Crime in Web3 is shifting away from Bitcoin (BTC) to stablecoins, and Ponzi schemes remain prevalent, according to Elliptic’s former head of technical crypto advisory.
Tara Annison shared the latest insights from the murky world of cryptocurrency-related crime during a presentation on the final day of EthCC in Paris, addressing a wide variety of ways digital assets are either facilitating crime or being used to launder funds.
The presentation drew Web3 crime insights from Elliptic, Chainalysis and TRM Labs, with Annison talking in her capacity as a former employee of Elliptic having recently left the firm.
According to Annison, Bitcoin is no longer the cryptocurrency of choice for illicit activities or laundering money. As the cryptocurrency industry has matured, the establishment of decentralized finance protocols, mixing services and stablecoins present new avenues for criminals to explore.
Slide from Annison’s presentation. Source: Tara Annison.
Criminals have shifted toward using dollar-denominated assets, like USD Coin (USDC), with their easy accessibility and ability to be laundered through decentralized exchanges (DEXs).
“The criminals use that as a target point. It’s also super easy to launder through DEXs. There’s deep liquidity, really good volume, so that’s pretty worrying.”
Annison highlighted a potential silver lining from a law enforcement perspective, noting that centralized issuers like Circle could freeze specific USDC tokens before criminals can “off-ramp out of the asset” into fiat through DEXs or centralized exchanges.
“What we’re seeing now is an increased number of accounts with USDC and USDT being blacklisted, and these are frozen funds that the criminals now can’t access.”
Ponzi and pyramid schemes remain a feature of the sector, with Annison noting that $7.8 billion was stolen from unwitting victims of these types of scams.
Criminals are finding more sophisticated ways to launder funds. Annison said chain swapping and asset swapping are prevalent as criminals try to hide illicit activity.
“We’ve seen that to the tune of about $4.1 billion. So they hop across using a DEX. They use a coin swap service, they use a mixer, they use a bridge, all basically to try and throw blockchain analytics firms off the trail.”
Annison said that $1.2 billion stolen from DEXs eventually ends up on centralized exchanges. In comparison with previous years, scams in the sector are down 46%. The reason, according to Annison, is the ongoing bear market, which has inevitably made the sector less appealing for cybercriminals.
“They’re less hyped up, the prices are lower, so it’s not as profitable for criminals. So at least next time we’re in a bear market, do bear in mind that the scams are at least down.”
Annison also touched on the increasing use of cryptocurrencies to evade sanctions and finance terrorist activities, highlighting TRON (TRX) and Tether (USDT) as popular assets for illicit use.
The advent of metaverse experiences has also seen the space attract nefarious actors. Various crimes are emerging in virtual worlds, including phishing attacks, nonfungible token theft, wallet tainting and augmented reality hacks.
Annison’s presentation highlighted the reality of criminal activity in the sector, which will demand increased security measures to protect users and combat illicit activities.
Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.
The Bank of England is worried that a rise in financiers’ lending to data center lending may cause an AI bubble reminiscent of the dot-com crash in the early 2000s.
A reference to China being an “enemy” of the UK was removed from key evidence for a collapsed spy trial in 2023 as it “did not reflect government policy” under the Conservatives at the time, according to the national security adviser.
In the letter published by parliament’s Joint Committee on National Security Strategy earlier on Friday, National Security Adviser (NSA) Jonathan Powell said Counter Terror Police and the Crown Prosecution Service were aware of the change made by Deputy National Security Adviser (DSNA) Matt Collins.
This would mean the CPS knew the “enemy” reference had been removed before charging the two suspects, according to Mr Powell.
In another letter published on Friday, the director of public prosecutions (DPP) Stephen Parkinson told the committee that it took DSNA Mr Collins more than a year to confirm to prosecutors he would not say China posed a threat to UK national security in court.
The DPP said a High Court judge ruled in June last year that an “enemy” under law is a state which “presently poses an active threat to the UK’s national security”, prompting the CPS to ask the DNSA whether China fulfilled that criteria.
He added prosecutors did not believe there would be “any difficulty in obtaining evidence” from Mr Collins that China was a national security threat, but added: “This was a sticking point that could not be overcome.”
More on China
Related Topics:
Mr Parkinson added that the DNSA’s “unwillingness” to describe China as an active or current threat was “fatal to the case” because Christopher Cash and Christopher Berry’s defence teams would have been entitled to call him as a witness.
The DPP added: “This factor is compounded by the fact that drafts of the first witness statement, reviewed by us in July 2025, showed that references to China being an ‘enemy’ or ‘possible enemy’ had been deleted.
“Those drafts would probably have been disclosable to the defence.”
Please use Chrome browser for a more accessible video player
0:38
What do we know about the China spy case?
A final draft of Mr Collins’ statement was sent to then-prime minister Rishi Sunak in December 2023, Mr Powell’s letter said.
“Drafts of a statement provided to DNSA included the term ‘enemy’ but he removed this term from the final draft as it did not reflect government policy,” the letter reads.
It comes amid a political row over the collapse of the prosecution of Christopher Berry and Christopher Cash last month, who were accused of conducting espionage for China.
Both individuals vehemently deny the claims.
Because the CPS was pursuing charges under the Official Secrets Act 1911, prosecutors would have had to show the defendants were acting for an “enemy”.
Please use Chrome browser for a more accessible video player
2:09
China spy row: Witness statements explained
DPP Mr Parkinson has come under pressure to provide a fuller explanation for the abandonment of the case.
He has blamed insufficient evidence being provided by the government that Beijing represented a threat to the UK at the time of the alleged offences.
The Conservatives have accused Sir Keir Starmer of letting the case collapse, but Labour has said there was nothing more it could have done.
The current government has insisted ministers did not intervene in the case or attempt to make representations to ensure the strength of evidence, for fear of interfering with the course of justice.
Image: Sir Keir Starmer met Chinese premier Xi Jingping in November 2024. Pic: PA
The DNSA and DPP will face questions from the parliamentary committee on Monday afternoon.
The current attorney general, Lord Hermer, and the chancellor of the duchy of Lancaster, Darren Jones, will be questioned on Wednesday.
The PM’s spokesman reiterated the government’s position that “what is relevant in a criminal case of this nature is the government’s position at the time of the alleged offences”.