Global Crypto Flows Fuel Expanding Human Trafficking Networks, Blockchain Data Shows

Payments made using cryptocurrency to groups suspected of running human trafficking operations increased by 85% during 2025, with investigators tracing hundreds of millions of dollars in activity across public blockchain networks, according to new research released by Chainalysis. The U.S.-based blockchain intelligence company reported that the majority of this activity was tied to a rapidly growing criminal infrastructure centered in Southeast Asia, where scam compounds, illegal online gambling operations, and Chinese-language money laundering networks function in an interconnected ecosystem. Researchers concluded that cryptocurrency activity linked to trafficking operations generally fell into three main categories: international escort and prostitution services, labor recruitment operations connected to scam compounds, and vendors distributing child sexual abuse material. Although the majority of services appeared geographically concentrated in Southeast Asia, the customer base was truly global, with payments originating from North and South America, Africa, Europe, and Australia, demonstrating the worldwide reach of these criminal operations.

The research also found that cybercriminal networks are increasingly using messaging platforms such as Telegram to advertise illicit services, recruit victims, and coordinate payment flows. “There’s a broader migration from older darknet forums into messaging apps and semi-open Telegram ecosystems, which, combined with crypto, let these networks scale faster, run ‘customer services,’ and move money globally with much less friction,” said Chainalysis intelligence analyst Tom McLouth. The firm noted that public blockchain transparency simultaneously provides what it described as “unprecedented visibility” into criminal money movement, enabling investigators to map illicit financial networks and disrupt them more effectively. “The key takeaway is that the true financial scale is large, at least hundreds of millions of USD worth of crypto transactions, and the physical harm is orders of magnitude greater than any dollar figure,” McLouth said.

Blockchain transaction patterns suggested that many payments were linked to highly coordinated escort and prostitution networks. While some escort or sex work services operate legally in certain jurisdictions, the report indicated that trafficking-linked operations often reveal themselves through distinctive financial signatures. Investigators found that suspected trafficking networks increasingly rely on stablecoins combined with Chinese-language laundering groups to quickly convert cryptocurrency into usable funds. These laundering groups primarily operate through Chinese-language Telegram channels, helping criminals move and “clean” illicit cryptocurrency, contributing to an estimated $16.1 billion in illicit crypto flows during 2025. The data also showed that crypto-linked international escort services represented a large share of high-value transactions identified in the report, with nearly half of transactions exceeding $10,000. Listings reviewed by researchers advertised cross-border travel arrangements, multi-day “companionship” packages, and tiered service pricing, with VIP offerings often exceeding $30,000. The consistency and scale of transfers, along with recurring payment routes between clusters of digital wallets, pointed toward professionalized criminal enterprises rather than isolated actors. Crypto payments tied to suspected prostitution networks, by contrast, showed clusters of smaller transfers typically ranging from $1,000 to $10,000, though researchers said the patterns still suggested organized group activity.

Another major area of concern involved so-called labor placement agents that recruit individuals into scam compounds, primarily located in Southeast Asia and frequently involved in crypto-enabled fraud schemes. According to the research, recruitment fees usually ranged between $1,000 and $10,000 in cryptocurrency, matching pricing structures promoted on Telegram recruitment channels. The report highlighted examples of job postings advertising positions such as “customer service” or “data entry” roles in countries like Cambodia or Myanmar, often promising high salaries and paid travel costs. Once recruited, victims were allegedly forced into conducting romance scams, fake cryptocurrency investment frauds, and other online schemes targeting victims overseas. In some Telegram conversations reviewed by investigators, recruiters openly discussed moving workers across borders, arranging forged identification documents, and coordinating payments to facilitators. Researchers also found digital connections between recruitment channels and cryptocurrency wallets previously linked to illegal gambling platforms and money laundering services, suggesting that trafficking activity was deeply integrated into broader criminal ecosystems.

The scale of these scam compounds became more widely understood last year when the U.S. Department of Justice seized $15 billion worth of bitcoin connected to a large Cambodian scam center running international romance fraud operations. “Since late 2025 we’ve seen more enforcement around parts of this ecosystem, especially scam compounds, but the underlying sexual exploitation and trafficking networks can often keep operating via alternative infrastructure, both physical and digital,” McLouth said.

Chainalysis also identified organized networks involved in the distribution of child sexual abuse material, which operate under different payment models but show similarly structured financial behavior. Approximately half of crypto transactions linked to CSAM activity were below $100, reflecting subscription-style payment models and low-cost per-user access to content through encrypted file-sharing or private chat groups. Investigators observed funds moving from mainstream cryptocurrencies into privacy-focused digital assets and instant exchange services that do not require identity verification. The report also found overlaps between CSAM payment networks and communities linked to what researchers described as “sadistic online extremism.” “These [sadistic online extremism] groups specifically target and manipulate minors through sophisticated sextortion schemes, with the resulting content being monetized through cryptocurrency payments, perpetuating cycles of abuse,” the report said.

In July 2025, Chainalysis said it assisted investigators in identifying one of the largest CSAM websites operating on the dark web after a lead from UK law enforcement authorities. The single operation reportedly used more than 5,800 cryptocurrency wallet addresses and generated over $530,000 in revenue since July 2022. Looking ahead, McLouth warned that illicit crypto usage linked to trafficking is unlikely to decline even as enforcement improves. “In general, as crypto adoption grows, its use for both illicit and legitimate purposes will increase. In the near term, I don’t expect crypto use in trafficking-linked activity to go away, if anything, I expect it to keep growing even as enforcement gets better.”

By fLEXI tEAM