This weblog is a preview from our upcoming 2024 Crypto Crime Report. Click here to enroll and reserve your copy now.

CSAM (baby sexual abuse materials) is an understudied a part of the crypto crime ecosystem. The business is broadly conscious that there are digital areas the place CSAM may be purchased and bought utilizing crypto, and there are well-publicized cases of legislation enforcement shutting down crypto-based CSAM marketplaces like Welcome to Video. 

Not all CSAM exercise includes cryptocurrency, and in lots of circumstances, customers merely commerce CSAM amongst themselves. However cryptocurrency-based gross sales of CSAM are a rising downside. Tamsin McNally, Hotline Supervisor on the Internet Watch Foundation (IWF) shared with us that they “discover digital foreign money is the dominant selection for patrons and sellers of business baby sexual abuse content material, a lot in order that we now have a devoted crypto unit that works with legislation enforcement and the finance business to assist present proof for investigations.” This evaluation is our first try to provide a complete, goal measure of the CSAM-cryptocurrency ecosystem.

First, we debut a technique for measuring the scope of the crypto-based CSAM ecosystem throughout quite a lot of completely different variables, primarily based on on-chain exercise. General, our knowledge means that whereas the scale of the crypto-based CSAM market has decreased in 2023, the sophistication of CSAM sellers and in flip their resilience to detection and takedowns has elevated over time. As well as, we’ll have a look at CSAM distributors’ use of obfuscation measures reminiscent of mixers and privateness cash like Monero, and look at how distributors could profit from them. 

The entire CSAM knowledge we analyze right here is predicated on a subset of over 400 on-chain CSAM vendor wallets we’ve recognized that have been energetic between 2020 and 2023 and met a particular threshold of transaction exercise. We noticed over 10,000 wallets that despatched funds to CSAM vendor wallets in 2023, which for the needs of this evaluation we label as CSAM patrons. Figuring out CSAM distributors isn’t simple, as most shrink back from promoting even on the darknet because of the stigma related to this notably abhorrent type of crime — just about all darknet markets, for instance, explicitly ban the sale of this materials. Our identifications of CSAM vendor wallets come from quite a lot of sources, together with the IWF, different companions and clients, and our personal investigations. 

We’re virtually actually not capturing all on-chain CSAM exercise, however given the breadth of sources we draw from, in addition to the truth that now we have a sufficiently big pattern dimension to measure non-scale primarily based traits like longevity and class, we imagine this evaluation sheds worthwhile mild on how on-chain CSAM marketplaces function and have modified over time. 

How crypto’s CSAM downside has modified over time: A four-component measurement

We quantify most types of cryptocurrency-based crime based on the crypto worth acquired by illicit addresses. Nonetheless, this could be deceptive within the case of CSAM. As a recent research report by the European Parliament explains, there’s extra CSAM on the web than ever earlier than, and it’s by no means been cheaper to provide. Given the flood of cheap materials, and the truth that every bit of content material inherently includes abuse, we don’t imagine {that a} greenback determine can precisely measure the true injury of CSAM. 

As a substitute, we’ve give you a four-component measurement to evaluate the distinctive downside of CSAM over time primarily based on completely different on-chain metrics. For any given time period, we will assign a rating for every of the 4 elements, and in that manner see how the cryptocurrency-based CSAM market adjustments throughout every part over time. These 4 elements are:

Scale: Scale captures the scale of the CSAM market by way of transactions and members. On-chain metrics right here embrace:

• Variety of wallets sending to CSAM distributors [1]
• Variety of distinct CSAM distributors energetic through the time interval
• Variety of transactions incoming to CSAM distributors
• Whole worth despatched to CSAM distributors

Severity: Severity is meant to seize the extremity and quantity of the content material being shared on a per transaction foundation. Whereas this may’t be instantly seen on-chain, we will infer these traits primarily based on the worth of particular person transactions with CSAM distributors. On-chain metrics right here embrace:

• Imply fee dimension 
• Median fee dimension
• Variety of CSAM distributors which have acquired funds of $70 or extra in dimension — these characterize the best tier of funds that CSAM distributors usually cost in a single transaction for content material. We’ll clarify the five-tier fee classification system specialists use for CSAM market evaluation in additional element later. 

Sophistication: Sophistication refers back to the degree of obfuscation measures taken by CSAM suppliers throughout a given time interval. Later within the report, we’ll look at the connection between sophistication and CSAM distributors’ potential to remain in operation for longer. On-chain metrics right here embrace:

• Inflows to CSAM distributors from mixers (which we assume to be buyer funds made through mixers)
• Outflows from CSAM distributors to mixers (which we assume characterize efforts by CSAM distributors to launder funds)
• Outflows from CSAM distributors to prompt change providers that assist privateness cash like Monero (which we assume are doable conversions into privateness cash by CSAM vendor operators for cash laundering functions)

Resilience: Resilience refers to CSAM distributors’ potential to develop into energetic and keep in enterprise. On-chain metrics right here embrace:

• Common cumulative lifespan of energetic CSAM distributors
• Variety of CSAM distributors that turned inactive through the time interval (this could negatively impression the resilience rating)
• Variety of new providers that turned energetic through the time interval
• The online development or decline of CSAM distributors, calculated by subtracting the variety of providers that turned inactive throughout a given 12 months from the variety of new providers that emerged in that 12 months

Let’s have a look at how the crypto-based CSAM market has modified over the past 4 years alongside every of these 4 axes.

General, we see that the size and severity of CSAM exercise peaked in 2021 after comparatively low exercise in 2020. The fluctuations in severity develop into clearer once we incorporate our five-tier fee classification system. This tiered pricing system has been recognized by IWF as being utilized by many CSAM distributors, with greater tiers being dearer and giving customers a better quantity of content material, and sometimes extra excessive content material, within the context of a single buy. The tiering system is as follows:

• Tier 1: $10 – $20 
• Tier 2: $20 – $35
• Tier 3: $35 – $50
• Tier 4: $50 – $70
• Tier 5: >$70

As we will see on the chart beneath, purchases in Tiers 4 and 5 have decreased as a share of general CSAM transactions over time since 2021, whereas the share for Tiers 1 and a pair of has elevated. 

This will likely point out that the CSAM being disseminated is turning into much less excessive, or that much less materials is being offered on a per buy foundation. In fact, it may additionally imply that the market is being flooded with content material, main to cost drops throughout the board whatever the extremity of the content material. For example, researchers have famous that AI is enabling the dissemination of synthetic CSAM — a glut of such content material may drive costs down. 

We additionally see that the resilience of CSAM distributors has gone up. Have a look at the chart beneath, which exhibits the lifespan of all CSAM distributors we observe by begin date and finish date.

Lifespans are trending upwards: In 2023, the lifespan of the common energetic CSAM vendor is 884 days, up from 560 days in 2022. Nonetheless, comparatively few new CSAM distributors have cropped up in 2023 — simply 43, in comparison with 112 in 2022. Nonetheless, how is it that so many CSAM distributors are capable of persist for thus lengthy, and why is resilience going up? 

In fact, there are various steps CSAM distributors may very well be taking to obfuscate their exercise that don’t have anything to do with cryptocurrency, reminiscent of using web anonymity instruments like Tor. However in relation to crypto particularly, the information suggests CSAM distributors could also be benefiting from using Monero. Monero is the most well-liked of the so-called “privateness cash,” that are cryptocurrencies whose blockchains make use of distinctive privateness enhancing options that make it tougher to observe the move of funds or discern their authentic supply.   

Many CSAM distributors have adopted Monero in recent times, although Bitcoin is by far probably the most broadly used cryptocurrency for CSAM buying. Actually, whereas the screenshot above exhibits a vendor asking customers to pay in Monero, the information suggests Monero’s position is extra prevalent in CSAM distributors’ efforts to launder their on-chain earnings, quite than to obscure the purchases themselves. It’s tough to indicate Monero’s position instantly on-chain utilizing normal blockchain evaluation methods, however we can have a look at CSAM distributors’ use of Monero-friendly prompt exchangers to estimate their potential Monero use. Not like conventional centralized exchanges (CEXes), which have largely delisted Monero, prompt exchangers are non-custodial and usually don’t supply crypto-to-fiat conversion — however not like, say, a DeFi protocol, they’re centrally managed by a single group. Instantaneous exchangers usually draw on the liquidity of a number of CEXes to offer customers the absolute best costs, and facilitate the change of 1 crypto for an additional instantly between customers’ wallets, such that the transaction is commonly tough to hint on-chain. That, together with the truth that many prompt exchangers don’t require KYC, could make them useful for concealing the unique supply of cryptocurrency. 

It’s additionally doable that CSAM distributors are swapping into different cryptocurrencies, together with privateness cash apart from Monero. However primarily based on distributors’ particular solicitation of Monero and our personal investigations, we imagine Monero to be the foreign money of selection for laundering through prompt exchangers.

Our knowledge exhibits that CSAM distributors’ utilization of prompt exchangers that enable for Monero conversion has elevated considerably over the previous few years.

Conventional CEXes have at all times been the most important recipient of funds despatched by illicit providers, together with CSAM distributors. Nonetheless, Monero-friendly prompt exchangers have narrowed the hole in recent times, suggesting that CSAM vendor wallets could also be rising their utilization of Monero for cash laundering functions, although they proceed to obtain the majority of buyer funds in Bitcoin. Some CSAM distributors have transitioned virtually totally away from direct sending to CEXes, as a substitute sending funds solely to Monero-friendly prompt exchangers. We will see two examples of CSAM distributors that made that change in 2022 on the chart beneath.

If CSAM distributors’ utilization of Monero-friendly prompt exchangers does certainly correlate with precise utilization of Monero, the information means that Monero could also be serving to these CSAM distributors survive longer. Try the chart beneath, which compares the survival charges over time of a pattern of CSAM distributors that ship funds to Monero-friendly prompt exchangers versus these that don’t.

CSAM distributors that use Monero-friendly prompt exchangers are more likely to outlive initially than people who don’t — inside 50 days of launching, the survival price of potential Monero utilizing CSAM distributors is roughly 77.6%, in comparison with simply 57.0% for all others. Moreover, on the 1,000 day mark, 19.2% of potential Monero utilizing CSAM distributors are nonetheless energetic, in comparison with simply 3.8% of all others. Whereas the shortage of KYC at many prompt exchangers and lack of ability to hint via these centralized providers may play a task, the information means that Monero may very well be an enormous boon to CSAM distributors.

It’s necessary to notice that using an prompt exchanger doesn’t essentially present anonymity for customers. Some prompt exchangers do have KYC and different compliance processes, together with transaction monitoring. We additionally know that many adjust to legislation enforcement requests associated to investigations, together with ones involving CSAM. 

General, 52.0% of CSAM vendor wallets energetic in 2023 have despatched funds to Monero-friendly prompt exchangers. One cause that quantity isn’t greater may very well be Monero’s comparative issue of use. Many exchanges don’t assist Monero for off-ramping functions, although customers may at all times swap again from Monero to a unique cryptocurrency that’s simpler to transform into money. Regardless, the information means that the provision of privateness cash like Monero could assist CSAM distributors keep in enterprise longer. Legislation enforcement could take into account funding in specialised blockchain evaluation providers that may make tracing Monero and different belongings doable, and prompt exchangers that don’t make use of conventional compliance practices could take into account constructing packages that contribute to a safer ecosystem.

Finish notes:

[1] For the needs of this evaluation, we don’t rely transactions from providers to CSAM distributors, which may additionally characterize folks buying this materials. We additionally don’t rely cases the place one particular person could also be buying CSAM from one other who made the preliminary buy from a CSAM vendor. For instance, if private pockets 1 transfers to CSAM vendor 1, after which private pockets 2 transfers to private pockets 1, we don’t rely that second transaction, which is perhaps redistribution. Once more, we’re virtually actually not capturing all on-chain CSAM exercise.

This materials is for informational functions solely, and isn’t meant to offer authorized, tax, monetary, funding, regulatory or different skilled recommendation, neither is it to be relied upon as knowledgeable opinion. Recipients ought to seek the advice of their very own advisors earlier than making a lot of these selections. Chainalysis doesn’t assure or warrant the accuracy, completeness, timeliness, suitability or validity of the data herein. Chainalysis has no accountability or legal responsibility for any choice made or some other acts or omissions in reference to Recipient’s use of this materials.