Monero in 2025: What happened to the most popular coin among criminals

Key Takeaways

• Monero’s transaction activity remains stable and resilient. Usage stays well above pre-2022 levels despite widespread delistings and tighter oversight of transparent cryptocurrencies.
• Criminal groups, including ransomware operators, continue to say they prefer payments in Monero. In reality, however, most ransom payments are still made in Bitcoin. This highlights the gap between the desire for privacy and the need for liquidity and convenience.
• Monero’s share on darknet marketplaces is rising. Nearly half of new platforms launched in 2025 accept only XMR, a noticeable increase from previous years and a sign of shifting behavior in high-risk segments.
• New research shows that around 14–15% of Monero network nodes exhibit non-standard behavior. This includes differences in message propagation, response timing, and infrastructure concentration, which may influence assumptions about privacy.
• Privacy at the blockchain level remains intact, but real-world network behavior matters. The way peer-to-peer connections operate can introduce additional observability that may be relevant in investigations.

Monero holds a unique position in the illicit crypto ecosystem. In recent years, transactions on public blockchains have become significantly more transparent to analysts and law enforcement. U.S. dollar–pegged stablecoins now dominate cross-border settlements and are increasingly subject to issuer controls and regulatory oversight, even when circulating freely in open networks.

Against this backdrop, Monero remains difficult to trace due to its privacy-first architecture. Market data and academic research help clarify where its privacy mechanisms are truly effective — and where real-world usage patterns introduce new risk factors. GetBlock AML Research examined how Monero’s use evolved in 2025.

Adaptation and Growth in Monero Usage

While monthly activity has fluctuated in response to market events, the broader trend since 2020 shows steady growth in Monero usage. Activity levels have remained relatively stable across different market cycles.

Monero network monthly transaction volume. Visualization: TRM Labs

In 2024–2025, transaction volumes were significantly higher than at the start of the decade. This suggests that Monero continues to serve a consistent user base, even as tracking tools for transparent cryptocurrencies improve. The higher baseline points to sustained usage rather than short-term speculation.

This trend is notable given that Monero has been delisted or restricted on many of the world’s largest centralized exchanges. Platforms such as Binance, Coinbase, Kraken, OKX, Huobi, and Bitstamp have removed or limited support for XMR. By some estimates, Monero had been delisted from 73 exchanges by 2025. As a result, liquidity has concentrated on fewer venues, often operating outside stricter regulatory regimes.

Limited liquidity helps explain the disconnect between stated criminal preferences and actual payment flows. Ransomware groups frequently request Monero and sometimes offer discounts for XMR payments. In practice, however, most ransoms are still paid in Bitcoin. Bitcoin is easier to acquire, transfer, and exchange in large amounts, despite being more traceable. In many cases, accessibility outweighs privacy.

Over the past 30 days, Monero has shown significantly higher price volatility than Bitcoin and Ethereum — roughly 2.5 times higher — reflecting thinner liquidity and a more fragmented market structure.

XMR, BTC, and ETH volatility over the past 30 days. Visualization: TRM Labs

Despite reduced access to major exchanges, on-chain Monero activity has not meaningfully declined. This suggests demand is driven less by casual retail traders and more by users who deliberately prioritize privacy and accept the trade-offs.

Monero adoption on darknet marketplaces is also expanding. In 2025, nearly 48% of newly launched platforms accepted only XMR. The shift is particularly visible in Western-facing markets, where improved tracking of Bitcoin and stablecoins has pushed some participants toward more privacy-focused alternatives.

Although Monero’s share of total crypto transaction volume remains smaller than that of major transparent networks, its activity levels are significant given its specialized use case. The combination of steady activity and a growing number of XMR-only marketplaces indicates that demand for enhanced privacy remains strong.

New Research: Non-Standard Behavior in the Monero Network

As Monero’s popularity grows, so does scrutiny of how its privacy mechanisms function in real-world conditions.

Discussions about Monero’s resilience typically focus on its on-chain cryptography. However, practical privacy depends not only on algorithms but also on how network participants connect and exchange data on a daily basis. As pressure increases on transparent assets, understanding the network layer becomes increasingly important.

Recent analysis of Monero’s peer-to-peer (P2P) network identified patterns that do not fully align with the reference client implementation or expected protocol behavior.

To systematically assess these anomalies, independent researchers were engaged. Their findings were published as a preprint on arXiv. The study provides an empirical description of node-level deviations and explores their potential implications.

Key Findings

• Approximately 14–15% of reachable nodes exhibited behavior that diverged from standard protocol expectations.
• Non-standard behavior does not automatically imply malicious intent. It refers to unusual connection patterns, message timing differences, and other technical characteristics.
• The research identified signs of infrastructure concentration, suggesting that some nodes may be operated by a limited number of entities, potentially increasing network-level observability.
• While Monero’s blockchain cryptography remains unchanged, differences in how messages propagate across the network may affect theoretical anonymity models.

Interpreting the Results

The deviations were observed in several aspects of the P2P protocol, including connection handshakes, message timing intervals, peer list construction, and infrastructure distribution.

Individually, such differences could be attributed to outdated software or alternative client implementations. However, their persistence over time and the scale at which they appeared — affecting a meaningful share of nodes — makes them noteworthy.

Importantly, the study describes how nodes behave, not why. It does not attempt to assign motives or identify operators.

Infrastructure Concentration and Network Effects

One recurring pattern was the clustering of nodes within a limited number of hosting providers. In peer-to-peer systems, this can matter even when cryptographic protections remain intact.

Nodes that receive more inbound connections or appear more frequently in peer lists may gain broader visibility into how transactions propagate. Over time, this could reduce uncertainty about transaction origin or routing paths.

These effects arise not from a direct protocol breach but from network dynamics, making them harder to detect and mitigate.

Implications for Privacy Assessment

Monero’s privacy guarantees are typically evaluated at the blockchain level, assuming statistically uniform network behavior and independent nodes following standard data propagation rules.

Persistent deviations challenge this simplified model. Variations in message timing, connection duration, and peer selection can create observable transaction propagation patterns that may be incorporated into advanced analytical techniques.

This does not mean Monero’s cryptography has failed. Rather, it underscores the gap between theoretical privacy models and how the network operates under real-world conditions.