Cryptocurrency-based crime hit a new all-time high in 2021, researchers at Chainalysis said in a report published Thursday.
According to the report, illicit addresses tracked by Chainalysis received $14 billion in deposits over the course of 2021, almost double the amount they collected in 2020.
Rather than digital extortion, though, Chainalysis found it was actually cryptocurrency-related scams, namely investment-related fraud, and straight theft that saw the biggest jumps in 2021.
Illicit revenue from scams rose by 82% in 2021 to $7.8 billion worth of cryptocurrency. Researchers attribute a large part of the growth to a boom in so-called “rug pulls,” a fraud scheme in which developers set up seemingly legitimate cryptocurrency projects with the intent to steal investors’ money and disappear.
Of the over $2.8 billion lost to rug pull scams, roughly 90% can be attributed to an Istanbul-based exchange Thodex, whose CEO disappeared with users’ funds. But there are plenty of other recent examples, including the $3.3 million of investor funds stolen by the creators of Squid coin, a currency named after the popular Netflix show “Squid Game.” Chainalysis researchers tracked a total of 24 rug pull scams in 2021.
Roughly $3.2 billion in cryptocurrency was stolen in 2021, a 516% increase from 2020 numbers, Chainalysis said. Nearly three-quarters of those losses were from DeFi protocols, an emerging form of financial technology that operates on a peer-to-peer basis rather than through an exchange. DeFi also saw significant growth in funds received related to money laundering.
Criminals have flocked to the new technology for a few reasons, according to Kim Grauer, head of research at Chainalysis.
“The nature of DeFi means that a lot of the code in these different protocols are open source, which means that a potential criminal can look for bugs in the code that they can exploit,” explains Grauer.
Some investors also might be skipping over the vetting process out of a fear of missing out on big returns, making them more susceptible to scams, Grauer said.
“All of these things are working together to have created an ecosystem where DeFi hacks just really exploded this year,” she said.
As for laundering, the trend isn’t anything unusual: fraudsters have historically been early adopters of technologies with the potential to shield their activity from law enforcement.
Scammers have also targeted the growing popularity of so-called meme coins like the Shiba Inu token. The security firm Tenable determined that, between October and November, scammers had earned at least $239,000 worth of cryptocurrency from scams promising fake investment returns on the coin.
Similar efforts have plagued YouTube and other social media channels over the past two years, leading Google to crack down on phishing scams used to facilitate cryptocurrency theft.
As cybercrime issues like ransomware bring increased attention to illicit uses of the currency, law enforcement agencies are also dedicating more resources to cryptocurrency-based crime. In 2021 the Justice Department announced multiple seizures of cryptocurrency funneled to criminals, including the retrieval of a $2.3 million payment that Colonial Pipeline made to the ransomware group DarkSide.
In its first sanction against a cryptocurrency exchange, in September the Treasury Department sanctioned exchange Suex for facilitating payments gained via ransomware attacks. The agency followed with the sanction of another exchange, Chatex, in November. The Internal Revenue Service seized $3.5 billion in cryptocurrency through non-tax-related investigations in 2021, the agency reported in November.
