Hundreds of millions in crypto flow to global trafficking rings as telegram fuels shift

Hundreds of millions of dollars in cryptocurrency flowed through wallets tied to suspected human trafficking networks in 2025, as criminal groups increasingly abandoned traditional darknet forums for encrypted messaging platforms such as Telegram, according to a new report by Chainalysis.

The blockchain analytics firm said crypto payments linked to trafficking-related activity jumped 85 percent over the past year, reflecting what it described as a growing convergence between digital finance and organised exploitation networks.

While much of the operational infrastructure, including scam compounds and laundering hubs, was concentrated in Southeast Asia, the money told a different story. Payments were traced back to customers across North and South America, Europe and Australia, highlighting the global demand sustaining the trade.

From darknet to messaging apps

Researchers observed a clear migration away from older darknet marketplaces into semi-open Telegram channels, where services are advertised, recruits are sourced and payments coordinated in real time.

On these channels, operators marketed cross-border escort packages, multi-day companionship services and job placements promising lucrative overseas roles. Pricing tiers were often laid out in detail, with some premium offerings exceeding $30,000.

The move to messaging apps, combined with crypto payments, has lowered barriers to entry and increased scale. Wallet clusters analysed by Chainalysis showed repeated high-value transfers, nearly half above $10,000 in the escort category, suggesting professionalised networks rather than isolated actors.

Tom McLouth, a Chainalysis intelligence analyst, said the blend of encrypted communications and digital assets has enabled trafficking groups to function more like structured enterprises. The result, he noted, is faster settlement, global reach and fewer traditional financial choke points.

Read more: After $205bn in transactions, Africa’s crypto growth shifts from trading to payments

Stablecoins and laundering pipelines

The report found that stablecoins have become a preferred payment method, offering speed and relative price stability. Once funds are received, they are often routed through Chinese-language laundering networks operating primarily on Telegram.

These networks help clean illicit proceeds by moving them through layers of cryptocurrency transactions. Chainalysis estimates that such laundering services were linked to roughly $16.1 billion in illicit crypto flows in 2025 alone.

In many cases, recruitment channels for labour placements were directly connected to wallets previously associated with illegal gambling platforms and money laundering services, evidence of deep integration across criminal enterprises, the firm said.

Scam compounds and forced labour

Another significant stream of payments was tied to labour recruiters advertising jobs in countries such as Cambodia and Myanmar. Prospective workers were asked to pay between $1,000 and $10,000 in cryptocurrency for travel and placement.

Once on site, victims were allegedly forced to run romance scams, bogus crypto investment schemes and other online frauds targeting individuals abroad.

The scale of these scam compounds became more visible after the United States Department of Justice last year announced the seizure of $15 billion in bitcoin connected to a Cambodian operation accused of orchestrating large-scale romance scams.

Despite enforcement actions, Chainalysis said the broader ecosystem has proven adaptive, shifting infrastructure and communication channels when pressured.

Read more: Bitcoin slides below $70,000 as crypto rout deepens

CSAM networks and privacy coins

The report also tracked cryptocurrency flows tied to child sexual abuse material (CSAM) vendors. Here, payment patterns differed as about half of transactions were below $100, consistent with subscription-style access in private chat groups.

Funds frequently moved from mainstream cryptocurrencies into privacy-focused assets such as Monero, or through instant exchanges that require minimal identity verification, complicating investigative efforts.

One case cited in the report involved a major dark web CSAM platform that used more than 5,800 crypto addresses and generated over $530,000 in revenue since mid-2022 before being identified with assistance from Chainalysis following a UK law enforcement lead.

Visibility in a borderless system

Even as trafficking networks exploit the speed and reach of crypto, Chainalysis argues that blockchain transparency provides investigators with an unprecedented window into financial flows.

The financial totals, at least hundreds of millions of dollars in 2025, capture only part of the picture, McLouth said, noting that the human cost behind the transactions is far greater than any on-chain value.

As crypto adoption continues to expand globally, the firm expects illicit use to rise alongside legitimate activity. The shift toward Telegram-based ecosystems, however, marks a structural change, in that trafficking networks are no longer confined to hidden marketplaces but are operating in fluid, semi-public digital spaces where recruitment, advertising and payment converge.

For authorities, that convergence presents both a challenge and an opportunity, a fast-moving, borderless threat recorded in permanent, traceable code.