An analysis of current darknet entities and their interactions with other entity types in Q1 2021, in comparison with historical dynamics over the last four years.
Exchanges with KYC: exchanges with mandatory Know Your Customer (KYC) procedures, that will not allow the withdrawal of cryptocurrency or fiat money without ID confirmation.
Exchanges without KYC: exchanges that allow the withdrawal of cryptocurrency or fiat money without any mandatory KYC procedures.
Mixers: services for mixing cryptocurrency funds from different sources with other funds, to obscure the trail back to the original source.
Darknet entities: entities that operate via the darknet and offer illegal services or goods in exchange for (mainly) cryptocurrency.
Stolen coins: entities that have taken possession of someone else’s cryptocurrency by hacking.
Other entity types: includes payment processors, gambling services, illegal services, miners, marketplaces, online wallets, ransom extortioners, scams, stolen coins, and/or other entity types.
DeFi: Decentralized Finance
DEX: Decentralized Exchange
FATF: Financial Action Task Force
VASP: Virtual Asset Service Provider
The immutability and transparency of the Bitcoin Blockchain enables us to identify suspicious activity on a global level, an effort that would be impossible with fiat payments. Additionally, guidelines and regulations that have been laid out by the Financial Actions Task Force (FATF) and the European Union (EU) for exchanges, online wallets, and other Virtual Asset Service Providers (VASPs) have significantly contributed to the identification of fund source purity.
The public nature of transactions on the blockchain, paired with the most recent introductions of global and regional digital asset regulations (aimed at preventing illicit activity involving cryptocurrencies), makes it even easier to identify suspicious activities through analytical tools like Crystal.
This report represents both direct and indirect bitcoin transactions between clusters owned by darknet entities, as well as non-darknet and unidentified entities. The report includes transactions between darknet and other types of entities, as well as unknown intermediate addresses (ie. addresses that do not belong to any identified services.)
NOTE: This analytics report was compiled using the Crystal Blockchain platform All Connections solution on the Bitcoin Blockchain.
NOTE: All USD amounts are monthly bitcoin amounts multiplied by the average monthly price of BTC.
WHY? These drops in bitcoin received and sent are mainly due to the significant growth of the price of BTC, however overall activity of darknet entities on the Bitcoin Blockchain declined too.
USD vs. BTC: Less rapid drops were considered in amounts in USD. We can see that darknet entities received and sent a slightly decreased amount of fiat or money in general
— from $410m in Q1 2020 to $400m in Q1 2021 and from $433m in Q1 2020 to $407m in Q1 2021 respectively.
Darknet entities often solicit exchanges without strict KYC verification requirements (to avoid financial crime and money laundering restrictions). The share of all bitcoin received by darknet entities from exchanges without KYC slightly dropped in Q1 2021 compared to Q1 2020 – from 46% to 40% respectively, as compared to the consistent growth we saw throughout 2020.
The share of bitcoin received from exchanges with KYC verification requirements has also been decreasing. In Q1 2020 it was 28%, where, in Q1 2021 it dropped to 19%. More new exchanges are implementing KYC procedures due to requirements from the FATF, because of that users prefer to choose to avoid KYC verification while interacting with darknet entities.
The share of bitcoin sent from one darknet entity to another (i.e., all transactions between different darknet entities) stayed relatively flat in Q1 2020 compared to in Q1 2021 – 18%.
This stable share could also indicate that darknet users are still trying to hide their bitcoin flows and transfers inside the darknet itself, avoiding the risk of having their activities unveiled by other entities (like exchanges) that have implemented FATF requirements.
There was also a noticeable growth in the share of received stolen bitcoins in Q1 2021. The main contribution to this was made when the Hydra marketplace received coins (stolen in 2016 from Bitfinex) that started to move in Q4 2020 and reached the darknet marketplace in Q1 2021.
The most notable change in how darknet entities send bitcoin is the growing use of mixers. Before Q3 2019, only 1-3% of bitcoin was sent to such services. In Q1 2020, it dramatically jumped to 20% and then declined to 10% until the end of 2020. It stopped at the 7% level in Q1 2021. The jump in Q1 2020 was mainly contributed to the interaction between the Hydra marketplace and the Wasabi mixer.
The amount of bitcoin received by darknet entities from exchanges with KYC requirements significantly reduced from 8,800 total bitcoin in Q1 2020 to only 1,067 total bitcoin in Q1 2021. Across this same time period, the amount of bitcoin sent by darknet entities to exchanges with verification requirements dropped from 6,308 total bitcoin to 734 total bitcoin.
The amount of bitcoin sent (in USD) from the darknet to exchanges with verification requirements also dropped, from $52m in Q1 2020 to $32m in Q1 2021. And darknet entities received bitcoin (in USD) from exchanges with verification requirements also decreased – $45m in Q1 2021 compared with $72m Q1 2020. This is likely due once again to the increased KYC/AML requirements at these exchanges.
Overall, bitcoin mixing services continue to grow in popularity thanks to their use by darknet entities.
Overall, darknet entities are sending more and more bitcoin amongst themselves, in comparison to pre-2020. The sum of transferred amounts between darknet entities directly grew significantly (looking at both the amount of bitcoin and the value in USD) between 2017 and 2020. However, in Q1 2021 the amount transferred between darknet entities slightly reduced to $43m, compared to $46m in Q1 2020.
In Q1 2020, bitcoin transfers between darknet entities amounted to 5,585 bitcoin, while in Q1 2021 it was only 993 bitcoin. Despite the reduction in BTC, the amount in USD remained stable. This seems to indicate the darknet ecosystem is remaining stable in size right now, or its revenue streams are becoming more directly interconnected (darknet to darknet).
In this report, we observed that in Q1 2021 the flow of bitcoin funds to and from darknet entities had dropped in bitcoin value and slightly decreased in USD value compared to Q1 2020. This may be partly explained by the growing capitalization of bitcoin. However, the overall decreasing bitcoin flow to and from these entities may also be explained by the growing popularity of other blockchains’ tokens and DeFi platform usage. Exchanges with KYC are becoming a much less popular way to withdraw bitcoin from darknet entities, while mixers are becoming more popular to withdraw from darknet entities.
The amount of bitcoin and USD transferred between darknet entities since 2020 also grew compared to the previous period. However, in Q1 2021 there was a small decrease in amounts from $46m in Q1 2020 to $43m in Q1 2021. Bitcoin is available to anyone in the world to use — this means that while it is increasingly a place for legitimate business, it is still used for malicious and criminal activities.
What is reassuring, however, is that all potentially suspicious activity on the blockchain can be detected due to blockchain’s immutability and transparency. This paired with the introduction of digital asset regulations by the FATF and the EU, as well as local regulations around the world, will increase the potential for identification of fund source purity, aided even further by analytics tools like Crystal Blockchain.