Illicit crypto activity dropped significantly last year, partly because of lower crypto trading volume and partly because sophisticated threat actors like the Lazarus Group are developing methods to evade detection, Chainalysis said in its annual report on crypto money laundering.
Chainalysis said $22.2 billion was laundered via crypto in 2023, down from $31.5 billion the year before. The drop was steeper than the decrease in transaction volumes, suggesting that factors beyond just the general market downturn may have contributed to the reduction in illicit activity. The figures suggest that only about 1% of all money laundering is carried out with crypto. The value of all illicit funds laundered is about $2 trillion a year, Deloitte wrote in a June 2023 report.
In 2023, there was an increase in the use of blockchain bridges and gambling services for laundering crypto, while in 2022, there was greater reliance on illicit service types and centralized exchanges.
“DeFi’s inherent transparency generally makes it a poor choice for obfuscating the movement of funds,” Chainalysis said.
For example, Hamas, listed as a terror group by the U.S., U.K., European Union and other jurisdictions, has had a significant amount of the crypto it raised traced, and crypto accounts shut down, because of the transparency of the blockchain.
The Lazarus Group, a North Korea-based threat actor, has been adapting its money laundering strategies to avoid the same fate, Chainalysis said.
“The growth of YoMix and its embrace by Lazarus Group is a prime example of sophisticated actors’ ability to adapt and find replacement obfuscation services when previously popular ones are shut down,” Chainalysis wrote.
While bridges are gaining in popularity because of Lazarus Group’s preference, the value of funds sent to mixers from illicit addresses almost halved to $504.3 million.
“Much of this is likely due to law enforcement and regulatory efforts, such as the sanctioning and shutdown of mixer Sinbad in November 2023,” Chainalysis noted.
The U.S. Treasury sanctioned the crypto mixer Sinbad for alleged ties to North Korea’s hacking group, leading to the seizure of its website by the FBI, Dutch and Finnish authorities, CoinDesk reported at the time.
“The changes in money laundering strategy we’ve seen from crypto criminals like Lazarus Group serve as an important reminder that the most sophisticated illicit actors are always adapting their money laundering strategy and exploiting new kinds of crypto service,” Chainalysis concluded.