Chainalysis put 2019 crypto crime activity at $11.5 billion

Chainalysis released its 2020 State of Crypto Crime report on January 29, 2020, estimating that $11.5 billion in cryptocurrency transactions during calendar 2019 were associated with criminal activity. The blockchain-analytics company put that amount at 1.1% of the cryptocurrency activity covered by its dataset. The release mattered because it reframed an argument often conducted through anecdotes: illicit use was material in dollar terms, but small as a share of the activity Chainalysis measured.

Those figures were estimates produced by a commercial analytics provider, not totals reported by a regulator or audited accounts. They depended on Chainalysis identifying addresses and entities as illicit, tracing flows connected to them, converting token movements into U.S. dollars and defining the set of cryptocurrency activity used as the denominator.

Scams dominated the estimate

Chainalysis said scams accounted for $8.6 billion of 2019 transaction activity. That was not the same as victim losses. The company separately estimated that scammers received $4.30 billion from victims, with outgoing transfers from scam wallets contributing to the larger activity figure.

The report attributed 92% of scam receipts to Ponzi schemes. It counted more than 2.4 million transfers into six Ponzi schemes and reported an average transfer value of $1,676. Those transfers were a transaction count, not a verified count of unique people: one person could make multiple payments, and the report said its work on the most prominent schemes was continuing.

Concentration was central to the finding. The PDF said removing three large Ponzi schemes would reduce crime’s measured share of cryptocurrency activity from 1.1% to 0.46%. Chainalysis’s January 29 web summary instead referred to two large schemes. The surviving contemporaneous materials therefore support the conclusion that a few schemes drove the aggregate, but they do not resolve the discrepancy over whether the relevant concentration test excluded two schemes or three.

A broader compliance map

The report treated scams as one part of a wider system that included money laundering, ransomware, exchange attacks, darknet markets, theft, sanctions-related activity, child-abuse-material payments and terrorism financing. Separate report excerpts published by Chainalysis supplied useful scale and definitions.

For exchange security, the company counted 11 attacks in 2019 and $283 million stolen. Its scope included technical exploits and social engineering that reached exchange funds, but excluded wallet providers, payment processors, exit scams, compromised data without confirmed cryptocurrency theft and incidents lacking a publicly confirmed amount. Chainalysis described the resulting total as a likely lower boundary.

For darknet markets, Chainalysis estimated more than $790 million in 2019 cryptocurrency sales, up 70% from 2018. Their share of incoming cryptocurrency activity doubled from 0.04% to 0.08%, still a narrow slice of the measured market. That excerpt covered bitcoin, bitcoin cash, litecoin and tether for the cited share, while other report charts used broader currency sets. The percentages therefore should not be treated as universal measures of every blockchain or token.

Why January 29 mattered

The institutional message was as important as the totals. Chainalysis argued that exchanges could identify suspicious deposits, scrutinize over-the-counter brokers and strengthen know-your-customer controls, while investigators could use public-ledger analysis to follow funds. CoinDesk’s contemporaneous account emphasized that regulatory enforcement and exchange action were the report’s proposed response.

There was also an incentive to read the claims cautiously. Chainalysis sold the investigative tools whose usefulness the report promoted, and its address attribution was proprietary rather than independently reproducible from the publication. The verified January 29 development is the report’s release and the estimates it presented. The record does not establish that every illicit address was identified, that every flagged flow represented a final loss, or that the report caused a same-day cryptocurrency price move.