Darknet Vendors Shift to DeFi as Crypto Laundering Tactics Evolve

According to Chainalysis’ 2025 Crypto Crime Report, darknet market (DNM) vendors are adapting their money laundering tactics. While centralized exchanges (CEXs) remain the dominant cash-out method, a notable shift has been toward decentralized finance (DeFi) protocols. 

In 2024, DeFi played an increasing role in storing, transferring, and obfuscating illicit crypto proceeds.

Darknet Market Vendors Turn to DeFi

The increased use of DeFi comes amid tight regulations on centralized exchanges. With stricter Know Your Customer (KYC) and Anti-Money Laundering (AML) measures, illicit actors are facing greater challenges when attempting to cash out. Furthermore, law enforcement worldwide has stepped up its efforts, seized assets, and disrupted key money laundering networks.

In response, darknet market vendors are increasingly shifting their financial activity toward decentralized platforms. 

“Last year, DNM vendors sent a significantly higher portion of their funds to DeFi than they did historically,” the report read.

In terms of vendor behavior, the change is largely dominated by wholesale vendors. Meanwhile, retail vendors, who operate on a smaller scale, are holding more of their illicit earnings in personal wallets, delaying conversion to fiat to avoid detection. 

It is worth noting that the shift is not isolated to darknet markets. Scammed funds are also increasingly moving through decentralized protocols.

“But as scams on more blockchains including Ethereum, Tron, and Solana have grown, so too has the use of DeFi protocols,” the report noted.

While DeFi adoption among darknet vendors is growing, it has not replaced centralized exchanges as the primary laundering method. However, the trend is clear—illicit actors are expanding their strategies, forcing enforcement agencies to evolve their tracking methods to keep pace with increasingly sophisticated laundering techniques.

Another interesting trend is also the transition in the assets used. With law enforcement agencies improving their ability to track Bitcoin (BTC) transactions, darknet market operators and vendors are moving to Monero (XMR) as their cryptocurrency of choice. 

“As international authorities have disrupted DNMs large and small in the last few years, cybercriminals and drug dealers have learned firsthand the consequences of running BTC-accepting DNMs, given the currency’s inherent transparency. Many operators have since moved to accepting only Monero (XMR),” Chainalysis added.

Unlike BTC, which relies on a transparent public ledger, Monero offers built-in privacy features such as ring signatures, stealth addresses, and confidential transactions, making it nearly impossible to trace sender and receiver identities. 

The report also revealed that despite a likely record year for overall crypto crime revenue, inflows to darknet markets and fraud shops declined in 2024. Total darknet market revenue fell from $2.3 billion in 2023 to $2 billion in 2024.