The European Union is in late-stage talks about implementing new rules to curb shady behavior using virtual assets - but estimates of the percentage of crypto payments associated with financial crime vary widely, from 0.15% to a whopping 46% of transaction volume.
There is clearly a lot of illegal activity in the crypto world - some of which, like fraud or hacks, is harmful to honest crypto users, while others seem like a way to circumvent rules that were unfair in the first place, like government-imposed capital controls.
The crypto industry likes to cite the numbers at the low end of the scale, and on Friday, Binance CEO Changpeng "CZ" Zhao tweeted statistics to argue that crypto is safer than fiat.
However, trying to get a handle on the exact scale of illicit activity involving virtual assets is not easy. It usually involves identifying crypto addresses that appear suspicious and tallying up their trading volumes - but illicit users generally prefer to hide in the shadows.
The outcome depends on how sure you want to be about who the illegal players are on the Internet. If you consider a wallet address suspicious, you may want definitive proof, or you may settle for something more probable and speculative.
For regulators, judges, and law enforcement, understanding the problem could prove critical in determining whether new laws forcing crypto users to identify themselves are necessary or even legal.
Still, there is surprisingly little consensus on how big cryptocrime is. Almost certainly, in dollar terms, it dwarfs the real-world version. According to the UN Office on Drugs and Crime, the value of money laundering through conventional financial transactions is as much as $2 trillion, which is the total value of all the world's crypto markets combined.
However, regulators are concerned not only about the total volume, but also about the share of the crypto sector. They have noted how quickly virtual assets are gaining popularity and are concerned about how big the problem could be in the future, not just today.
In a recent speech criticizing the industry as a sort of lawless Wild West, Fabio Panetta of the European Central Bank cited a wide range of figures for illegal crypto activity, ranging from under 1% to half of all virtual transactions.
One reason for the disparity in figures is whether, for example, drug purchases are considered as a proportion of crypto payments or in comparison to the overall market. Those who purchase Bitcoin (BTC) just to "HODL" aren't doing anything wrong - but that means a larger proportion of those who use it to buy something are likely to be involved in illegal activity.
What wallet?
But beyond the question of what exactly is being counted, there's also the question of how these transactions are being counted - and that depends on how you determine who the bad actors are.
Industry insiders and academics like CZ or Georgetown Law's Chris Brummer often cite figures from blockchain specialist Chainalysis, which said in January that transactions with illicit addresses accounted for just 0.15% of cryptocurrency transaction volume last year.
But that approach leaves out many crimes, Sean Foley, an associate professor of applied finance at Macquarie University in Australia, told CoinDesk.
Foley's own paper, tellingly titled "Sex, Drugs, and Bitcoin," was peer-reviewed and published in the Review of Financial Studies in 2019. It concluded that a quarter of Bitcoin users engage in illicit activity, and that the $76 billion in illicit payments made with Bitcoin account for 46% of the currency's total transactions.
That's a much higher estimate than others in the market - but Foley defended his methods in an interview with CoinDesk.
Chainalysis "aren't necessarily very transparent in their approach," he said. "They don't really document exactly how they arrive at their numbers."
"If Chainalysis just looks at Ross Ulbricht's wallet, which was seized by the FBI, but I look at all of his behavior over time. ... I'm going to find a lot more," he said, referring to the founder of the Silk Road marketplace who was sentenced to prison in 2015.
Rather than just looking at suspicious addresses, Foley examined the networks and the behavior of individual users, using statistical techniques that are also used in fields such as medicine and nuclear security.
Although using a blender to maintain anonymity is not proof of bad behavior, various indicators taken together can give a good idea of whether someone is up to no good, he says.
"If you look shady because you've dealt predominantly with shady people, and if you look shady because you've used a lot of file-sharing sites, and if there was a lot of activity when darknet marketplaces were seized ... then we can say with a much higher level of confidence that they're probably illegal actors," he said.
Too far gone?
Others warn that Foley may have gone too far and unfairly implicated innocent crypto users by association.
"You have to be really careful with crime data and the associations you make between wallets," Kim Grauer, research director at Chainalysis, told CoinDesk. Chainalysis says illicit wallets received $14 billion in 2021, a figure much lower than Foley's.
"A lot of times people see money being transferred between one criminal wallet and another wallet, and they say, 'Hey, they must be connected,'" she said - citing examples where a single service managed millions of different addresses.
The "whimsical" nature of blockchain means that "unless you're a criminal investigator with blockchain experience, I would be a little skeptical of some of the definitive associations," she said.
Chainalysis' own data, unlike Foley's, "is not extrapolated, it's not statistically determined," she said. "This is the actual number of transactions identified as illegal from a dataset that is the most powerful dataset on cryptocurrencies in the world."
The Chainalysis figure is still not all-inclusive, she acknowledged. It does not include real-world crimes like street-level drug deals that are then laundered through Bitcoin, nor does it include gray areas like wash trading - the fake sales designed to drive up market prices that are increasingly common in the non-fungible token market.
Frauds often can't be detected until the rug has already been pulled, which means data for a given year can be lagging and needs to be updated. But she said an approach based on "hundreds of investigators" searching darknet forums for crimes is "definitely, definitely fair."
Too old?
Another problem is how quickly data becomes obsolete in such a fast-moving market. The data Foley used was from 2017 - an eternity in the crypto world - but he believes the problem has only increased since then.
He acknowledges that illicit Bitcoin volumes have likely declined over time - but only because perpetrators have turned to less conspicuous alternatives, such as ZCash, Monero and Dash.
"There's a lot of privacy technology that's been developed since our paper was published," he said, and he believes overall criminal use of cryptocurrencies "is not declining."
"There are still a lot of online marketplaces for darknet products, so I don't think that's gone away," he said - also pointing to the rise of industrial-scale ransomware like the $5 million Colonial Pipeline hack in 2021.
Regulators unconvinced
Those who really need convincing, of course, are the Financial Action Task Force, the international body responsible for developing money laundering standards for conventional finance and the crypto sector - including the controversial travel rule the EU is now trying to implement.
In a report published in July 2021, the FATF found significant variation in estimates of illicit crypto trading, both over time and between different analysts such as Chainalysis, Elliptic and Merkle Science - which Grauer said could be because they are looking at a different universe of transactions or currencies.
Whatever the reason, the FATF believes analysts' estimates of the percentage of illicit transactions, which range from 0.1% to 15.4%, are too low.
"The data presented relate only to identified illicit transactions that companies can identify based on lists of known or suspected illicit addresses," the FATF report states. The figures from companies such as Chainalysis should be "considered as a likely minimum," it concludes.
Grauer also seems to concede this point - saying that the figure she favors "represents a lower bound on the level of illicit activity.
"We wouldn't know how many [illegal actors] are missing," she said. "You don't know what you don't know ... if we knew about it, we would include it in our system."
In the end, Foley and Grauer may have reached different conclusions because they have different goals. In the first case, the goal is to estimate the total volume associated with crimes; in the second, the goal is to identify individual users who might be worth tracking - something that requires a much higher burden of proof.
Methods like Foley's are "certainly very useful," Grauer said, but she cautioned that the results should not be relied upon to identify illegal wallets.
"People are using our data set to do extensive investigations, including detaining people," she said - so she wouldn't blacklist someone lightly.
This is relevant to live policy. In March, the European Parliament voted to introduce new checks on the identities of those making even the smallest crypto payments - including, and this is particularly controversial, when transactions are made with non-hosted wallets that are not managed by a regulated exchange.
The idea behind this - the details of which have yet to be agreed with national governments - is that law enforcement agencies would then be able to more easily track crypto transactions that could be used to fund serious crimes such as terrorism or child pornography. But the move faced a number of oppositions from industry players like Coinbase (COIN), who said the bill could stifle innovation and compromise privacy.
Laws that are more invasive than necessary could be repealed, legal experts like Thibaut Schrepel of the University of Amsterdam told CoinDesk. That message seems to have resonated with officials like Gabriel Hugonnot of the European Commission, who warned lawmakers that they would have to justify attempts to treat cryptocurrencies differently from other types of financial transfers.
In considering whether the law is really necessary, policymakers - and ultimately judges - may be swayed by figures on the overall scale of the cryptocrime problem and by other features of crypto technology such as network transparency.
However inaccurate the numbers may be, the kind of analysis that is possible on the blockchain is still much better than offline statistics on financial crime, Grauer says.
"There is no comparable number in the fiat world because that kind of research just isn't possible," she said. "How many drug dealers are there in the world in U.S. dollars? There's never a number you can get.
But ultimately, good policies rely on good data - and that may be in short supply.