Tag: crypto crime

As Epstein-linked revelations emerged, new data show crypto payments to suspected trafficking services surged 85% globally in 2025.

As global attention remains fixed on the continued release and scrutiny of emails and documents tied to sex trafficker Jeffrey Epstein, attention has turned to how exploitation networks operate and move money.

Against this backdrop, a new report from Chainalysis disclosed that cryptocurrency flows to suspected human trafficking-related services surged sharply in 2025. Transaction volumes reached hundreds of millions of dollars, up 85% year-over-year. While the figures quantify financial activity, the report stressed that the true cost of these crimes is borne by victims, not balance sheets.

Trafficking-Linked Crypto Activity

The increase in crypto-linked trafficking activity has occurred alongside the expansion of Southeast Asia–based scam compounds, online gambling operations, and Chinese-language money laundering and guarantee networks, many of which operate openly on Telegram and form a tightly connected illicit ecosystem with global reach.

Unlike cash-based systems, blockchain transparency helps investigators to trace these flows, thereby creating opportunities to identify and disrupt networks that would otherwise remain hidden. Blockchain analytics company Chainalysis tracked four primary categories of suspected cryptocurrency-facilitated trafficking: Telegram-based “international escort” services suspected of trafficking people; “labor placement” agents linked to kidnapping and forced labor in scam compounds; prostitution networks; and vendors of child sexual abuse material (CSAM).

Payment behavior differs across categories. “International escort” services and prostitution networks rely almost entirely on stablecoins as they prioritize price stability and ease of conversion, but CSAM vendors have historically favored Bitcoin. However, its dominance is declining as alternative Layer 1 networks and privacy tools emerge.

Escort services were found to be deeply integrated with Chinese-language money laundering networks that rapidly convert stablecoins into local currencies and reduce exposure to asset freezes by centralized issuers. Transaction-size analysis points to professionalized operations as nearly 49% of “international escort” service transfers surpass $10,000, which is consistent with organized enterprises operating at scale.

Meanwhile, prostitution networks cluster in the $1,000-$10,000 range. These networks often use structured pricing and customer-service models, advertising standardized rates across major East Asian cities, which in turn produce identifiable on-chain patterns useful for detection.

You may also like:

CSAM Crypto Economy

CSAM operations reveal a different structure. It was found that roughly half of transactions are under $100, and there is a shift toward subscription-based models that generate predictable revenue streams. In 2025, Chainalysis observed growing use of Monero and instant exchangers to launder CSAM proceeds, in addition to an emerging overlap between CSAM networks and sadistic online extremism communities, where abuse material is monetized through cryptocurrency payments.

One major CSAM site identified in July 2025 alone used more than 5,800 crypto addresses and generated over $530,000 since 2022. The report also stated that trafficking-linked services leverage US-based infrastructure for scale and legitimacy, while operators often remain overseas to limit personal exposure.

Joshua Armbrust mined $5,895 in Ethereum using his former employer’s AWS account, but escaped jail time with three-year probation.

A former Digital River employee has been ordered to pay more than $45,000 back to his previous employer after unlawfully using company computing systems to mine cryptocurrency.

Joshua Paul Armbrust, 45, was sentenced Tuesday to three years’ probation by US District Judge Jerry Blackwell, following his April guilty plea to a felony computer fraud charge.

Armbrust’s Covert Mining Scheme Exposed

According to court filings, Armbrust continued exploiting Digital River’s resources for over a year after leaving the Minnetonka-based e-commerce and payment processing firm in February 2020. He mined Ethereum using the company Amazon Web Services (AWS) credentials, which fetched him an earnings of $5,895 while incurring $45,270 in costs to Digital River.

The activity was uncovered during an internal investigation by Digital River, which shut down operations in January. Reviewers noticed unusual AWS fees and traced the activity to Armbrust’s IP address. This revealed that he had consistently run mining scripts on company servers between 6 p.m. and 7 a.m., long after his departure.

Assistant US Attorney Jordan Endicott said that it was “not a momentary lapse in judgment” but a “calculated and covert misuse of enterprise-level computing resources for private enrichment.”

“The defendant’s conduct strikes at the core of digital trust and security in the modern economy. Companies rely on former employees to act ethically, even after separation, and to respect corporate systems and data. Unauthorized access to corporate cloud infrastructure not only creates financial harm, as in this case, but also exposes sensitive systems to potential compromise and opens the door to more severe cyber threats.”

Desperate or Calculated?

Defense attorney William Mauzy described Armbrust’s conduct as driven by desperation rather than greed. Mauzy said Armbrust faced severe financial pressure while caring for his terminally ill mother, who has since passed. He added that Armbrust did not attempt to damage systems, hide his actions, and accepted responsibility for losses.

At the time of his indictment in November 2024, Armbrust was living in Orr, Minnesota. He has since moved to St. Paul, where he now works in the insurance sector. Both the prosecution and defense recommended a probation sentence under the plea deal, citing his clean record and cooperation with authorities.

You may also like:

Judge Blackwell remarked that Armbrust’s technical talents could have been applied lawfully, pointing to the wasted potential. The outcome underscores the need for companies to secure access to computing resources and prevent long-term misuse by former employees.

Cryptojacking, also called malicious cryptomining, still remains a critical threat vector. It’s a cyber threat where hackers secretly use a computer or mobile device to mine cryptocurrency. Before its shutdown in March 2019, Coinhive was a widely used cryptojacking tool and was estimated to be involved in more than two-thirds of all such attacks.

In a pioneering press release announcement, TRM Labs, the blockchain intelligence firm that assists businesses and law enforcement in combating crimes involving cryptocurrency, has unveiled Beacon Network, the first dedicated response network to real-time crypto fraud.

Live Crypto Crime Detection

It’s designed to prevent illicit assets from leaving the blockchain and was developed in collaboration with law enforcement, stablecoin issuers, exchanges, and various other firms. Some of the founding members include Ripple, Binance, Stripe, Anchorage Digital, Zodia Custody, PayPal, Robinhood, and many others, forming a groundbreaking alliance between traditional institutions and cryptocurrency companies.

Leading federal law enforcement agencies worldwide are actively participating in the network, triggering alerts and flagging critical threat-linked addresses to prevent criminals from off-ramping their ill-gotten gains. Various security researchers and firms, including ZachXBT, zeroShadow, CryptoForensics Investigators, and Hypernative, among others, provide continuous threat monitoring.

According to data from TRM Labs, at least $47 billion in cryptocurrency assets has been sent to addresses associated with fraudulent activities since 2023. However, that number is likely to be much higher, as most victims of this type of crime either do not report it, as they do not know how, or are simply ashamed that it has happened to them. Moreover, the year so far has seen over $2 billion of crypto funds stolen from their rightful owners.

This constant wave of hacks, scams, and other illicit activities continues to drain billions from individuals, from everyday investors to well-established and secure organizations. In many cases, the stolen capital is quickly funneled and converted to fiat before the law can take action.

A prime example is the disastrous $1.5 billion Bybit hack that occurred in February of this year, with the bad actors performing over 10.000 transactions in the month following the attack, provoking the urgent need for faster responses and detection across the crypto ecosystem.

How Will It Operate?

Until today, law enforcement and crypto platforms have been slow to react to crimes, which often occur after the funds have already been stolen. Given that transaction processing times on the blockchain are typically rapid in most scenarios, the response time should be measured in minutes, rather than days.

The Beacon Network is primed and ready to tackle the rising wave of crypto criminals by providing several key functions:

• Flagging and propagation: Investigators flag addresses linked to crime, and the network automatically labels the wallets linked to them
• Real-time alerts: These are triggered when tagged funds arrive at a participating exchange or platform
• Rapid response: Crypto platforms will have the ability to hold flagged deposits before they are withdrawn, effectively stopping the criminals in their tracks
• Accessible by design: Affiliate membership is of no cost to law enforcement partners and verified exchanges.

“As the crypto industry continues to evolve at a rapid pace, threats such as hacking and money laundering have become increasingly sophisticated, intelligent, complex, and fast-moving.

It is no longer feasible for any single team to fight these crimes effectively — we must unite as an industry to build coordinated defenses and responses, and Beacon Network helps us do just that.” – Heisen Guo, Chief Security Officer at HTX