Cryptocurrency and crypto crime

What is cryptocurrency?

A cryptocurrency is digital money issued and transferred over a decentralized network instead of a bank. No central authority clears payments: cryptography and distributed consensus do that job. Ownership is proved by a key, and whoever holds it controls the funds.

That separates a wallet from a bank account and explains the economics of crypto crime. There is no chargeback, no fraud desk and, in most jurisdictions, no deposit insurance. A transfer the network accepts is final, so crypto crime usually ends in permanent loss.

What is blockchain?

A blockchain is a shared ledger in which transactions are grouped into blocks, each cryptographically linked to the one before it. Nodes verify every block, so altering a past record would mean rewriting everything after it on most of those nodes. That design holds, which is why crypto crime goes around it.

Public chains are pseudonymous, not anonymous. Addresses are not names, but every transfer between them is visible and permanent. That is why investigators can follow stolen funds years after a theft, and why blockchain security debates misread where crypto crime happens: blockchain security is not the weak link. Some networks do add privacy features that limit what an observer can reconstruct.

How are cryptocurrencies generated and obtained?

Bitcoin uses proof of work: miners spend computing power on a puzzle and the winner adds the next block in exchange for new coins. Other networks use proof of stake, selecting validators by the collateral they commit. Most people never mine anything. They buy on a cryptocurrency exchange, handing custody to a company whose defenses are ordinary software defenses.

That handoff is where retail exposure to crypto crime begins: the platform's defenses become the user's defenses.

What is crypto crime?

Crypto crime is the set of offenses in which digital assets are stolen, extorted, used to pay for an illegal service or laundered after another crime. It is not one technique: an exchange breach, a fake investment platform and a ransomware payment are different crimes sharing one rail. That breadth is why crypto crime resists a single control.

Scale is best read from two measurements that should never be added together. Chainalysis estimates illicit addresses received at least USD 154 billion in 2025, a 162% increase driven mostly by a 694% rise in value received by sanctioned entities (Chainalysis, 2026 Crypto Crime Report). It calls that a lower-bound estimate, and notes illicit activity still represents below 1% of total attributed transaction volume.

The FBI figure counts something else: complaints filed by victims in one country. Both measure crypto crime, they measure different things, and conflating them is the commonest error in coverage.

Why crypto crime is a software problem, not only a blockchain problem

In the largest thefts of digital assets on record, what failed was the conventional software stack around the blockchain: hot wallets, signing services, cloud infrastructure, APIs, developer workstations and repositories holding live credentials. That is the layer where crypto crime operates.

Splitting the attack surface in two makes the pattern behind most crypto crime obvious.

Binance in 2026, Ronin in 2022, Mt. Gox between 2011 and 2014, DMM Bitcoin in 2024: four of the largest incidents, four off-chain compromises. The money moved on-chain, but the decision to move it was made somewhere a pentester could have reached first. Treating crypto crime as a cryptography problem sends defenders to the layer that held.

Most documented crypto crime losses trace back to the off-chain layer rather than to the blockchain itself.

Crypto crime at Fluid Attacks

We do not read blockchains. We test the software that controls them: the APIs, services, cloud resources, pipelines and repositories that decide which transactions get signed and sent. That is where crypto crime starts, and why penetration testing of those systems matters more than ledger analysis. Juan Restrepo, Certified DevSecOps Professional, wrote in his analysis of the incident:

"No single vulnerability explains the Binance hack. It was a chain of trusted access."

What we assess, and under what rules

We test systems our clients own or are authorized to let us test, under a defined scope, with evidence attached to every finding. For a company that moves digital assets, that scope covers the withdrawal and settlement APIs, the transaction-signing service, the cloud account holding wallet infrastructure, the deployment pipelines, and the repositories where credentials leak. Those five are where crypto crime gets its opening.

Key handling has its own catalog. The Fluid Attacks database publishes 13 cryptography requirements, including Protect system cryptographic keys (145), Remove cryptographic keys from RAM (146) and Separate keys for encryption and signatures (151), each mapped to weaknesses our testing reports against, such as 052 — Insecure encryption algorithm.

Thirteen cryptography requirements in our public database, from key protection to random number distribution.

What it looks like in practice

Each technique covers a different link in the chain of trusted access that crypto crime exploits.

The Secret Scanning piece is specific. In October 2026, Release 42 added detection rules for Kraken Private Key and Bitfinex Secret Key, plus live validity checks for Etherscan API Key and Alchemy API Token. A leaked cryptocurrency exchange credential is not a theoretical finding: the scanner reports whether it still works.

Findings are also grouped by what they would cost. The Fraud risk center sorts open vulnerabilities into Account Takeover, Payment Fraud, Data Harvesting and Fake Accounts, defining payment fraud as weaknesses that let an attacker use stolen payment instruments or manipulate a transaction to move money.

The platform groups open vulnerabilities by fraud outcome, so payment fraud and account takeover carry their own exposure level.

Manual testing versus scanners on money-movement logic

A scanner can tell you a function uses a broken hash. It cannot tell you a withdrawal endpoint will sign any well-formed request from a trusted internal service. That gap is measurable.

In Fluid Attacks' benchmark of 36 third-party AppSec tools against an application seeded with 1,201 vulnerabilities, a pentester alone found 743 vulnerabilities that no tool detected — 61.9% of the dataset and 86.8% of the target's total risk exposure.

Production data agrees: across systems assessed in 2025, manual review accounted for 11.6% of reported vulnerabilities but 44.2% of total risk exposure and 87% of the critical findings (State of Attacks 2026). Those are the findings that stop crypto crime. Restrepo's conclusion is the operational version of that data:

"The business logic of money-movement flows needs manual pentesting."

Where our testing meets the digital-asset stack

A custody platform is a web application, a set of APIs, a cloud account and a deployment pipeline before it is anything blockchain-specific, and those are the parts that failed in the record-setting thefts. Our scope covers that stack, so our findings map onto the crypto crime categories below.

Our team works the Web3 side too. In a LATAM meetup, our engineers walked through Ethereum fundamentals and how a smart contract audit is approached — the knowledge that lets a tester reason about where on-chain logic and off-chain infrastructure hand off.

Treat the signing service as the crown jewel

If one practice decides the rest, it is this: a signing service that honors any well-formed request from a trusted internal service turns control of that service into control of the funds. Binance reported no evidence of a leaked key, which points at the systems authorized to request a signature, not at the key material.

So the question is not whether an attacker can steal the key. It is whose request the service will honor, and what it would take to impersonate them. That is an authorization question, answered by a person trying it, not by a rule matching a pattern.

Types of crypto crime

These categories share a rail but not a method. Each has a documented case and a control that could have caught it.

Exchange breaches

An exchange breach is the theft of customer or treasury funds held by a trading platform, and it produces the largest single losses in crypto crime because exchanges concentrate assets. These incidents almost always start with an ordinary intrusion.

Mt. Gox once handled 70% of Bitcoin transactions before roughly 850,000 BTC drained from its wallets over several years. Binance, a decade later, lost about USD 6.3 billion in a day. The common factor is custody: funds in a hot wallet, reachable by software someone else can reach.

DeFi and cross-chain bridge exploits

Decentralized finance replaces the intermediary with code, so a flaw in the code is a flaw in the vault. A DeFi exploit against a cross-chain bridge is especially costly: bridges hold collateral for every wrapped asset they issued.

Our analysis of the most significant crypto crimes since 2011 documents both shapes. In Wormhole, attackers exploited a flaw in the bridge's signature verification code to mint wrapped ETH never backed by a deposit on the source chain. In Ronin, they obtained validator keys through social engineering and authorized withdrawals themselves. A DeFi exploit of that kind needs no cryptographic break.

Flash loan attacks

A flash loan lets a user borrow an asset with no collateral, on one condition: the borrowed amount and the fee are returned before the end of the same blockchain transaction. If repayment fails, the transaction is reverted and the loan never existed (Aave documentation).

This is often misdescribed as a time limit tied to block intervals. It is not. The constraint is atomicity inside one transaction, and that is what attackers exploit: in that single execution, borrowed capital large enough to move a thin liquidity pool can distort a price another smart contract reads as truth. PancakeBunny lost about USD 45 million to a flash loan attack in May 2021.

Money laundering and mixers

Stolen funds are only useful once they can be spent, which makes money laundering a standard stage of crypto crime. The sequence is usually rapid conversion on a decentralized exchange, movement across chains, a mixing service and fractional withdrawal through platforms with weak controls.

Mixing and privacy tools are not criminal by definition. What is documented is that specific services have been used to obscure the origin of stolen funds and sanctioned for it. The useful point is the inverse: public ledgers are permanent, so laundering leaves a trail investigators have followed back to named individuals.

Ransomware payments and cryptojacking

Crypto is the collection mechanism for most extortion operations. Ransomware groups typically demand payment in Bitcoin, which is why ransomware and crypto crime statistics overlap.

Cryptojacking is the quieter variant. Daniel Correa, a security expert at Fluid Attacks, described it as:

"Capturing machines, so third-party resources are devoted to mine cryptocurrencies,"

in an interview on the blog. Nothing is stolen outright; the cost shows up as degraded performance and inflated cloud bills.

Blockchains as criminal infrastructure

The newest category of crypto crime steals no coins. It uses the chain as infrastructure. Our research on the GlassWorm supply chain attack documented malware that reads its command-and-control instructions from the memo field of Solana transactions sent by the attacker's wallet.

The properties that make a public blockchain trustworthy for payments make it durable here too. Instructions cannot be edited or deleted, there is no registrar to serve a takedown on, and RPC node traffic looks like normal telemetry. Expect more of this form of crypto crime: none of it requires compromising the chain.

How to reduce exposure to crypto crime

If you build crypto platforms

• Test money-movement logic by hand: authorization in withdrawal, settlement and signing flows is where the business logic flaws behind crypto crime hide, and pattern matching does not find them.

• Validate every secret you detect: a key in a repository matters only if it still works.

• Constrain the signing service: require every signature request to carry an attribution a compromised internal service cannot forge alone.

• Keep testing as the system changes: a platform that deploys weekly cannot price its crypto crime exposure from an annual assessment.

If you hold digital assets

• Move long-term holdings to cold storage: an offline wallet removes the network path an attacker needs.

• Protect the key, not the account: whoever holds the private key controls the funds, and no support desk reverses a transfer.

• Enable multi-factor authentication on every cryptocurrency exchange account.

• Treat unsolicited investment offers as hostile: pitches on social media and messaging apps deliver most crypto scams, and crypto scams drive much of the reported crypto crime loss.

Conclusions

Crypto crime is not a cryptography failure. It is an application security failure denominated in digital assets. The ledger does what it was designed to do; the exchange, the bridge, the signing service and the laptop that reaches them are where crypto crime produces its losses.

That has a practical consequence. A company holding digital assets does not need to secure a blockchain. It needs to secure a web application, a set of APIs, a cloud account, a pipeline and a repository with the rigor a bank applies to its core systems, and someone testing the logic of the flows that move money. Defending against crypto crime is application security work, and crypto crime keeps paying because too few companies treat it that way.

Frequently asked questions

What is crypto crime?

Crypto crime is any criminal activity in which cryptocurrency is the target, the instrument or the payout: exchange breaches, DeFi exploits, flash loan manipulation, ransomware payments, cryptojacking, investment scams and laundering. Most crypto crime exploits the software and access controls around the blockchain, not the chain itself.

Can crypto transactions be traced?

Yes, on public chains. Addresses are pseudonymous rather than anonymous, and every transfer between them is permanently recorded and visible. Investigators have traced crypto crime proceeds across thousands of transactions and recovered assets years later. Some networks add privacy features that reduce that visibility.

What is the difference between a hot wallet and a cold wallet?

A hot wallet is connected to the internet so it can sign transactions on demand, which makes it convenient and reachable by attackers. A cold wallet keeps keys offline. Exchanges need hot wallets to operate, which is why their compromise accounts for the largest thefts in crypto crime.

How much of a crypto platform's risk sits outside the blockchain?

Nearly all of it. The largest crypto crime incidents on record were compromises of custody software, validator keys, employee endpoints and signing infrastructure. In Fluid Attacks' testing across systems assessed in 2025, manual review of application logic accounted for 44.2% of total risk exposure and 87% of critical findings; scanners found the volume of lower-severity issues.

Does Fluid Attacks test systems that handle cryptocurrency?

Yes. We test the applications, APIs, cloud infrastructure, pipelines and repositories that custody platforms and financial institutions run, including the business logic of withdrawal and signing flows. Our secret scanning carries detection rules for exchange credentials such as Kraken and Bitfinex keys, plus live validity checks on Etherscan and Alchemy tokens.

Stop crypto crime where it starts

Crypto crime begins in an application, not on a ledger: our pentesters and scanners test the APIs and pipelines that authorize every transfer, so the flaws behind crypto crime get fixed before anyone finds them. Start free trial · Contact us.