Over half of illicit crypto activity in 2024 was on Tron: TRM Labs

The Tron network continues to host the majority of illicit crypto activity, including cryptocurrency transfers tied to sanctioned entities, according to a new report from analytics firm TRM Labs.

Of the $45 billion in total illicit volumes recorded in 2024, Tron made up over $26 billion, followed by the Ethereum and Bitcoin networks.

Illicit activity refers to cryptocurrencies tied to illegal investment schemes, fraud, scams, hacks, sanctioned entities, and darknet marketplaces, TRM Labs said.

Why Tron?

Bad actors are lured by its low transaction fees, access to popular stablecoins, and capabilities of so-called smart contracts, said Ari Redbord, global head of policy for TRM Labs.

“Illicit actors are just like the rest of us,” he told DL News.

Redbord’s comments come as TRM Labs releases its latest report today, which indicates that nearly half of illicit activity on the Tron network is linked to sanctioned entities.

Tron is a low-cost blockchain founded in 2017 by Chinese-born crypto entrepreneur Justin Sun.

Hackers with ties to North Korea also continue to turn to USDT on Tron.

In 2024, North Korea stole $800 million from various crypto projects. Stolen funds are quickly moved through brokers — mostly on the TRON blockchain, reports TRM Labs — within a few hours. Tron did not respond to a request for comment.

North Korea isn’t the only concern.

A United Nations analysis in 2024 found that USDT on the Tron blockchain had become “a preferred choice” for fraudsters and money launderers in East and Southeast Asia. Tether and Tron have rebutted the UN claims.

Tether, the industry’s largest stablecoin provider, has also dealt with the illicit use of its $141 billion stablecoin USDT across all blockchains.

US lawmakers have expressed concern that USDT plays a key economic role in the trafficking of fentanyl, the illegal synthetic opioid.

In 2023, Elliptic, a blockchain analytics firm, reported that Chinese manufacturers providing precursor chemicals for fentanyl used Bitcoin and USDT wallets to receive millions of dollars in payments.

In interviews with DL News in 2024, Tether CEO Paolo Ardoino said the company is committed to working with the US Department of Justice and other law enforcement agencies to prevent criminals from using USDT.

Still, TRM Labs has reported a disproportionate amount of illicit USDT activity on the Tron network.

In 2023, TRM Labs reported that hackers with ties to North Korea swapped stolen funds from various crypto projects, mostly for Tether’s stablecoin USDT, on Tron before converting them to cash using over-the-counter brokers.

Among cryptocurrency addresses linked to terror financing campaigns, the firm reported a 125% increase in Tron addresses in 2023.

Tron turns a page

While these trends continued throughout last year, progress is being made to thwart illicit activity on the network.

Though Tron continues to host the majority of illicit crypto activity, Redbord said it also recorded the most significant year-over-year decline.

TRM Labs reported that illicit activity on Tron dropped by $6 billion in 2024 compared to 2023.

He chalks up the improvement to Tron paying closer attention to snuff out such activity on its network, as well as a new partnership between TRM Labs, Tether, and Tron that launched in 2024 called the T3 Unit.

Purpose-built to stop the use of USDT on Tron, the T3 Unit has facilitated the freezing of over $130 million in illicit proceeds in the last six months.

“While we are still seeing a disproportionate amount of illicit activity, T3 has made a considerable impact on Tron, and much of that activity was in Tether,” said Redbord.

Tether did not immediately respond to a request for comment.

Liam Kelly is a Berlin-based reporter for DL News. Got a tip? Email him at liam@dlnews.com.