A report published Wednesday by the blockchain analytics company TRM Labs revealed that crypto criminals had moved from bitcoin to alternative cryptocurrencies.

Elicit Crypto Ecosystem Report revealed that while crypto prices are down, scammers’ and hackers’ earnings haven’t. In 2022, crypto Ponzi schemes extorted at least $7.8 Billion from their victims. Over $9 billion worth of crypto was sent in total to 2022 addresses that were associated with frauds, scams, and Ponzi schemes. These frauds are most commonly committed using USDT, a Tron-based blockchain.

DeFi exploits have brought in $3.7 billion for attackers, including $2 billion from stolen cross-chain bridges. TRM reported that around $1.5 billion was spent on darknet markets selling illegal drugs.

Crypto criminals are increasingly using so-called “chain hopping” to hide their tracks. They move money from one blockchain into another to make it harder for outsiders to track. TRM reported that bitcoin’s contribution to such crimes has decreased from 97% of all criminal activity in 2016 down to 19% by 2022.

The report states that “in 2016, Bitcoin accounted for two-thirds (or 65%) of all crypto hacking volume; by 2022, this figure will be just under 3%. Ethereum (68%), and Binance Smart Chain (18%), are the dominant players in the market.” TRM found that USDT, which is based on Tron’s blockchain, is now the most popular coin to finance terrorism. TRM reported that the cryptocurrency was particularly popular among ISIS and its affiliated groups in Pakistan and Tajikistan.

Both bitcoin and tether are popular and liquid crypto currencies, which makes them an ideal payment method in many other situations.

Here’s how scammers can drain your crypto wallet

Bitcoin is still the currency of choice in some parts of the criminal underworld. For example, Russian darknet markets, which dominate the sector (80%), accept bitcoin primarily as payment for illegal drugs and other goods. TRM reported that large Western marketplaces like this often accept monero, but their contribution to the darknet economy as a whole is smaller.

TRM reported that websites offering pornographic images and videos of kids (also known as child sexual abuse material, or CSAM), received $3.32 millions in 2022. However, TRM also said that more than two-thirds of these funds were not paid to actual CSAM sellers, but instead to scammers selling access to nonexistent content.

Jeanhee Kim is the editor.