TRM Labs: The Illicit Crypto Ecosystem in Focus
Despite a prolonged decline in cryptocurrency valuations since 2021, the dollar value of crypto-linked crime did not fall in step. TRM Labs' landmark illicit crypto ecosystem report, the first to systematically classify more than 40 distinct crime typologies across 20-plus blockchains, puts the scale of the problem in stark relief: at least USD 7.8 billion flowed into Ponzi and pyramid schemes, USD 1.5 billion was spent on darknet drug markets, and USD 3.7 billion was stolen through hacks and exploits in a single year. For accounting firms, auditors, and CFOs managing digital asset books, the report is not background reading. It is a compliance reference.
Why Price Drops Did Not Reduce Illicit Volume
The intuitive expectation is that a bear market shrinks criminal activity alongside legitimate trading. The TRM Labs data challenges that assumption directly. Criminals are not passive holders; they move funds quickly, convert across chains, and target infrastructure weaknesses that exist regardless of price. The resilience of illicit dollar volumes points to structural factors rather than speculative ones.
The multi-chain shift as a risk amplifier
The most significant structural change documented in the report is the collapse of Bitcoin's dominance within illicit flows. In 2016, Bitcoin accounted for 97% of illicit crypto volume. By the period covered in the report, that share had fallen to 19%. On the hacking side, the shift is even more pronounced: Bitcoin represented two-thirds of hack volume in 2016, but by 2022 it accounted for less than 3%. Ethereum took 68% of hack proceeds, and Binance Smart Chain held 19%.
Terrorist financing tells a parallel story. Bitcoin was the exclusive vehicle in 2016. By 2022, assets on the TRON blockchain had taken over, accounting for 92% of that category. The practical implication for compliance teams is that monitoring a single chain, or even prioritising Bitcoin addresses in transaction screening, is no longer a credible AML posture.
Cross-chain bridges as a primary attack surface
Approximately USD 2 billion was stolen through cross-chain bridges in the year covered by the report. Bridges, which allow cryptocurrency to move from one blockchain network to another, have become a preferred target precisely because they concentrate liquidity at a single protocol layer. Once funds are extracted, criminals use chain-hopping, cycling assets through multiple networks in rapid succession, to obscure both origin and destination. This technique complicates transaction tracing and stretches the analytical capacity of conventional AML tools.
For a deeper technical breakdown of what this means for on-chain due diligence, see our coverage of AML red flags compliance teams must know from crypto bridge hacks.
Crime Typologies: What the Report Actually Catalogues
TRM Labs classifies illicit crypto activity into two broad sections. The first covers activities that generate crypto proceeds directly. The second covers the laundering of those proceeds, whether the original crime was crypto-native or fiat-based. The taxonomy runs across more than 40 categories, from espionage and SIM swapping to pump-and-dump schemes. The sections most relevant to institutional compliance fall into a handful of clusters.
Darknet markets and vendor shops
Darknet markets (DNMs) remain the largest driver of crypto-mediated illicit commerce. These are encrypted, multi-vendor platforms on the darknet where drugs and personal data are the primary goods. TRM Labs data shows that USD 1.49 billion was spent on DNMs during the reporting period. Over 80% of that volume moved through Russian-language markets. The largest Western Bitcoin DNM at the time of the report held less than 10% of global market share.
There is a notable operational divergence between Eastern and Western DNMs. Russian-language platforms predominantly use Bitcoin only, with no privacy coin options. Western platforms tend to offer Monero exclusively, or Monero alongside Bitcoin, reflecting a different risk calculus around law enforcement takedowns. For transaction monitoring purposes, this means that Monero flows and unusual Bitcoin clustering patterns each carry distinct red flag profiles depending on counterparty geography.
Alongside DNMs, independent vendor shops, single-operator storefronts using Tor, Telegram bots, and encrypted email, received more than USD 230 million during the same period. These platforms carry higher risk for customers because there is no escrow intermediary, but from a compliance standpoint they are harder to identify in transaction data precisely because they operate without a centralised address cluster.
Cybercrime forums as financial infrastructure
Cybercrime forums sit upstream of many illicit transactions. They function as marketplaces for initial access credentials, malware, zero-day vulnerabilities, and stolen personal data, and they derive revenue from registration fees, escrow services, and tiered account upgrades. TRM Labs examined prominent examples including a long-running Russian forum focused on exploit trading and a large English-language platform with millions of registered users. Cryptocurrency is the payment rail of choice throughout. For a firm that has onboarded clients or counterparties touching these ecosystems, standard KYB checks on business registration alone will not surface the exposure.
Accounting and Audit Implications
The report's findings carry direct consequences for how accounting firms and CFOs approach digital asset engagements. The concentration of illicit volume in multi-chain environments, and the speed with which funds are moved across protocols, means that the useful life of any static wallet screening list is measured in hours, not months.
Transaction monitoring and ledger integrity
For firms using digital asset accounting software to maintain client ledgers, the question is whether the software's data feeds incorporate multi-chain analytics or only cover major chains. A client whose treasury holds assets on Ethereum, TRON, and BNB Chain simultaneously requires screening logic that spans all three. A gap in any one feed creates a blind spot that could expose the firm to regulatory censure if a counterparty is later sanctioned or identified as a criminal address.
From a bookkeeping perspective, chain-hopping activity can create apparent cost-basis distortions. Each swap across chains may constitute a disposal event in most jurisdictions. If a client's treasury team is using cross-chain bridges for legitimate treasury management and those bridges have been exploited or are on a high-risk watchlist, the firm needs a protocol for flagging and documenting those transactions in the audit file, separate from normal disposal records.
Risk-based client acceptance and ongoing monitoring
The TRM Labs taxonomy gives compliance officers a working vocabulary for updating their risk-based approach. Firms that accept clients in DeFi protocol development, bridge infrastructure, or peer-to-peer exchange should now treat bridge exposure as a specific risk category in client acceptance forms, not a subset of generic "crypto risk." Similarly, clients with significant TRON treasury positions warrant enhanced due diligence given TRON's documented dominance in terrorist financing flows, regardless of the client's own stated purpose.
EU-based firms should cross-reference this with the direction of travel at the legislative level. For context on how EU policymakers are responding to exactly these risks, see our piece on how EU lawmakers are pushing crypto into anti-corruption strategy.
Ponzi and pyramid scheme proceeds: the audit challenge
USD 7.8 billion flowing into Ponzi and pyramid schemes is not an abstract figure. Some of that capital will have passed through legitimate exchanges, been converted to stablecoins, and ended up in the treasury accounts or investment portfolios of clients who believed they were receiving genuine investment returns. Auditors need to ask hard questions about the provenance of unusually high-yield crypto holdings and should request on-chain provenance documentation rather than relying solely on counterparty representations. If a client cannot explain the source of funds for a large crypto inflow at the address level, that is a red flag requiring escalation under both AML and audit professional standards.
Practical Steps for Compliance and Finance Teams
The TRM Labs report is descriptive, but the compliance response it demands is operational. The following priorities apply across accounting firms, corporate CFOs, and audit engagements:
Update your chain coverage and screening scope
Review whether your current crypto bookkeeping software and transaction monitoring tools cover Ethereum, BNB Chain, TRON, and the bridge protocols your clients use. If your firm's AML screening is Bitcoin-first by default, it is now structurally misaligned with where illicit volume actually concentrates. That misalignment is a documented gap that a regulator examining your AML programme will find.
Classify bridge transactions explicitly
Cross-chain bridge transactions should be categorised as a distinct transaction type in client ledgers, not merged with simple token swaps. Each bridge event needs a timestamp, the originating and receiving chain, the bridge protocol name, and a notation on whether that protocol appears on any sanctions or high-risk watchlist at the time of the transaction. This record supports both the audit file and any future regulatory inquiry.
Refresh risk appetite statements
Risk appetite statements written before 2022 almost certainly do not reflect multi-chain exposure, bridge risk, or TRON-specific considerations. A refresh that incorporates the TRM Labs typology framework, citing the specific crime categories and blockchain distributions documented in the report, will strengthen both the internal governance position and any external regulatory submission.
Train staff on chain-hopping red flags
Transaction reviewers need to recognise chain-hopping sequences in client data. A pattern of rapid, small-value movements across three or more blockchains within a short window, particularly where the final destination is a privacy-enabled asset or an unhosted wallet, should trigger enhanced review. This is now standard typology, not an edge case.
Source: TRM Labs
Frequently Asked Questions
Why did illicit crypto volumes hold steady despite falling prices?
TRM Labs' data suggests that criminal activity in crypto is driven by structural opportunity rather than asset price. Criminals move funds quickly across chains, exploit protocol weaknesses, and operate across a broadening range of blockchains, none of which are materially affected by a price downturn in Bitcoin or Ethereum.
What does Bitcoin's declining share of illicit volume mean for AML programmes?
It means that Bitcoin-first screening is no longer sufficient. With Ethereum, BNB Chain, and TRON now accounting for the majority of hack proceeds and terrorist financing flows respectively, AML programmes need multi-chain coverage as a baseline, not an enhancement.
How should accounting firms treat cross-chain bridge transactions in client ledgers?
Each bridge transaction should be logged as a distinct event with the originating chain, receiving chain, protocol name, and a sanction/watchlist status check at the time of the transaction. In most jurisdictions, a bridge transfer may also constitute a disposal for tax purposes, so cost-basis records need to be updated at each crossing.
Does this report change how auditors should approach crypto client acceptance?
It should. The taxonomy of 40-plus crime typologies, and the blockchain-level distributions documented in the report, gives auditors a reference framework for identifying higher-risk client profiles at the acceptance stage. Clients with significant TRON exposure, bridge protocol involvement, or high-yield crypto investment returns of unclear provenance now warrant explicit enhanced due diligence.
What is chain-hopping and why does it matter for transaction monitoring?
Chain-hopping is the practice of moving funds through multiple blockchain networks in sequence to obscure the original source and final destination. It is a documented money laundering technique. From a monitoring standpoint, it means that a clean address on one chain can still be the downstream recipient of illicit funds if intermediate chains are not covered in the screening workflow.