Crime in the $1.7 trillion cryptocurrency market fell 39 percent last year as a persistent drop in prices slowed all activity, according to blockchain forensics firm Chainalysis.

The cybersleuths also characterized the $8.7 billion loss associated with defunct crypto-exchange FTX as fraudulent after its co-founder Sam Bankman-Fried was found guilty on all counts in his fraud trial late last year. As an overall percentage of blockchain transactions, crime accounted for 0.34 percent, Chainalysis said in a report released today. That’s down from 0.42 percent in 2022 – when crypto crime peaked -- and stands in stark contrast to baseless claims by politicians like Massachusetts Senator Elizabeth Warren that crypto is only used for crime, money laundering and terrorist financing.

Against the general trend, ransomware and darknet market illicit use grew in 2023.

“The growth of ransomware revenue is disappointing following the sharp declines we covered last year, and suggests that perhaps ransomware attackers have adjusted to organizations’ cybersecurity improvements,” Chainalysis said in the report. Darknet markets, which are accessed using browsers such as TOR, also saw more use last year compared to 2022, Chainalysis said. A big reason for the 2022 decline was the shutdown of Russian darknet market Hydra, which took in more than 90 percent of peak illicit revenue, the firm said.

Last year, “while no single market has yet emerged to take [Hydra’s] place, the sector as a whole is rebounding, with total revenue climbing back towards its 2021 highs,” Chainalysis said.

Chainalysis said $24.2 billion in illicit crypto activity occurred in 2023. As it has stated in the past, its calculations of fraudulent activity tend to rise over time as more bad actors are uncovered. For example, the firm said initially last year that 2022 crypto-crime totaled $20.6 billion and then doubled that estimate to $40.6 billion. In a rare case, the firm is including the off-chain theft of customer money perpetuated by Bankman-Fried and FTX executives.

“Another key reason the new total is so much higher, besides the identification of new illicit addresses: We’re now counting the $8.7 billion in creditor claims against FTX in our 2022 figures,” Chainalysis said. Going forward it will add similar ongoing instances of illegal off-chain activity if courts reach guilty verdicts like in FTX, the firm said.

Read more: Criminal Activity Using Crypto Stays Below 1%, Rubbishing Skeptic Claims to the Contrary

For the second year in a row, stablecoins such as Tether and USDC were used the most in illegal blockchain transactions. In 2018 and 2019, scammers dealt in Bitcoin and Ether in about 90 percent of all cases, Chainalysis said.

“Through 2021, Bitcoin reigned supreme as the cryptocurrency of choice among cybercriminals, likely due to its high liquidity,” the firm said in its reort. “ But that’s changed over the last two years, with stablecoins now accounting for the majority of all illicit transaction volume. This change also comes alongside recent growth in stablecoins’ share of all crypto activity overall, including legitimate activity.”

Crypto scams and losses due to hacking were both down last year, falling 29 percent and 54 percent, respectively, Chainalysis said. There is a large caveat related to crypto scams, however.

“Many crypto scammers have now adopted romance scam tactics, targeting individuals and building relationships with them in order to pitch them on fraudulent investing opportunities, rather than advertising them far and wide, which often makes them more difficult to uncover,” the firm said. While the FBI reports that crypto investment scams are rising, Chainalysis doesn’t see that reflected in on-chain data. That would track the firm’s belief that fraudsters have better luck when markets are up and people are afraid of being left out of the get-rich-quick narrative.

Hacking instances were down, driven in large part by a drop in breached decentralized-finance protocols, Chainalysis said. Breaking a long, disturbing thread of major defi hacks, the new data “may signify that defi protocols are improving their security practices,” Chainalysis said. “That said, stolen funds  metrics are heavily outlier-driven, and one large hack could again shift the trend.”