Have you ever paused mid-trade and wondered just how much questionable money might be moving through the same platforms you use every day? I have. A recent deep analysis of blockchain flows turned up a figure that stopped me cold: nearly 188 billion dollars in high-risk exposure tied to crypto exchanges over a five-year stretch. That number is not abstract. It represents real deposits and withdrawals linked to flagged sources, and the way those funds clustered tells a story most casual traders never see.
The Staggering Scale Of High-Risk Exposure Across Exchanges
The researchers examined more than 36 trillion dollars in deposits and withdrawals involving Bitcoin, Ethereum, and USDT moving on the Tron network. From that enormous pool they traced connections to identified high-risk sources and destinations, following the money through as many as five successive transfers. What emerged was 90.55 billion dollars flowing into exchanges from flagged origins and another 97.21 billion leaving for flagged destinations. Add those together and you arrive at the headline total of roughly 187.75 billion dollars in combined exposure.
One unnamed platform alone accounted for 70.84 billion dollars of that total, including more than 41 percent of every risky inflow recorded. That level of concentration is hard to ignore. Yet the analysts were careful to stress an important distinction. Exposure here means proximity to high-risk entities. It does not prove that any exchange or its customers knowingly took part in illicit activity. Still, the sheer size of the figure forces a second look at how risk travels through the system.
I find it striking that the top ten platforms absorbed 167.66 billion dollars, or about 90.9 percent of all flagged inflows between 2021 and 2025. The remaining 89 exchanges shared just over 20 billion. Large absolute numbers did not always equal high relative risk. Among those top ten the share of risky inflows ranged from a modest 0.07 percent to 2.25 percent of total deposits. The industry benchmark across the full sample sat at 0.68 percent. Individual platforms outside that elite group sometimes showed far higher ratios, climbing as high as 7.79 percent on inflows and an eye-watering 24.78 percent on outflows.
How Annual Exposure Shifted Over Five Years
The yearly totals tell their own tale. Exposure peaked at 60.80 billion dollars in 2021, dropped to 23.85 billion by 2023, then climbed again to 34.61 billion in 2025. Exchange transaction volume grew faster than the flagged amounts during the rebound, so the percentage of activity carrying risk actually declined. By 2025 risky inflows represented just 0.50 percent of all deposits and risky outflows only 0.21 percent of withdrawals. The five-year average for outflows settled at 0.42 percent.
That downward trend in relative terms is encouraging on the surface. Yet the absolute dollars remain large enough to matter. When markets expand, even a smaller slice of a bigger pie can still move tens of billions. The recovery after 2023 shows that risk never fully left the system; it simply adapted to new conditions.
Sanctions Take Center Stage As The Dominant Risk Category
Perhaps the most interesting shift is the rise of sanctions as the leading source of flagged activity. Across the full period sanctions generated 74.09 billion dollars in combined exposure. By 2025 they accounted for 62.2 percent of risky inflows and 53.8 percent of risky outflows. Contrast that with 2021, when fraud and hacks supplied more than four-fifths of flagged inflows. Those two categories shrank dramatically: fraud-related inflows fell to 4.16 billion and hack-related flows to 1.51 billion in 2025, while sanctions climbed to 11.02 billion.
Exposure represents proximity to identified high-risk entities rather than proof that an exchange or its customers knowingly participated in illicit activity.
In July 2025 alone sanctions-related inflows hit 2.48 billion dollars, making up roughly 84 percent of that month’s risky deposits. The change feels structural. Once fraud and direct theft dominated the conversation. Now the conversation has moved toward compliance and the long reach of government designations. I suspect this trend will only intensify as more jurisdictions expand their sanctions lists.
Why USDT On Tron Dominates Recent Risky Flows
Asset composition changed just as dramatically. In 2025 USDT circulating on the Tron network represented 68 percent of all flagged inflows and an astonishing 80.4 percent of flagged outflows. Bitcoin’s share of risky deposits dropped from 83.1 percent in 2021 to just 11 percent five years later. That is a profound realignment.
Interestingly, Bitcoin still made up around 40 percent of all exchange deposits in 2025, while USDT accounted for about 36 percent. The risk was therefore disproportionately concentrated in one stablecoin on one network. The study limited its coverage to Bitcoin, Ethereum, and Tron-based USDT, so the full picture across every chain remains incomplete. Even so, the dominance of that single asset raises practical questions for anyone monitoring flows.
In my view the shift toward stablecoins on faster, cheaper networks is both logical and concerning. Lower fees and quicker settlement attract legitimate volume, but they also attract actors who value speed and relative opacity. The data simply reflects that reality.
Large Transfers Carry Disproportionate Risk
Size matters. Across the entire study period researchers identified 5,878 deposits larger than one million dollars. Those relatively few transactions carried 33.77 billion dollars, or 37.24 percent of the total flagged deposit value. They represented only 0.02 percent of the number of flagged deposit transactions. In other words, a tiny fraction of the activity moved more than a third of the risky money.
Average risky transaction size rose sharply from 392 dollars in 2021 to 5,237 dollars in 2025. At the same time the number of flagged transactions collapsed from roughly 155 million to 6.6 million. The pattern is clear: fewer but larger movements. That evolution makes detection harder in some ways and easier in others. Large transfers stand out more easily on the blockchain, yet they can also be layered through additional hops to obscure their origin.
The value-weighted average distance between exchanges and flagged entities increased from 1.51 transfers in 2021 to 2.73 transfers in 2025. Actors appear to be inserting extra steps. The methodology itself warns that funds can shed their original attribution through mixers, bridges, privacy services, and unidentified wallets. Anything beyond five transfers fell outside the study’s scope. Falling identified exposure therefore does not automatically mean the underlying activity has declined by the same amount.
What Disruption Of High-Risk Platforms Actually Achieves
One concrete case study illustrates both the persistence of risk and the power of coordinated action. A major sanctioned platform remained connected to the sampled exchanges for almost three years after its initial designation in 2022. Only after a multi-national infrastructure disruption in early 2025 did the picture change. Average daily flagged inflows linked to that platform dropped 98.9 percent and outflows fell 99.7 percent.
Authorities seized domains and servers while freezing tens of millions of dollars. Subsequent designations of successor entities produced further reductions, though the effect was not uniform across every related platform. Some designations appeared to have limited immediate impact on average daily exposure. The lesson seems straightforward: designation alone is rarely enough. Actual disruption of infrastructure and banking rails produces measurable results.
I’ve watched similar patterns play out before. When pressure focuses solely on labels without follow-through on the operational side, funds simply migrate. When pressure includes the technical and financial backbone, the migration becomes far more costly and visible.
Licensing Status And Historical Exposure
Among ten exchanges examined for licensing, the analysis estimated 52.33 billion dollars in exposure associated with jurisdictions where the platforms held recorded licenses. Because infrastructure could not generally be separated by legal entity, the researchers allocated exposure according to the geographic distribution of website visits. That method is imperfect. It does not prove where any individual transaction originated. Still, it offers a rough sense of the overlap between regulated status and historical risk.
Separately, seventeen exchanges that had received authorization under European markets rules by mid-2026 showed 83.18 billion dollars in historical exposure. Their transaction records largely predated the authorizations used for comparison. The data therefore captures past behavior more than current compliance posture. That distinction matters. Licensing can improve future controls without erasing earlier connections.
North Korea Linked Activity And Methodological Limits
A focused slice of the research looked at activity attributed to North Korean actors and recorded 544.40 million dollars in combined exchange exposure. The methodology deliberately excluded withdrawals that represented the original theft from exchanges targeted in those incidents. Even with that conservative approach the residual flows remain notable.
Every study of this type faces inherent limits. Once funds pass through mixers or cross-chain bridges the original attribution can fade. Unidentified wallets further dilute the signal. The five-transfer window is a practical compromise, not a perfect mirror of reality. Readers should treat the numbers as a lower bound on visible risk rather than a complete census.
Practical Implications For Everyday Market Participants
So what should ordinary traders and investors take away from these findings? First, absolute exposure remains concentrated. A handful of platforms handle the overwhelming majority of flagged value. That does not automatically make those platforms unsafe; their sheer volume can produce large absolute numbers even at low relative rates. Still, concentration creates single points of stress when regulators act.
Second, the shift toward sanctions risk changes the compliance landscape. Platforms that once focused primarily on fraud detection now must maintain sophisticated sanctions screening across multiple jurisdictions. The cost of those systems ultimately filters into fees or service restrictions for users.
Third, the growing role of USDT on Tron means that monitoring efforts cannot remain Bitcoin-centric. Risk has followed liquidity and low fees. Anyone building analytics tools or compliance programs needs to weight networks according to actual observed risk rather than historical market share.
- Large transfers continue to dominate the value of flagged activity even though they form a tiny share of transaction count
- Average distance between exchanges and flagged entities has lengthened, suggesting more sophisticated layering
- Relative risk rates have declined even as absolute exposure recovered after 2023
- Infrastructure disruption produces sharper drops in flagged flows than designation alone
Customer experience is already feeling the effects. Some platforms have publicly warned that high-risk deposits can trigger reviews lasting two weeks or longer, during which account functions and funds may be restricted. Those reviews often cover transfers involving certain messaging-app escrow arrangements and specific regional payment variants. The duration depends on the circumstances of each case. Users who move sizeable sums should expect greater friction when counterparties or corridors carry elevated risk scores.
Looking Ahead At Risk Patterns
If the past five years are any guide, risk will keep migrating toward the path of least resistance. Cheaper, faster settlement layers will attract both legitimate and questionable volume. Sanctions lists will expand. Successor platforms will appear after major disruptions. The arms race between concealment techniques and analytics will continue.
I remain cautiously optimistic that greater transparency and better tooling can shrink the relative share of risky activity even further. The drop in percentage terms between 2021 and 2025 shows progress is possible. Yet the absolute dollars involved mean that progress must be measured carefully. A smaller percentage of a much larger market can still represent meaningful risk.
The study also highlights how methodology shapes conclusions. By limiting the trace to five hops and focusing on three major assets, the researchers produced a clear, comparable data set. Expanding the window or the asset list would almost certainly raise the totals. Future work that incorporates additional chains and longer attribution paths will refine the picture further.
For now the central takeaway is straightforward. Nearly 188 billion dollars in high-risk exposure moved through crypto exchanges over five years. Most of that value concentrated on a small group of platforms. Sanctions replaced fraud and hacks as the primary driver. USDT on Tron became the dominant vehicle. Large transfers carried outsized portions of the total. And coordinated disruption of infrastructure proved far more effective than labels alone.
Those facts do not mean the entire industry is compromised. They do mean that risk management, compliance investment, and continuous monitoring remain essential. Traders who understand the patterns are better positioned to navigate the friction that inevitably follows. Platforms that invest early in robust screening may find themselves better prepared when the next wave of designations or disruptions arrives.
The data leaves me with a final observation. Markets evolve. Risk evolves with them. The platforms and assets that look cleanest today can become tomorrow’s concentration points if incentives shift. Staying informed about the actual flows, rather than relying on assumptions from previous cycles, is the only reliable way to keep pace. The nearly 188 billion dollar figure is a snapshot, not a permanent verdict. How the next five years unfold will depend on technology, regulation, and the constant push and pull between those seeking to move value and those seeking to understand its origin.
In the end the numbers force a practical question on anyone active in the space. Are the platforms you use prepared for the next shift in risk composition? The answer will shape both individual outcomes and the broader health of the market for years to come.
