Andrew Paterson | Photographer’s Choice RF | Getty Images
Cryptocurrency payments to suspected human trafficking syndicates surged 85% in 2025, with hundreds of millions of transactions traced on public blockchains, according to a new report by Chainalysis.
The U.S.-based blockchain analytics firm said most of the activity was linked to an expanding criminal ecosystem in Southeast Asia, where scam compounds, illegal online gambling operations and Chinese-language money laundering networks operate in unison.
Chainalysis said in its report that crypto activity by human traffickers largely fell into three categories: International escort and prostitution services; labor placement agents and scam compounds; and child sexual abuse material (CSAM) vendors.
While data on the blockchain shows most services were concentrated in Southeast Asia, customers sent payments from across North and South America, Europe and Australia, highlighting the global reach of the operations.
The report also found that cybercriminals are increasingly relying on messaging platforms such as Telegram to advertise their services, recruit victims, and coordinate payments.
“There’s a broader migration from older darknet forums into messaging apps and semi‑open Telegram ecosystems, which, combined with crypto, let these networks scale faster, run ‘customer services,’ and move money globally with much less friction,” Chainalysis intelligence analyst Tom McLouth told CNBC.
However, Chainalysis adds that the transparency of public blockchains also provides “unprecedented visibility” into criminal financial flows, which watchdogs and authorities rely on to disrupt activities.
“The key takeaway is that the true financial scale is large, at least hundreds of millions of USD worth of crypto transactions, and the physical harm is orders of magnitude greater than any dollar figure,” said McLouth.
Escort and prostitution networks
Blockchain activity suggests that highly organized networks were behind many transactions.
While some escort services and sex work operate legally, the report said potential trafficking operations can be identified through distinct financial behaviors.
In particular, suspected networks are increasingly relying on stablecoins and Chinese‑language money laundering groups to cash out quickly, McLouth said.
These laundering networks operate primarily through Chinese-language Telegram channels, which can help cybercriminals “clean” illicit funds by moving them through cryptocurrency. Chainalysis estimates that those services funneled at least $16.1 billion in illicit funds in 2025.
Data showed that crypto-linked international escort services also accounted for a significant share of higher-value transfers tracked by Chainalysis, with nearly half of transactions exceeding $10,000.
Listings reviewed by researchers advertised cross-border travel packages, multi-day “companionship” services and tiered pricing structures, with VIP packages priced above $30,000.
Chainalysis said the size and consistency of these transfers, along with repeated payment patterns between wallet clusters, suggest professionalized operations rather than isolated individuals.
Crypto payments to suspected prostitution networks showed a distinct cluster of smaller transactions than those of escort services, mostly between $1,000 and $10,000. Still, Chainalysis said this data suggested operations consistent with agency-level activity.
Labor recruiters and scam compounds
Another major category involved so-called “labor placement agents” who recruit individuals into scam compounds, usually in Southeast Asia, known for carrying out crypto-based schemes.
Recruitment fees typically range from $1,000 to $10,000 in cryptocurrency, matching the prices advertised on Telegram channels, the report said.
Examples cited in the report include posts seeking “customer service” or “data entry” workers for jobs in Cambodia or Myanmar, promising high monthly salaries and covering travel costs.
Once recruited, victims were allegedly forced to conduct romance scams, fake cryptocurrency investment schemes and other online frauds targeting victims abroad.
In some Telegram conversations analyzed by Chainalysis, recruiters discussed transporting workers across borders, arranging forged documents and coordinating payments to intermediaries.
The firm also identified links between recruitment channels and wallets previously associated with illegal gambling platforms and money laundering services, suggesting that the trafficking activity was linked to broader criminal enterprises.
The scale of these compounds was highlighted last year when the U.S. Department of Justice announced the seizure of bitcoin worth about $15 billion at the time from a massive Cambodian scam center that was running romance scams.
“Since late 2025 we’ve seen more enforcement around parts of this ecosystem, especially scam compounds, but the underlying sexual exploitation and trafficking networks can often keep operating via alternative infrastructure, both physical and digital,” said McLouth.
CSAM vendors
Chainalysis also tracked networks involved in child sexual abuse material (CSAM), which operated under different crypto payment structures but also reflected growing levels of organization and “sophisticated financial and distribution strategies.”
While about half of CSAM-related crypto transactions were below $100, that price point reflected individual payments within subscription-based models in private chat groups and encrypted file-sharing channels, the report said.
The blockchain tracker also observed these funds moving from mainstream cryptocurrencies into privacy-focused assets such as Monero, as well as instant exchange services that require no identity verification.
The report also documented overlaps between CSAM subscription services and “sadistic online extremism” communities.
“These [sadistic online extremism] groups specifically target and manipulate minors through sophisticated sextortion schemes, with the resulting content being monetized through cryptocurrency payments, perpetuating cycles of abuse,” the report said.
In July 2025, Chainalysis said it helped identify one of the largest CSAM websites operating on the dark web following a UK law enforcement lead.
That single operation utilized over 5,800 cryptocurrency addresses and generated more than $530,000 in revenue since July 2022.
“In general, as crypto adoption grows, its use for both illicit and legitimate purposes will increase,” said McLouth. “In the near term, I don’t expect crypto use in trafficking‑linked activity to go away, if anything, I expect it to keep growing even as enforcement gets better.”
