The New Currency of Online Criminals

Criminals are swapping volatility for predictability: stablecoins tied to the U.S. dollar offer certainty and cross-chain speed needed to scale theft, forcing investigators to shift from post-fact subpoenas to real-time chain tracking.

See Also: Protecting Financial Services Mobile Apps

Bitcoin was the dominant currency of choice for cybercriminals in 2021, largely because of its liquidity. But stablecoins now account for 63% of all illicit crypto transactions, said Jacqueline Burns Koven, head of cyberthreat intelligence at Chainalysis.

The shift reflects a broader market dynamic, Koven told Information Security Media Group. Stablecoin usage has surged, growing about 77% year-over-year in 2024, according to Chainalysis data published in January. Those figures capture both legal demands such as remittances, cross-border payments and value storage – the same liquidity and accessibility that attract illicit actors.

Stablecoins are cryptocurrencies designed to hold a steady value, most commonly pegged to the U.S. dollar, and backed by reserves or stabilization mechanisms intended to keep that peg intact. The design gives users confidence that a token labeled as $1 will remain close to $1 between receipt and cash-out, a feature criminals also prize when moving large sums of money.

Why Stablecoins?

Practitioners say a cluster of market and technical factors are making stablecoins the payment of choice for cybercriminals and fraudsters.

“It’s not just the dollar peg that makes stablecoins attractive,” said Ari Redbord, vice president and global head of policy and government affairs at TRM Labs. “Liquidity is critical. There are deep pools of stablecoin liquidity on both centralized and decentralized platforms. Settlement speed and irreversibility are also appealing for criminals trying to move large sums quickly,” he told Information Security Media Group. The perception of stability – knowing $1 today will likely be $1 tomorrow – often suffices for illicit actors, regardless of an issuer’s exact collateral model, he said.

This stability and on-chain plumbing create both opportunity and exposure. Redbord said the spike in stablecoin usage is partly because law enforcement agencies around the world have become “exceptionally effective at tracing and seizing bitcoin,” and criminals “go where the liquidity and usability are.”

There is no technical attribute of stablecoins that makes them more appealing to criminals or harder to trace, compared to other cryptocurrencies, Koven said. In practice, public ledgers keep transfers visible; the question then becomes whether investigators have the right tools and the cooperation of the ecosystem’s gatekeepers to follow value across chains.

Unlike bitcoin, many stablecoins are issued by centralized organizations that can exert operational controls. “Issuers can monitor flows across their ecosystems, freeze or burn illicit funds and even reissue clean tokens to victims of hacks or theft,” Redbord said, pointing to enforcement levers unavailable in fully decentralized money.

The mix of public traceability and issuer controls creates new possibilities – and new chokepoints for issuers.

Rob Autrey, director of global advisory in North America for BioCatch, urged banks to stop the pipeline before tokens reach the crypto blockchain: “Start by flagging outbound payments to known crypto on ramps – i.e., wires, ACH and card transactions tied to exchanges or fiat to crypto platforms,” he said. Then fraud investigators can layer in behavioral rules to catch the setups that precede an exit to stablecoin rails.

The result is a familiar paradox: the characteristics of stability, liquidity, speed and interoperability that make stablecoins useful for payments also make them attractive for laundering. The same features also create novel enforcement tools when issuers and regulators cooperate.

“What’s unique about stablecoins is the ability for both issuers and regulators to have visibility over risks across a stablecoin’s ecosystem, including as tokens circulate ‘in the wild.’ This creates new possibilities for risk management and enforcement,” Koven said.

A Call for Better Cooperation

But cooperation is uneven and regulatory standards aren’t fully adapted. The shift from bitcoin to stablecoin is less a story of anonymity reclaimed than of markets maturing and criminal behavior following payment rails with the least friction. “Fraudsters are pivoting to stablecoins now because the environment is perfectly aligned,” Autrey said.

The technology to facilitate the money movement has matured, enforcement pressure has shifted and the economics work in the favor of criminals. Stablecoins held their peg through crypto crashes and bank failures, giving criminals confidence they can move size without volatility risks. Cross-chain bridges and swaps let them hop networks in seconds, cash out fast and blend into high-volume flows. Meanwhile, law enforcement is focused on high-profile coins like bitcoin and ethereum, while stablecoins still slip past traditional controls. The victims trust them, banks are less likely to alert on them and forensics tools are still catching up, Autrey added.

“Why now? Because stablecoins are fast, trusted and under-monitored. They’re not just enabling fraud. They’re accelerating it,” he said.

This alignment creates practical headaches for forensic teams. Stablecoins often run across multiple blockchains and move with greater speed, which “create[s] new challenges for tracing and attribution,” Redbord said, adding that public ledgers keep the data accessible but force a new emphasis on tools that “follow value across chains in real time.” On the banking side, by the time funds leave a bank and hit crypto rails, “recovery essentially doesn’t exist,” making upstream detection of mule activity, sudden behavior shifts and first-time crypto funding critical, Autrey said.

Trace Fooshee, strategic advisor at Datos Insights, described the trend as market-driven and evolutionary: “My sense is that what shift there has been has probably been building over time, though it’s likely that criminal use of stablecoin has increased at a commensurate rate with legitimate use,” he said.

Mainstream adoption and deeper liquidity appear to pull both legitimate and illicit flows toward payment rails that offer the least friction.

But liquidity is a double-edged sword. Autrey said that stablecoins often “rarely trigger fraud alerts and often fly under the radar,” while also being “fast, trusted and rarely scrutinized.” Criminals exploit that brief window, hopping chains, swapping tokens and cashing out into fiat before issuer controls, analytics and law enforcement converge. “That same predictability of issuer controls, token concentration and liquidity trace is exactly what will get them caught if they don’t cash out fast,” Autrey said.

Emerging Solutions

The technical contours help identify where defenders should focus: bridges, on ramps and off ramps, and emerging chains with lower compliance scrutiny. Redbord focused on TRON-based USDT for its volume and speed and urged monitoring of decentralized finance primitives such as Curve, Uniswap and THORChain, along with cross-chain messaging layers including LayerZero and Wormhole that can obscure provenance.

As interoperability grows, the problem shifts from the coin itself to the broader ecosystem of exchanges, swap protocols and fiat bridges that together form money-laundering pipelines.

The enforcement successes to date show the model’s potential – but also its limits. Firms such as TRM and Chainalysis report cases in which issuers and analytics providers worked with law enforcement to trace funds and return assets, but those gains are uneven across jurisdictions. Redbord framed the policy imperative in familiar compliance terms: Policy should extend the “same anti-money laundering/counter terrorism financing expectations as traditional financial institutions” to stablecoin issuers and platforms that facilitate their flows.

Regulators are moving in that direction. Legislative frameworks such as the European Union’s Markets in Crypto-Assets and the recently signed Genius Act aim to set guardrails for reserve transparency, supervision and consumer protections.

“The key isn’t reinventing the wheel, but applying the same tried-and-tested principles that already work in traditional finance: robust AML/CFT standards, strong consumer protections and clear prudential requirements,” Kovens said. For stablecoins specifically, she added: “transparency and accountability are essential. Issuers should be required to maintain high-quality, independently audited reserves and meet redemption and reporting standards.”

On the front lines, banks and fraud teams are adapting incrementally. Koven recommended that banks incorporate blockchain analytics into existing risk management frameworks, while Autrey urged better internal signal-sharing to catch scam pipelines before tokens leave the bank. Those are defensive, pragmatic changes that lean on a simple fact of chain data: Public ledgers provide more visibility than traditional wire rails ever did, but only if institutions use the right tools and cooperate across the ecosystem.

The net effect is a practical tension. The attributes that make stablecoins useful for legitimate finance also make them attractive for criminal use. The same attributes also create enforcement tools that did not exist in earlier crypto-eras: issuers who can freeze tokens, analytics firms that can stitch value across chains and regulators beginning to require audited reserves and robust AML frameworks. The major challenge facing the industry will be combining all of these capabilities quickly enough to stay ahead of an agile online criminal market.