KEY TAKEAWAYS
- CipherTrace, founded in 2015 and acquired by Mastercard in October 2021, developed cryptocurrency anti-money laundering and blockchain analytics solutions. SecurityWeek reported that its platform covered more than 900 cryptocurrencies.
- Chainalysis reported in its 2026 Crypto Crime Report that illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase, while illicit activity still represented less than 1% of total attributed on-chain transaction volume.
- Blockchain analytics platforms use transaction graph analysis, wallet clustering, and risk scoring to trace fund flows across multiple blockchains, flagging connections to sanctioned entities and known illicit addresses.
- Stablecoins accounted for 84% of all illicit transaction volume in 2025, displacing Bitcoin, which dropped to approximately 7%, according to Chainalysis figures reported by BeInCrypto.
- North Korean-linked hackers stole $2 billion in cryptocurrency during 2025. Chainalysis described 2025 as the most severe year on record for cryptocurrency theft by DPRK-linked actors, measured by the value stolen.
Illicit cryptocurrency addresses received at least $154 billion in digital assets during 2025, a 162% year-over-year increase, according to Chainalysis.
That record figure arrived alongside a parallel reality: illicit activity still represented less than 1% of total attributed crypto transaction volume. The gap between those two numbers defines the operating environment for blockchain analytics companies like Chainalysis and Elliptic, as well as CipherTrace, whose product offerings were scaled back after Mastercard discontinued several of its products in 2024.
This article examines how CipherTrace developed its blockchain analytics platform, the changes following its acquisition by Mastercard, and how competing platforms track illicit transactions across multiple blockchains.
How CipherTrace Built Its Blockchain Analytics Platform
CipherTrace was founded in 2015 in Menlo Park, California, by Dave Jevans, who had been tracking Bitcoin criminal activity since 2011. The company built a platform focused on cryptocurrency anti-money laundering (AML) compliance, blockchain forensics, and fraud detection. Its products and services were later affected by Mastercard’s decision to discontinue several CipherTrace offerings in March 2024.
SecurityWeek reported that CipherTrace’s platform covered more than 900 cryptocurrencies. The company separately claimed coverage of more than 2,000 cryptocurrency entities through its proprietary clustering algorithms and data attribution systems.
Mastercard agreed to acquire CipherTrace in September 2021 for an undisclosed sum, with the deal closing in October 2021.
Ajay Bhalla, President of Cyber and Intelligence at Mastercard, stated: “With the rapid growth of the digital asset ecosystem comes the need to ensure it is trusted and safe. Our aim is to build upon the complementary capabilities of Mastercard and CipherTrace to do just this,” according to the acquisition announcement.
CipherTrace developed several products for cryptocurrency compliance and blockchain analytics. However, their current availability should not be assumed. In March 2024, Mastercard discontinued three key CipherTrace products: Armada, Inspector, and Sentry. Mastercard clarified that CipherTrace itself was not shutting down, according to Fortune.
CipherTrace previously offered blockchain forensic tools that enabled investigators to trace fund movements linked to criminal activity, fraud, and sanctions evasion. Mastercard discontinued its Inspector transaction-tracing interface and Sentry anti-money laundering tool in March 2024. The available information does not establish the current status of its other products, including Traveler.
Dave Jevans, then Chief Executive Officer of CipherTrace, said in 2021: “We help companies, whether they are banks or cryptocurrency exchanges, government regulators or law enforcement, to keep the crypto economy safe,” according to FinTech Futures.
Transaction Tracing Combines Clustering Algorithms With Risk Scoring
Blockchain analytics platforms trace illicit transactions through a combination of address clustering, transaction graph analysis, and real-time risk scoring. These systems use data attribution and machine learning to trace fund flows between legitimate entities and suspected criminal enterprises.
The platforms assign risk scores to individual wallet addresses and transactions based on their proximity to known illicit activity, according to CB Insights’ analysis.
Address attribution is the foundation of the entire system. Analytics firms map blockchain addresses to real-world entities through proprietary data collection, law enforcement partnerships, and open-source intelligence gathering.
When a known ransomware wallet sends funds to a new address, clustering algorithms can link that new address to the same entity. CipherTrace’s platform historically offered transaction risk scoring, wallet tracing, entity risk profiling, address attribution, dark web monitoring, and sanctions screening. However, Mastercard discontinued its Inspector and Sentry products in March 2024.
The 2026 Chainalysis Crypto Crime Report revealed that the on-chain money laundering ecosystem expanded from roughly $10 billion in 2020 to more than $82 billion in 2025, according to Chainalysis. Sanctioned entities accounted for approximately $104 billion of the $154 billion in total illicit crypto flows, representing roughly two-thirds of all illicit on-chain activity.
Sanctions-related crypto activity increased by 694% year-over-year, with sanctioned entities receiving approximately $104 billion in cryptocurrency during 2025, according to Chainalysis. Cross-chain tracing represents an important technical challenge for analytics platforms.
Elliptic’s 2025 research identified more than $21.8 billion in illicit and high-risk crypto laundered using cross-chain methods. This highlights the difficulty of tracking funds as they move between different blockchain networks through bridges and decentralized exchanges. Blockchain analytics providers face the challenge of tracing these transactions across multiple networks.
Crypto Crime Has Shifted From Opportunistic Theft to State-Sponsored Operations
The 2026 Chainalysis Crypto Crime Report frames 2025 as the third wave of crypto crime evolution. The first wave from 2009 through 2019 was characterized by rogue cybercriminals operating independently. The second wave saw the rise of organized criminal networks.
The third wave, now underway, features nation-state actors using cryptocurrency for sanctions evasion and other state-backed operations, according to Chainalysis.
North Korean-linked hackers stole $2 billion in cryptocurrency during 2025, making it the most severe year on record for DPRK-linked cryptocurrency theft by value stolen, according to Chainalysis. The report explained that these threat actors are increasingly achieving outsized results, often by embedding IT workers inside crypto services, with additional qualifications in the original report.
Those operations represent systematic state-level infiltration rather than opportunistic external attacks. Stablecoins displaced Bitcoin as the primary vehicle for illicit transactions. By 2025, stablecoins accounted for 84% of all illicit transaction volume while Bitcoin dropped to approximately 7%, according to figures reported by BeInCrypto.
That shift creates both challenges and opportunities for analytics platforms. Stablecoin issuers like Tether and Circle can freeze addresses associated with illicit activity, a capability that decentralized cryptocurrencies generally do not offer at the protocol level. However, the volume and speed of stablecoin transactions require more sophisticated monitoring infrastructure.
Paul Marrinan, Founder of Tuath Consulting, wrote in a Thomson Reuters analysis published in March 2026 that forensic companies had identified at least $154 billion in illicit cryptocurrency activity during 2025. He cautioned that current estimates may represent only part of the problem, reflecting the limitations of measuring illicit activity across blockchain networks, according to Thomson Reuters.
What’s Next?
Blockchain analytics platforms are working to address the $21.8 billion in illicit and high-risk cryptocurrency laundering through cross-chain methods identified by Elliptic. Multi-chain transaction tracing, real-time DeFi protocol monitoring, and artificial intelligence-driven pattern detection remain important capabilities for blockchain analytics providers.
The shift toward state-sponsored crypto crime is likely to sustain institutional demand for blockchain analytics and compliance tools as regulators, financial institutions, and law enforcement agencies seek to identify illicit fund flows.
FAQs
What is CipherTrace and who owns it?
CipherTrace is a blockchain analytics and cryptocurrency compliance company founded in 2015 in California. Mastercard agreed to acquire the company in September 2021, and the deal closed in October 2021, for an undisclosed sum. Mastercard discontinued several CipherTrace products in March 2024 but stated that CipherTrace itself was not shutting down.
How do blockchain analytics tools track illicit crypto transactions?
Blockchain analytics platforms use address clustering, transaction graph analysis, machine-learning risk scoring, and proprietary entity-attribution databases to trace cryptocurrency fund flows and identify connections to known illicit actors, sanctioned entities, and suspicious wallets.
How much illicit cryptocurrency activity occurred in 2025?
Chainalysis reported in its 2026 Crypto Crime Report that illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase, with sanctioned entities accounting for approximately $104 billion of the total.
What percentage of crypto transactions are illicit?
Despite the record $154 billion in illicit flows during 2025, Chainalysis estimates that illicit activity still represents less than 1% of all attributed cryptocurrency transaction volume on-chain.
Which cryptocurrency type is most used for illicit transactions?
Stablecoins accounted for 84% of all illicit transaction volume in 2025, displacing Bitcoin, which dropped to approximately 7% of illicit flows that year, according to figures reported by BeInCrypto.
What is the FATF Travel Rule for cryptocurrency?
The Financial Action Task Force Travel Rule requires Virtual Asset Service Providers to collect and transmit originator and beneficiary identification information for cryptocurrency transactions exceeding applicable jurisdictional thresholds.
How does CipherTrace compare to Chainalysis and Elliptic?
CipherTrace, Chainalysis, and Elliptic have developed blockchain analytics and cryptocurrency compliance solutions. CipherTrace’s product offerings were scaled back after Mastercard discontinued several products in March 2024, while Chainalysis and Elliptic continue to operate in the blockchain analytics sector.
References
- Chainalysis via Cointelegraph, Sanctions Drive Illicit Crypto Transactions to Record in 2025
- SecurityWeek, Mastercard to Acquire Blockchain Analytics Firm CipherTrace
- Thomson Reuters Institute, Crypto Crime, Caveats & Clarity: How Crypto Forensics Has Evolved
- BeInCrypto, Illicit Crypto Hits All-Time High $154B; Stablecoins Lead at 84%
