Two major blockchain analytics studies released in mid-October 2026 quantify the scale of illicit crypto activity and the risk exposure of centralized exchanges. Chainalysis reports that illicit cryptocurrency money laundering surpassed $82 billion in 2025, up from roughly $10 billion in 2020. Global Ledger, meanwhile, identified $187.75 billion in high-risk exposure across 99 crypto exchanges between 2021 and 2025, after analyzing $36.28 trillion in deposits and withdrawals involving Bitcoin, Ethereum and USDT on Tron.
Chainalysis says its intelligence tools now serve more than 1,500 clients—including government agencies, financial institutions and crypto exchanges—across more than 70 countries. Its Reactor tool attributes wallet addresses to known entities and generates visual transaction graphs for investigators. Know Your Transaction, or KYT, runs real-time monitoring against transfers and triggers alerts when activity touches wallets associated with sanctions, darknet markets or other flagged entities. Additional modules include Address Screening, VASP Risking and the AI-powered Alterya tool.
The Chainalysis data highlights the growing role of Chinese-language money laundering networks. These networks processed an estimated $16.1 billion in inflows in 2025 across 1,799 active wallets, roughly 20% of all known illicit crypto laundering. The company identified six service types: point brokers, money mules, informal OTC desks, Black U services, gambling platforms, and mixing and swapping services. Tom Keatinge of RUSI said the networks have rapidly become multi-billion-dollar cross-border operations, while Chris Urben of Nardello and Co. noted that crypto offers an efficient way to discreetly move funds across borders.
Global Ledger’s exchange-level analysis found $90.55 billion entering exchanges from flagged sources and $97.21 billion leaving for flagged destinations over the study period. One unnamed exchange accounted for $70.84 billion in combined exposure, including 41.3% of all risky inflows. The 10 largest platforms combined for $167.66 billion in exposure; the other 89 exchanges accounted for $20.09 billion. Across the top 10, risky inflows ranged from 0.07% to 2.25% of deposits, compared with an industry benchmark of 0.68%. Some individual exchanges in the broader sample showed risky inflow and outflow rates as high as 7.79% and 24.78%.
Sanctions have become the dominant risk category. Global Ledger attributed $74.09 billion in combined five-year exposure to sanctions-related activity. In 2025, sanctions accounted for 62.2% of risky inflows and 53.8% of risky outflows. Fraud and hacks, which supplied more than four-fifths of flagged inflows in 2021, dropped to $4.16 billion and $1.51 billion respectively in 2025, while sanctions-related inflows reached $11.02 billion. The report also found that USDT on Tron accounted for 68% of risky inflows and 80.4% of risky outflows in 2025. Bitcoin’s share of flagged inflows fell to 11% from 83.1% in 2021, even though Bitcoin still represented about 40% of all exchange deposits in 2025, compared with USDT’s 36%.
Compliance programs are tightening. Chainalysis benchmark data shows nearly half of organizations onboarded in 2026 operate at alerting standards that ranked in the top 10% of strictness in 2020. Crypto exchanges set non-illicit indirect exposure alert minimums at an average of $950, while financial institutions trigger alerts at $150. For illicit indirect exposure, exchanges alert at $100 compared with $55 for traditional finance companies. Categories such as child exploitation material, sanctioned entities, special measures designations, and terrorist financing carry near-zero tolerance, with alert thresholds at approximately one cent. Regionally, EMEA jurisdictions tend to set the strictest indirect exposure thresholds, while Asia-Pacific organizations configure more lenient settings.
The reports also document limits and evolving evasion techniques. Chainalysis acknowledges limited tracing for privacy-focused cryptocurrencies such as Monero and Zcash. Black U services fragment large transactions into thousands of smaller amounts, with small transaction volumes rising 467% from inflow to outflow. Automated services cleared very large transactions in about 1.6 minutes during Q4 2025. Guarantee platforms like Huione and Xinbi were excluded from Chainalysis’s $16.1 billion Chinese-language estimate because they facilitate rather than directly control underlying fund movements; Huione Pay alone received more than $49 billion in crypto inflows since 2021.
Large transfers carry much of the risk. Global Ledger identified 5,878 deposits exceeding $1 million that carried $33.77 billion, or 37.24% of risky deposit value, while representing only 0.02% of flagged deposit transactions. Average risky transaction size rose from $392 in 2021 to $5,237 in 2025, and the average distance between exchanges and flagged entities increased from 1.51 to 2.73 transfers. Following the March 2025 disruption of Garantex, average daily flagged inflows linked to the exchange fell 98.9% and outflows fell 99.7%, according to the study.
Global Ledger also estimated that 10 exchanges examined for licensing had $52.33 billion in exposure associated with jurisdictions where they held recorded licenses, while 17 exchanges authorized under the EU’s Markets in Crypto-Assets Regulation by August 2026 had recorded $83.18 billion in historical exposure from 2021 through 2025. A separate North Korea analysis found $544.40 million in combined exchange exposure, excluding theft withdrawals attributed to North Korean actors.
The regulatory and enforcement environment is intensifying. OKX CEO Star Xu warned in September that high-risk deposits could trigger account reviews lasting 15 days or longer. FinCEN named Huione a primary money laundering concern, while OFAC and the UK’s OFSI designated the Prince Group network. Japan’s Ministry of Foreign Affairs included Garantex in an October sanctions package covering 33 entities and nine individuals. UK authorities also targeted Cryptomus, Heleket and TokenSpot. The combined research suggests compliance teams will increasingly focus on stablecoin flows and sanction-linked transaction patterns.
