The shadow blockchain economy: criminals’ balance sheets exceed $75 billion

The cryptocurrency wallets of attackers, scammers, and criminals form their own extensive network, which is growing every year. GetBlock AML Research reveals details of the shadow blockchain economy.

Criminal balances: statistics

• In 2025, criminals hold nearly $15 billion in cryptocurrencies, and most of these funds are stolen money.
• In addition, the wallets associated with them (those that receive more than 10% of funds from illegal sources) hold another $60 billion — about four times more than the criminals themselves.
• The dark web shadow market alone and its sellers control more than $40 billion on the blockchain.
• Bitcoin still holds the leading position, accounting for about 75% of all illegal balances. This is due to the fact that its value has grown significantly over time. However, stablecoins and ether (ETH) are increasingly being used in this area.

Concentration of funds and withdrawal methods

• Most of the illegal funds are concentrated in just a few large wallets.
• Criminals are constantly improving their money laundering and withdrawal schemes: they use more and more addresses, but keep them active for a short time.
• Previously, almost 40% of dirty money went directly to crypto exchanges, but by mid-2025, this figure had fallen to 15%.
• This suggests that criminals have learned to mask their transfers by adding intermediate steps — for example, using anonymous services and bridges between different blockchains.

What can be seized

The United States has already announced that it wants to replenish its state reserves of cryptocurrencies by seizing illegal assets. Indeed, there are billions of dollars of criminal funds in open blockchains that can be seized if action is taken in a timely and coordinated manner.

Researchers have conducted an analysis and shown that huge illegal balances have accumulated in the crypto sphere. They determined:

• how much money is currently stored in the wallets of criminals and related accounts;
• how these funds are distributed among different types of wallets and currencies;
• what opportunities exist for seizing the money before criminals manage to withdraw it.

This report differs from conventional reviews that examine the movement of funds. Here, the focus is on static balances — that is, cryptocurrencies that have already been accumulated, are stored in wallets, and can be seized.

This approach helps to understand not only the flow of money, but also the amount of real wealth that has not yet been withdrawn from the blockchain.

How illegal cryptocurrencies move

It is important to understand two things. First, not all criminals keep large amounts in one wallet. Many simply move money quickly along the chain. Second, the growth in the total value of such wallets is highly dependent on the bitcoin exchange rate. It used to be worth pennies, but now it is worth tens of thousands of dollars, so the total value has increased. Stablecoins, on the other hand, have not risen in price — their rate is pegged to the dollar, so there are almost no changes.

Criminal balances: a target of $15 billion

As of July 2025, the combined balances of illegal participants holding bitcoin, ether, and stablecoins reached nearly $15 billion — a 359% increase compared to 2020. Stolen funds account for the largest portion of this amount.

Those involved in fraud or shadow sales need money for quick cash, so they do not keep large balances. On the other hand, those who commit large thefts hold assets for longer, choosing the right moment for conversion or laundering. For example, after the recent $1,5 billion hack of the Bybit exchange, criminals faced difficulties in withdrawing such large amounts, which is why some of the funds are still on the blockchain.

It is also clear that criminals’ balances depend on market conditions: in 2021 (at the peak of growth), they were at their highest, in 2022 they declined, and by 2025 they rose again. The share of bitcoin is decreasing, while the share of ether and stablecoins is growing. Nevertheless, due to its high exchange rate, bitcoin remains the most expensive asset for criminals.

A $60 billion shadow economy

If we follow the money further down the chain, we see that the network of linked wallets now holds over $60 billion. That is four times more than the original criminal wallets.

Most of these funds are linked to dark web marketplaces and fraudulent schemes. Dark web marketplace sellers and administrators hold over $46 billion, making them the largest category of illegal asset holders.

Many of them have been operating since the early 2010s, since the days of the famous Silk Road, and over the years have managed to significantly increase their wealth thanks to the growth of cryptocurrency rates.

Flows to exchanges: smaller but more stable

Centralized crypto exchanges remain the main method of cashing out. In the first half of 2025, about $7 billion in illegal funds passed through them, and since 2020, more than $14 billion annually.

However, the trend is declining: more and more criminals prefer to use cryptocurrency as a means of payment and accumulation, and are in no hurry to exchange it for fiat money. The share of direct transfers from criminal wallets to exchanges has decreased from 40% to 15%. This means that now, bad actors are trying to “dilute” the money trails to avoid detection.

Where the money is kept

Different types of criminals store funds in different ways. Often, more than 50% of all funds are concentrated in just three wallets. The exceptions are terrorism financing and the distribution of illegal content, where money is more widely distributed and frequently changes addresses.

There are also differences depending on the type of cryptocurrency. Stablecoins are distributed across a larger number of wallets because they can be frozen if a connection to crime is discovered. Therefore, criminals prefer not to store them for long and divide them into smaller parts.

How criminals withdraw money

Withdrawal methods are constantly changing. Some criminal groups have started using more and more addresses for cashing out, while others, on the contrary, have focused on proven routes. For example, dark web markets, malware schemes, and scammers most frequently use the same proven addresses on exchanges.

In other cases, addresses change rapidly to make tracking more difficult. This strategy helps them evade monitoring systems and prevent accounts from being blocked.

Quick address changes

Today, criminals rarely use the same addresses to withdraw money. In 2020, up to 40% of addresses continued to be used for cashouts a year later, but now it’s way less. This means that attackers are more likely to create new wallets and not rely on old ones to avoid getting blocked.

When can assets be seized?

Blockchain not only allows us to see what criminals are holding, but also when we can take action. For example, organizations such as dark web markets can operate for several years, while wallets containing stolen funds are only active for a few days.

Once a criminal ceases operations, the speed at which funds are withdrawn depends on the type of currency:

• Stablecoins are almost completely withdrawn within 90 days;
• Ether is slightly slower, with about 87% withdrawn within 3 months;
• Bitcoin is the “slowest,” with only half withdrawn within the same period.

This means that it is important for law enforcement to act quickly in the first few weeks while the funds can still be traced.

What does this mean for law enforcement officers

An estimated $15 billion in criminal wallets and $60 billion in related addresses represent enormous potential for seizures, but also a serious challenge. To actually recover this money, authorities need:

• expedited procedures for seizing digital assets;
• international cooperation and data sharing;
• specialists and technologies capable of quickly analyzing the blockchain.

Without these steps, most illegal crypto assets will remain on the blockchain.