundational to the growth of ransomware as a criminal enterprise. Before cryptocurrency, ransomware operators faced the logistical challenge of collecting payment anonymously — a constraint that limited the scale and profitability of encryption-based extortion. Bitcoin and its successors removed this constraint by providing a payment channel that is pseudonymous, operates across borders, processes transactions in minutes, and resists the reversal and seizure mechanisms that law enforcement could apply to traditional financial transfers (Richardson & North, 2017). The explosive growth of ransomware from a marginal threat in the early 2010s to an industry generating over $1.1 billion in identified payments in 2023 (Chainalysis, 2024) is directly attributable to the availability of cryptocurrency as a ransom collection mechanism.

The cryptocurrency payment infrastructure for ransomware has developed in sophistication alongside the ransomware industry itself. Major ransomware-as-a-service platforms maintain dedicated cryptocurrency wallets for each victim, automate payment verification, and employ multi-stage laundering processes that move ransom proceeds through chains of wallets, mixing services, and cross-chain bridges before converting to fiat currency through exchanges in jurisdictions with minimal anti-money-laundering enforcement. The FBI’s successful recovery of approximately $2.3 million from the Colonial Pipeline ransom — traced through blockchain analysis and seized from a wallet whose private key the FBI obtained — demonstrated that ransomware payments are traceable under favorable conditions but also illustrated the resources and expertise required for successful recovery (U.S. Department of Justice, 2021).

Cryptocurrency-Native Crime

Exchange Hacks and Theft

Cryptocurrency exchanges — platforms that facilitate the buying, selling, and trading of digital currencies — represent high-value targets for criminal theft because they custody substantial quantities of cryptocurrency in hot wallets (connected to the internet for transaction processing) and cold wallets (stored offline for security). Major exchange hacks have resulted in some of the largest single-incident thefts in criminal history: the Mt. Gox hack (2014, approximately 850,000 Bitcoin, valued at approximately $450 million at the time), the Coincheck hack (2018, approximately $534 million in NEM tokens), the Ronin Network bridge hack (2022, approximately $620 million, attributed to North Korean state-sponsored actors), and the FTX collapse (2022, in which approximately $8 billion in customer funds were lost through a combination of fraud and mismanagement) (Chainalysis, 2024; Vigna & Casey, 2019).

The regulatory response to exchange security has evolved from essentially non-existent in the early years of cryptocurrency to increasingly structured oversight. The SEC has pursued enforcement actions against exchanges for operating unregistered securities exchanges and for custody failures. The CFTC has asserted jurisdiction over cryptocurrency derivatives. FinCEN requires cryptocurrency exchanges operating in the United States to register as money services businesses, implement anti-money-laundering programs, and file suspicious activity reports. State-level regulation, including New York’s BitLicense framework, imposes additional requirements on exchanges serving residents of regulated states. Despite these regulatory developments, the global character of cryptocurrency markets means that many exchanges serving U.S. customers operate from jurisdictions with less rigorous oversight, creating regulatory arbitrage opportunities that criminal actors exploit (Kethineni & Cao, 2020).

DeFi Exploits and Smart Contract Vulnerabilities

Decentralized finance (DeFi) protocols — blockchain-based financial services that operate through automated smart contracts without centralized intermediaries — have become a major vector for cryptocurrency-native crime. DeFi protocols manage tens of billions of dollars in deposited assets, and vulnerabilities in their smart contract code provide opportunities for exploitation that differ fundamentally from traditional financial crime. Flash loan attacks, oracle manipulation, governance attacks, and reentrancy exploits represent technically sophisticated attack methods that exploit the automated, trustless execution model that distinguishes DeFi from traditional finance (Werner, Perez, Gudgeon, Klages-Mundt, Harz, & Knottenbelt, 2022).

Chainalysis (2024) documented over $1.7 billion in DeFi-related theft in 2023, a figure that represents a substantial proportion of total cryptocurrency crime losses. The legal characterization of DeFi exploits remains contested: when an attacker uses a protocol’s own code to extract funds in a manner the code permits but the developers did not intend, the question of whether the conduct constitutes theft, fraud, or merely the exploitation of a contractual opportunity depends on legal interpretations that courts have not yet definitively established. The SEC and DOJ have pursued enforcement actions against DeFi actors under existing securities and wire fraud statutes, but the application of legal frameworks designed for human-intermediated transactions to automated protocol interactions raises novel questions about intent, authorization, and the boundaries of lawful conduct in code-governed financial systems.

Money Laundering and Financial Investigation

Cryptocurrency Laundering Methods

The laundering of illicit cryptocurrency proceeds — converting criminal funds from identifiable cryptocurrency form to usable value while obscuring their criminal origin — represents a critical function in the cybercrime ecosystem and a primary focus of law enforcement and regulatory attention. Laundering methods range from simple techniques (sending funds through multiple personal wallets to create transaction distance) through moderately sophisticated approaches (using cryptocurrency mixing services that pool and redistribute funds) to highly sophisticated methods (converting between cryptocurrencies through decentralized exchanges, using DeFi protocols to obscure fund flows, and exploiting cross-chain bridges to move value between blockchains with different transparency properties) (Fanusie & Robinson, 2018).

Cryptocurrency mixers and tumblers — services that aggregate cryptocurrency deposits from multiple users and redistribute them to destination addresses in a pattern that obscures the link between input and output — have been the most prominent laundering infrastructure and the most significant targets of law enforcement and regulatory action. The Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned the Tornado Cash mixer in August 2022, asserting that the protocol had been used to launder over $7 billion in cryptocurrency including proceeds from North Korean state-sponsored hacks. The sanctioning of Tornado Cash — a decentralized protocol operating on the Ethereum blockchain without a centralized operator — generated significant legal controversy about whether sanctioning software code (rather than a person or entity) is within OFAC’s authority, with a federal appeals court partially reversing the sanctions on the grounds that the immutable smart contracts underlying Tornado Cash were not “property” subject to sanctions (Chainalysis, 2024; U.S. Department of the Treasury, 2022).

Blockchain Analysis and Asset Recovery

The investigation of cryptocurrency crime relies heavily on blockchain analysis — the examination of publicly recorded blockchain transactions to trace the flow of funds, identify patterns of activity, and link pseudonymous addresses to real-world identities. Blockchain analytics firms including Chainalysis, Elliptic, and CipherTrace have developed tools that law enforcement agencies use to visualize transaction flows, cluster related addresses, identify interactions with known illicit services, and flag transactions that exhibit patterns consistent with laundering activity. The FBI, IRS Criminal Investigation, DEA, and HSI have developed internal blockchain analysis capabilities supplemented by commercial tools, and these capabilities have been instrumental in major cryptocurrency-related investigations and prosecutions (Meiklejohn et al., 2013).

The effectiveness of blockchain analysis depends on the cryptocurrency involved and the sophistication of the laundering techniques employed. Bitcoin transactions, which are recorded on a public blockchain with transparent transaction amounts and addresses, are amenable to tracing under many conditions — though the use of mixers, coinjoin protocols, and privacy wallets complicates analysis. Monero transactions, which employ cryptographic techniques specifically designed to prevent tracing, present substantially greater analytical challenges, and law enforcement’s ability to trace Monero remains limited and contested. The IRS has commissioned research into Monero tracing capabilities, and some analytical breakthroughs have been reported, but the privacy guarantees of Monero’s cryptographic design create inherent limitations on tracing that technical advances may not fully overcome (Chainalysis, 2024).

Asset seizure and forfeiture of criminal cryptocurrency represents the financial dimension of cryptocurrency crime investigation. The legal framework for cryptocurrency seizure draws on existing forfeiture authorities, with cryptocurrency classified as seizable property under federal law. The practical mechanics of seizure require the government to obtain control of the private cryptographic keys that authorize transactions from the wallet in question. The DOJ’s seizure of cryptocurrency from the Silk Road, the Colonial Pipeline ransom recovery, and the record $3.6 billion seizure of Bitcoin stolen from the Bitfinex exchange in 2016 (recovered in 2022 following the arrest of the alleged launderers) demonstrate that cryptocurrency, despite its design for user control, can be seized when law enforcement identifies and gains access to the relevant cryptographic keys (U.S. Department of Justice, 2022).

Regulatory Framework

U.S. Regulatory Landscape

The regulatory framework for cryptocurrency in the United States operates through multiple agencies with overlapping and sometimes contested jurisdictions. The SEC has asserted authority over cryptocurrency tokens that it classifies as securities under the Howey test, bringing enforcement actions against token issuers, exchanges, and DeFi protocols for operating unregistered securities offerings and exchanges. The CFTC has asserted jurisdiction over cryptocurrency derivatives and over spot market transactions involving fraud and manipulation. FinCEN regulates cryptocurrency businesses as money services businesses under the Bank Secrecy Act, requiring registration, anti-money-laundering programs, and suspicious activity reporting. The IRS treats cryptocurrency as property for tax purposes, imposing reporting requirements on transactions and pursuing enforcement actions against tax evasion involving unreported cryptocurrency gains (Kethineni & Cao, 2020).

The jurisdictional fragmentation of cryptocurrency regulation creates complexity for legitimate businesses and enforcement gaps that criminal actors exploit. The absence of a unified federal regulatory framework — despite the introduction of multiple legislative proposals including the Financial Innovation and Technology for the 21st Century Act (FIT21) — means that the regulatory treatment of cryptocurrency activities depends on which agency claims jurisdiction and how that agency characterizes the activity in question. The resulting uncertainty discourages legitimate innovation while providing criminal actors with gaps and gray areas that complicate enforcement.

International Regulatory Divergence

International regulatory approaches to cryptocurrency vary widely, creating jurisdictional arbitrage opportunities that criminal actors exploit by routing transactions through countries with minimal oversight. The Financial Action Task Force (FATF) has developed standards for cryptocurrency regulation including the “travel rule” — requiring cryptocurrency businesses to collect and transmit sender and receiver identification information for transactions above specified thresholds — but implementation varies across FATF member jurisdictions (FATF, 2021). The European Union’s Markets in Crypto-Assets Regulation (MiCA), which became effective in 2024, establishes a unified regulatory framework for cryptocurrency activities across EU member states, providing a model of coordinated regulation that contrasts with the fragmented American approach.

Countries that serve as cryptocurrency regulatory havens — with minimal registration requirements, lax anti-money-laundering enforcement, and limited cooperation with foreign law enforcement — provide infrastructure that the cybercrime ecosystem exploits. Cryptocurrency exchanges registered in these jurisdictions process a disproportionate share of illicit cryptocurrency flows, and the difficulty of obtaining evidence and cooperation from regulators in these countries constrains law enforcement investigation of transactions routed through their systems. The FATF’s “gray list” mechanism — which identifies countries with strategic deficiencies in anti-money-laundering and counter-terrorist-financing frameworks — provides some pressure for regulatory improvement, but the cryptocurrency-specific dimensions of regulatory adequacy are not yet fully reflected in FATF assessment methodology.

Nation-State Cryptocurrency Crime

North Korean Operations

North Korean state-sponsored cryptocurrency theft represents the most significant intersection of nation-state cyber operations and cryptocurrency crime, with the Lazarus Group and affiliated entities responsible for billions of dollars in stolen cryptocurrency that funds the regime’s nuclear and ballistic missile programs. Chainalysis (2024) estimated North Korean cryptocurrency theft at over $1 billion in 2023, following an estimated $1.7 billion in 2022 — figures that represent a substantial and growing revenue stream for a regime subject to extensive international sanctions. Major North Korean cryptocurrency operations have included the Ronin Network bridge hack ($620 million), the Harmony Horizon Bridge hack ($100 million), and numerous exchange and DeFi protocol compromises across the cryptocurrency ecosystem.

The national security implications of North Korean cryptocurrency crime extend beyond the immediate theft to encompass the proliferation financing that stolen cryptocurrency enables. The UN Panel of Experts on North Korea has documented how cryptocurrency theft proceeds are laundered through complex chains of transactions and converted to fiat currency that is used to purchase materials, technology, and services for North Korea’s weapons programs — creating a direct link between cryptocurrency security and nuclear nonproliferation. The Treasury Department and the DOJ have pursued sanctions and criminal charges targeting North Korean cryptocurrency operations, but the regime’s cyber operatives operate from within North Korea and from partner countries including China and Russia, placing them beyond the practical reach of American law enforcement (UN Security Council, 2023).

Sanctions Evasion

Cryptocurrency has been adopted by sanctioned regimes, entities, and individuals as a mechanism for evading the economic restrictions imposed by the United States and the international community. Iran has reportedly used cryptocurrency mining and trading to generate foreign exchange income outside the dollar-denominated financial system. Russian entities subject to sanctions following the 2022 invasion of Ukraine have explored cryptocurrency as an alternative payment channel for sanctioned transactions. The OFAC has expanded its sanctions designations to include cryptocurrency addresses associated with sanctioned entities, and compliance obligations require cryptocurrency businesses to screen transactions against sanctions lists — though the pseudonymous nature of cryptocurrency makes sanctions compliance more difficult than in the traditional banking system where account holders are identified.

Emerging Trends and Future Trajectory

Privacy Technologies and Regulatory Response

The development of privacy-enhancing cryptocurrency technologies — including Monero and other privacy coins, zero-knowledge proof protocols, and decentralized mixing protocols — represents an escalating challenge for both law enforcement investigation and regulatory compliance. Privacy technologies that prevent the tracing of cryptocurrency transactions undermine the effectiveness of blockchain analysis as an investigative tool and may make it impossible for cryptocurrency businesses to comply with anti-money-laundering requirements that depend on transaction monitoring and reporting. The regulatory response has varied: some jurisdictions (Japan, South Korea) have banned privacy coins from regulated exchanges, while others (the United States) have taken a more targeted approach, sanctioning specific mixing services while permitting the use of privacy-preserving technologies for legitimate purposes.

The tension between financial privacy and law enforcement access that privacy cryptocurrencies create parallels the encryption debate in communications — both involve technologies that serve legitimate privacy functions while also enabling criminal exploitation, and both resist governance approaches that attempt to distinguish between legitimate and criminal use at the technological level. The resolution of this tension, if one is achievable, will likely involve a combination of regulatory requirements for cryptocurrency businesses (KYC/AML compliance at exchange on-ramps and off-ramps), investigative capability development (continued improvement of blockchain analysis techniques for privacy-preserving protocols), and targeted enforcement against the criminal services (mixers, unlicensed exchanges, laundering intermediaries) that process the largest volumes of illicit cryptocurrency.

Central Bank Digital Currencies and Criminal Implications

The development of central bank digital currencies (CBDCs) — digital currencies issued and backed by national central banks — may alter the cryptocurrency crime landscape by providing government-controlled digital payment alternatives that offer some of the efficiency benefits of cryptocurrency without the anonymity that criminal exploitation requires. The Federal Reserve has conducted research on a potential digital dollar, and over 130 countries are exploring or developing CBDCs. A CBDC designed with appropriate privacy protections for legitimate transactions but with tracing capabilities for law enforcement investigation could address some of the challenges that decentralized cryptocurrencies create — though the design of privacy-preserving-yet-traceable digital currency involves fundamental technical and policy trade-offs that mirror those in the broader privacy-security debate (Auer & Böhme, 2020).

Conclusion

Cryptocurrency and crime exist in a relationship defined by the technology’s dual character — its capacity to serve both legitimate financial innovation and criminal exploitation through the same architectural features of decentralization, pseudonymity, and censorship resistance. The criminal dimensions of cryptocurrency encompass its use as payment infrastructure for dark web commerce and ransomware, as a target of theft and fraud through exchange hacks and DeFi exploits, as a medium for money laundering through mixers and cross-chain bridges, and as a mechanism for sanctions evasion by nation-state actors. The investigative response, centered on blockchain analysis and cryptocurrency seizure, has achieved significant successes but faces escalating challenges from privacy-enhancing technologies that are designed to defeat the tracing on which investigation depends.

The governance of cryptocurrency crime requires frameworks that address the technology’s dual-use character — enabling legitimate innovation while constraining criminal exploitation — through a combination of regulatory requirements, investigative capability, international cooperation, and sanctions enforcement that no single mechanism can provide independently. The continued development of cryptocurrency technology, the evolution of the regulatory landscape, and the adaptive behavior of criminal actors ensure that the relationship between cryptocurrency and crime will continue to evolve in ways that demand corresponding adaptation from the institutions responsible for its governance.

References

Auer, R., & Böhme, R. (2020). The technology of retail central bank digital currency. BIS Quarterly Review, March 2020, 85–100.
Chainalysis. (2024). The 2024 crypto crime report. https://www.chainalysis.com/blog/crypto-crime-2024/
Christin, N. (2013). Traveling the Silk Road. Proceedings of the 22nd International Conference on World Wide Web (pp. 213–224). https://doi.org/10.1145/2488388.2488408
Europol. (2024). Internet Organised Crime Threat Assessment (IOCTA) 2024. European Union Agency for Law Enforcement Cooperation.
Fanusie, Y., & Robinson, T. (2018). Bitcoin laundering: An analysis of illicit flows into digital currency services. Center on Sanctions and Illicit Finance.
Federal Bureau of Investigation. (2024). Internet Crime Complaint Center 2023 annual report. U.S. Department of Justice.
Financial Action Task Force. (2021). Updated guidance for a risk-based approach to virtual assets and virtual asset service providers. FATF. https://www.fatf-gafi.org/
Foley, S., Karlsen, J. R., & Putniņš, T. J. (2019). Sex, drugs, and Bitcoin: How much illegal activity is financed through cryptocurrencies? Review of Financial Studies, 32(5), 1798–1853. https://doi.org/10.1093/rfs/hhz015
Holt, T. J., & Bossler, A. M. (2016). Cybercrime in progress. Routledge.
Irwin, A. S. M., & Turner, A. B. (2018). Illicit Bitcoin transactions: Challenges in getting to the who, what, when and where. Journal of Money Laundering Control, 21(3), 297–313. https://doi.org/10.1108/JMLC-07-2017-0031
Kethineni, S., & Cao, Y. (2020). The rise in popularity of cryptocurrency and associated criminal activity. International Criminal Justice Review, 30(3), 325–344. https://doi.org/10.1177/1057567719827051
Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G. M., & Savage, S. (2013). A fistful of Bitcoins: Characterizing payments among men with no names. Proceedings of the 2013 Internet Measurement Conference (pp. 127–140). https://doi.org/10.1145/2504730.2504747
Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf
Richardson, R., & North, M. M. (2017). Ransomware: Evolution, mitigation and prevention. International Management Review, 13(1), 10–21.
UN Security Council. (2023). Report of the Panel of Experts established pursuant to resolution 1874 (2009). S/2023/171.
U.S. Department of Justice. (2021). Department of Justice seizes $2.3 million in cryptocurrency paid to the ransomware extortionists Darkside. Press release.
U.S. Department of Justice. (2022). Two arrested for alleged conspiracy to launder $4.5 billion in stolen cryptocurrency. Press release.
U.S. Department of the Treasury. (2022). U.S. Treasury sanctions notorious virtual currency mixer Tornado Cash. Press release.
Vigna, P., & Casey, M. J. (2019). The truth machine: The blockchain and the future of everything. St. Martin’s Press.
Wall, D. S. (2007). Cybercrime: The transformation of crime in the information age. Polity Press.
Werner, S. M., Perez, D., Gudgeon, L., Klages-Mundt, A., Harz, D., & Knottenbelt, W. J. (2022). SoK: Decentralized finance (DeFi). Proceedings of the 4th ACM Conference on Advances in Financial Technologies (pp. 1–15). https://doi.org/10.1145/3558535.3559780
Yar, M., & Steinmetz, K. F. (2019). Cybercrime and society (3rd ed.). SAGE Publications.

Related Articles