On-Chain Transparency and Compliance Statistics 2026: 40 Figures

Updated October 2026. Every figure on this page was checked against its source in October 2026.

Public blockchains carried 3.8 billion successful transactions a month in early 2025, according to the US Treasury, and the sender, recipient and amount of each transfer can be read by anyone, including a company's customers, vendors and partners. Analytics firms turn that data into names at scale: Elliptic says it has labeled more than 1 billion crypto addresses. Rules have tightened in parallel, with 83% of jurisdictions in the FATF's 2026 survey reporting Travel Rule laws.

Key statistics

• Illicit crypto addresses received at least $154 billion in 2025, up 162% from 2024, according to Chainalysis.
• Illicit activity made up 1.2% of total attributed on-chain volume in 2025, down from 1.3% in 2024, according to TRM Labs.
• Stablecoins accounted for 84% of illicit crypto transaction volume in 2025, according to Chainalysis.
• Successful monthly transactions on public blockchains reached 3.8 billion in early 2025, up 96% year over year, according to the US Treasury.
• Elliptic states that it has labeled more than 1 billion crypto addresses across more than 65 blockchains, bridges and tokens.
• In the FATF's 2026 survey, 83% of responding jurisdictions (91 of 109) had passed Travel Rule legislation, up from 73% in 2025, according to the FATF.
• As of April 2026, only 34% of 149 assessed jurisdictions were largely compliant with the FATF's crypto standard, Recommendation 15, according to the FATF.
• MiCA has applied in full across the EU since December 30, 2024, under Regulation (EU) 2023/1114.
• The GENIUS Act, signed on July 18, 2025, takes effect by January 18, 2027 at the latest, under Public Law 119-27.
• OKX agreed to pay more than $504 million after pleading guilty on February 24, 2025 to operating an unlicensed money transmitting business, according to the US Department of Justice.

What a public blockchain shows about a business

Every transfer on a public chain is stored with its sender, recipient, amount and time. For a business, that puts payroll, supplier payments and treasury moves in front of the people it trades with. Our On-Chain Treasury Exposure Report shows what public corporate wallets reveal in practice.

1. 3.8 billion successful transactions a month on public blockchains

Successful monthly transactions on public blockchains reached 3.8 billion in early 2025, up 96% year over year, according to the US Treasury's March 2026 report to Congress on technologies to counter illicit finance involving digital assets. Each of those transactions sits on a ledger that any customer, supplier or partner can query.

2. $46 trillion in stablecoin transaction volume in one year

Stablecoins processed $46 trillion in total transaction volume, or $9 trillion on an adjusted basis that filters out bots and other inflationary activity, in the 12 months covered by a16z crypto's State of Crypto 2025 report, published October 22, 2025. The more payments run on stablecoins, the more commercial data lands on public ledgers.

3. 270 million address poisoning attempts built from public transaction histories

Researchers at Carnegie Mellon University counted more than 270 million address poisoning attempts against over 17 million victims on Ethereum and BNB Smart Chain between July 1, 2022 and June 30, 2024, with 6,633 successful transfers worth more than $83.8 million, in a paper presented at USENIX Security 2025. The attack works because a wallet's past counterparties are public, so a lookalike address can be planted in its history.

How wallets get linked to names

A wallet address is a pseudonym until someone labels it. Labels come from analytics vendors, exchange records and the public history itself, and once applied they reach back over every past transfer. Counterparties can do the same work by hand, as shown in how counterparties reverse-engineer an OTC desk's book from on-chain settlement.

4. More than 1 billion crypto addresses labeled by one analytics firm

Elliptic states that it has labeled more than 1 billion crypto addresses and covers more than 65 blockchains, bridges and tokens (company website, accessed October 16, 2026). Once a business wallet carries a label, its payment history is tied to its name.

5. More than 500 million labeled addresses on Nansen

Nansen states that its platform holds more than 500 million labeled addresses and shows how funds, whales and public figures move in real time (company website, accessed October 16, 2026). Wallet labels are a commercial product, so anyone a business pays can access the same view.

6. Chainalysis raised its 2024 illicit estimate from $40.9 billion to $57.2 billion

The Chainalysis 2026 Crypto Crime Report raised its estimate of 2024 illicit crypto volume from $40.9 billion at publication to $57.2 billion one year later, as it identified more illicit addresses and added their historical activity. On a public chain, attribution keeps working backward: an address labeled today exposes every transfer it ever made.

7. TRM Labs raised its 2023 illicit estimate from $34.8 billion to more than $58 billion

TRM Labs reports that its estimate of 2023 illicit crypto volume rose from $34.8 billion at publication to more than $58 billion as new data emerged. TRM describes its current totals as a conservative baseline that it expects to revise upward.

8. 65 of more than 220 Treasury comments covered blockchain monitoring

Of the more than 220 public comments the US Treasury reviewed for its March 2026 report, 65 discussed blockchain monitoring, and commenters broadly agreed that financial institutions with substantial digital asset exposure already use blockchain analytics in their AML and sanctions programs. The same report lists address attribution and clustering, transaction tracing and counterparty risk scoring as core features, often combined with off-chain data such as IP address and device data.

How much on-chain volume is illicit?

The two largest public estimates come from Chainalysis and TRM Labs. They measure differently, so their totals differ, but both put the illicit share of on-chain volume close to 1% and both place stablecoins at the center of illicit flows.

9. $154 billion received by illicit addresses in 2025

Illicit crypto addresses received at least $154 billion in 2025, a 162% increase from 2024, according to the Chainalysis 2026 Crypto Crime Report. Chainalysis expects the total to rise as it identifies more illicit addresses.

10. Below 1% of attributed volume was illicit in 2025, according to Chainalysis

Chainalysis estimates that the illicit share of all attributed crypto transaction volume rose slightly in 2025 from 2024 but stayed below 1%. More than 99% of attributed volume is activity Chainalysis does not classify as illicit.

11. $158 billion in illicit crypto flows in 2025, according to TRM Labs

TRM Labs identified $158 billion in illicit crypto flows in 2025, up from $64.5 billion in 2024 and the highest level in the past five years. TRM attributes the rise to stronger sanctions enforcement, more crypto use by nation-state actors and faster attribution.

12. 1.2% of attributed on-chain volume was illicit in 2025, according to TRM Labs

Illicit activity made up 1.2% of total attributed on-chain volume in 2025, down from 1.3% in 2024 and a 2023 high of 2.4%, according to TRM Labs. TRM changed its method in this report, so these percentages should not be compared with ones it published in earlier years.

13. 84% of illicit crypto volume moved in stablecoins in 2025

Stablecoins accounted for 84% of all illicit crypto transaction volume in 2025, according to Chainalysis. For a business paid in stablecoins, screening incoming funds is now a baseline expectation.

14. 694% rise in value received by sanctioned entities in 2025

Value received by sanctioned entities rose 694% in 2025, and Russia's ruble-backed A7A5 token, launched in February 2025, transacted more than $93.3 billion in less than a year, according to Chainalysis. Chainalysis names the sanctions increase as the main driver of the 162% rise in illicit volume.

15. $3.4 billion in crypto stolen in 2025

More than $3.4 billion in crypto was stolen from January through early December 2025, and the February compromise of Bybit alone accounted for $1.5 billion, according to Chainalysis. The three largest hacks made up 69% of losses at crypto services.

16. $2.02 billion stolen by North Korea-linked hackers in 2025

North Korea-linked hackers stole at least $2.02 billion in crypto in 2025, a 51% year-over-year increase, and accounted for a record 76% of all service compromises, according to Chainalysis.

Compliance tooling and Travel Rule adoption

Compliance on public chains rests on three tools: screening wallets against risk data, passing sender and recipient details between providers under the Travel Rule, and freezing funds at the issuer. For how screening works at the moment a payment arrives, see Deposit Address Screening: KYT at the Point of Entry.

17. 83% of surveyed jurisdictions have passed Travel Rule laws

In the FATF's 2026 survey, 83% of responding jurisdictions (91 of 109) had passed legislation implementing the Travel Rule, up from 73% (85 of 117) in 2025, and 11 more reported that implementation was under way, according to the FATF's July 2026 Targeted Update. The Travel Rule requires providers to obtain, hold and transmit originator and beneficiary information, so payment details move with the funds between regulated firms.

18. 60% of Travel Rule jurisdictions have not yet taken enforcement action

Of the 91 jurisdictions with Travel Rule legislation, 60% (55) have not yet issued findings or directives or taken enforcement or other supervisory action against VASPs over Travel Rule compliance, the FATF reports. The FATF links this to many laws being recent, with supervision frameworks still being built.

19. 34% of assessed jurisdictions are largely compliant with FATF crypto standards

As of April 2026, 34% of the 149 jurisdictions assessed by the FATF (51) were largely compliant with Recommendation 15 on virtual assets, up from 29% (40 of 138) in 2025, and only one jurisdiction was fully compliant. A business paying across borders will often meet different rule sets on each side of a transfer.

20. 58% of jurisdictions have licensed or registered a VASP in practice

In the FATF's 2026 survey, 58% of respondents (76 of 130) reported having licensed or registered a VASP in practice, while 73% (95 of 130) said they require VASPs to be licensed or registered. A licensing law on paper does not always mean licensed counterparties in the market.

21. December 30, 2024: the EU Travel Rule covers crypto transfers of any amount

The EU Transfer of Funds Regulation (EU) 2023/1113, applicable since December 30, 2024, applies the same Travel Rule requirements to every crypto-asset transfer regardless of amount and whether it is domestic or cross-border. Even small stablecoin payments between EU providers carry sender and recipient data.

22. EUR 1,000: the EU threshold for self-hosted wallet ownership checks

For a crypto-asset transfer above EUR 1,000 to or from a self-hosted address, the Transfer of Funds Regulation requires the crypto-asset service provider to assess whether that address is owned or controlled by its own customer. Businesses that pay or get paid from their own wallets should expect this check from EU exchanges and custodians.

23. $4.4 billion in assets frozen with Tether's cooperation

Tether says it works with more than 340 law enforcement agencies in 65 countries and that this cooperation has led to more than $4.4 billion in frozen assets across more than 2,300 cases, as of April 23, 2026. On that date it also announced support for a single freeze of $344 million in USDT across two addresses.

Regulation milestones: MiCA, the GENIUS Act and other jurisdictions

The main stablecoin and crypto rules now have fixed dates. Each date below was checked against the legal text or the regulator's own page. For a readiness view across MiCA, the Travel Rule and GENIUS, see our 2026 confidential stablecoin settlement readiness report.

24. June 30, 2024: MiCA stablecoin rules apply

The EU's Markets in Crypto-Assets Regulation (MiCA), adopted on May 31, 2023, has applied its rules for asset-referenced tokens and e-money tokens (Titles III and IV) since June 30, 2024. E-money tokens are the MiCA category for stablecoins that reference a single official currency, such as euro or dollar tokens.

25. December 30, 2024: MiCA applies in full

MiCA has applied in full across the EU since December 30, 2024, under Article 149 of Regulation (EU) 2023/1114, which brings crypto-asset service providers under a single EU authorisation regime.

26. July 1, 2026: end of MiCA's transitional period

Under Article 143 of MiCA, crypto-asset service providers that operated under national law before December 30, 2024 could continue until July 1, 2026 at the latest, or until their MiCA authorisation was granted or refused if that came first. After that date, a crypto-asset service provider in the EU needs a MiCA authorisation to keep operating.

27. July 10, 2027: EU ban on anonymous crypto-asset accounts

From July 10, 2027, Article 79 of the EU Anti-Money Laundering Regulation (EU) 2024/1624 prohibits crypto-asset service providers from keeping anonymous crypto-asset accounts or any account that allows the anonymisation of the account holder or of transactions. As a regulation, it applies directly in every EU member state.

28. July 18, 2025: GENIUS Act signed into law

The US GENIUS Act became Public Law 119-27 when it was signed on July 18, 2025, after passing the Senate 68-30 on June 17, 2025 and the House 308-122 on July 17, 2025, according to Congress.gov. Its stated purpose, in the enacted text, is to provide for the regulation of payment stablecoins.

29. January 18, 2027: the latest date the GENIUS Act takes effect

Under Section 20 of the GENIUS Act, the law takes effect on the earlier of 18 months after its July 18, 2025 enactment, which is January 18, 2027, or 120 days after federal regulators issue final implementing regulations. Treasury published a proposed rule on stablecoin issuance, offer and sale on August 18, 2026, with comments due by October 19, 2026.

30. 1 to 1: the minimum reserve backing for US payment stablecoins

The GENIUS Act requires permitted payment stablecoin issuers to hold identifiable reserves on an at least 1 to 1 basis and to keep the technical capabilities to block, freeze and reject transactions that violate federal or state law. Freezes act on addresses, so a stablecoin balance on a public address can be stopped by its issuer.

31. July 18, 2028: US platforms limited to permitted stablecoins

From July 18, 2028, three years after enactment, the GENIUS Act makes it unlawful for a digital asset service provider to offer or sell a payment stablecoin to a person in the United States unless a permitted payment stablecoin issuer issued it, as set out in Treasury's August 18, 2026 proposed rule.

32. August 1, 2025: Hong Kong's Stablecoins Ordinance in force

Hong Kong's Stablecoins Ordinance (Cap. 656) came into operation on August 1, 2025, starting a licensing regime for stablecoin activities, according to the Hong Kong Government.

33. October 25, 2027: UK cryptoasset regime expected to start

The UK's new cryptoasset regime, created by regulations made on February 4, 2026, is expected to come into force on October 25, 2027, according to the Financial Conduct Authority. The FCA's final rules apply to cryptoasset firms granted permission under the Financial Services and Markets Act on or after that date.

34. Crypto is legal in 45 of 75 countries tracked

Of 75 countries in the Atlantic Council's Cryptocurrency Regulation Tracker, crypto is legal in 45, partially banned in 20 and generally banned in 10, and it is fully legal in 12 G20 countries that represent over 57% of world GDP (tracker updated September 2026).

35. 36 of 75 countries regulate crypto across tax, AML, consumer protection and licensing

Only 36 of the 75 countries in the Atlantic Council tracker have regulations covering taxation, AML/CFT, consumer protection and licensing (September 2026).

Fines and enforcement

Recent penalties target the same failures: weak AML programs, missing transaction monitoring and unlicensed money transmission.

36. $4,316,126,163: Binance's 2023 penalty, the historical baseline

Binance agreed to a total financial penalty of $4,316,126,163 when it pleaded guilty on November 21, 2023 to US Bank Secrecy Act and sanctions violations, according to the US Department of Justice. It is included here as a pre-2024 baseline for the penalties that follow.

37. More than $504 million: OKX penalty in February 2025

OKX pleaded guilty on February 24, 2025 to operating an unlicensed money transmitting business and agreed to pay more than $504 million in penalties, according to the US Attorney's Office for the Southern District of New York. Prosecutors said the exchange was used for over $5 billion of suspicious transactions and criminal proceeds.

38. More than $297 million: KuCoin penalty in January 2025

PEKEN Global Limited, the operator of KuCoin, pleaded guilty on January 27, 2025 to operating an unlicensed money transmitting business and agreed to pay more than $297 million in penalties, according to the US Attorney's Office for the Southern District of New York.

39. $3.5 million: FinCEN penalty against Paxful

FinCEN assessed a $3.5 million civil money penalty against Paxful on December 9, 2025, finding that the peer-to-peer trading platform facilitated more than $500 million in suspicious activity. Paxful admitted failing to register as a money services business, run an effective AML program and file suspicious activity reports.

40. €21,464,734: Central Bank of Ireland fine on Coinbase Europe

The Central Bank of Ireland fined Coinbase Europe €21,464,734 on November 6, 2025 after more than 30 million transactions worth over €176 billion, about 31% of its transactions in the affected period, were not properly monitored. The later review led to 2,708 suspicious transaction reports, and the Central Bank describes the case as its first enforcement outcome in the crypto sector.

What this means for businesses moving stablecoins

Public chains carry billions of transactions a month, and one analytics firm alone says it has labeled more than a billion addresses. For a business, the everyday exposure is commercial: customers, vendors and other businesses can look up a public wallet and read its balance, counterparties and payment history.

Hinkal Prime runs treasury, payroll and B2B payouts on private balances, with roles, approvals and compliance controls built in. A payout with Confidential Settlement goes into the Hinkal smart contract instead of the recipient's public wallet, so observers see deposits into the contract without attribution to specific operational wallets. Every deposit is screened against Chainalysis at entry and re-screened continuously, and funds from a depositor flagged later can only be withdrawn publicly to the original address. Viewing keys give an auditor, regulator or counterparty read-only access to all or part of the history, and transaction history can be downloaded when required, under Hinkal's compliance model. The result is confidential, not anonymous. For how this compares in a compliance review, see Association Sets vs Selective Disclosure.

Methodology

Figures on this page were chosen for businesses that move money in stablecoins and need to know what a public chain reveals and which rules apply. Each figure was checked against its original publisher on October 16, 2026: annual crime reports from Chainalysis and TRM Labs, the FATF's July 2026 Targeted Update, the US Treasury's March 2026 report, press releases from regulators and prosecutors, a peer-reviewed USENIX paper, and the legal texts on EUR-Lex, Congress.gov, govinfo.gov and the Federal Register. Regulation dates were checked against the official text or the regulator's own page.

Where a newer edition of a metric existed, the newer figure is used and its period is stated. Counts that companies report about themselves, such as Elliptic's and Nansen's address labels and Tether's freeze totals, are labeled as company statements. Each figure is attributed to its publisher in the line where it appears.

Frequently asked questions

How much crypto activity is illicit?

Close to 1%. TRM Labs measured illicit activity at 1.2% of total attributed on-chain volume in 2025, and Chainalysis puts its estimate below 1%, even though illicit addresses received at least $154 billion that year.

What can anyone see about a business on a public blockchain?

The sender address, recipient address and amount of every transfer, plus the wallet's balance and full history. Public chains handled 3.8 billion successful transactions a month in early 2025, according to the US Treasury, and once a wallet is labeled, by a firm such as Elliptic with more than 1 billion labeled addresses, that history is tied to a name.

Does the EU Travel Rule apply to small crypto transfers?

Yes. Since December 30, 2024, the EU Transfer of Funds Regulation has applied the same requirements to crypto-asset transfers regardless of amount, and for transfers above EUR 1,000 to or from a self-hosted address the provider must assess whether its customer owns or controls that address.

When does the GENIUS Act take effect?

On the earlier of January 18, 2027, which is 18 months after it was signed on July 18, 2025, or 120 days after federal regulators issue final implementing regulations, under Section 20 of Public Law 119-27. A separate limit on platforms offering non-permitted stablecoins to US persons starts on July 18, 2028.

Is MiCA fully in force?

Yes. MiCA has applied its stablecoin rules since June 30, 2024 and the full regulation since December 30, 2024, and the transitional period for existing crypto-asset service providers ended no later than July 1, 2026.

How widely is the FATF crypto standard implemented?

Unevenly. As of April 2026, 34% of the 149 jurisdictions assessed were largely compliant with Recommendation 15 and only one was fully compliant, although 83% of jurisdictions in the 2026 survey had passed Travel Rule laws, according to the FATF.

Related reading

• 19 Institutional Crypto Privacy Trends 2026
• Association Sets vs Selective Disclosure: Which Privacy Model Passes a Compliance Review?
• Best Privacy Protocols for Compliance-Preserving Crypto Payments

Learn more about the Hinkal API and SDK.