Stablecoins carried 84 percent of recorded illicit on-chain volume in 2025, and every one of those transfers is permanently visible to anyone with a laptop. That combination explains far less about how these investigations actually run than most compliance committees assume.
Two numbers published six weeks apart at the start of 2026 have shaped more bank board conversations about crypto exposure than any regulation of the same period. Chainalysis put illicit inflows for 2025 at a minimum of 154 billion dollars and found that stablecoins carried 84 percent of illicit transaction volume. TRM Labs, working from its own attribution data, arrived at 158 billion and 86 percent. The reasoning that follows in most committee rooms is quick. Dollar tokens have become the laundering instrument of the decade, and because the ledger is open, analytics will show us the problem. The first proposition is defensible. The second is where institutions in emerging markets are quietly spending money on the wrong thing.
My position is narrow enough to be defended. A public ledger does not make a financial investigation easier; it relocates the difficulty. Almost the entire cost of obtaining the path that value took disappears. The cost of naming the persons at either end of that path remains exactly where it was. A firm that buys address screening and books it as coverage has purchased the cheap half of the work, and usually has not noticed.
Traceability and attribution are separate products sold in one package
Ask a correspondent bank for records and what comes back is authoritative and partial: a named account holder, a stated purpose of payment, an intermediary or two, and nothing about what happened before the funds arrived or after they left unless you write to another institution and wait. Identity is attached to the record from the outset. The path stays hidden until somebody chooses to disclose it.
The public ledger inverts that arrangement precisely. The path is complete, visible in both directions, covering the entire history of every address involved, and obtainable without asking anyone's permission. What is missing is the identity. An address is a pseudonym, and everything that converts a pseudonym into a person is inference built on top of the ledger rather than read out of it.
Where this bites hardest is in how risk scores are consumed. A score tells you that something in its transactional history connects to a cluster somebody has labelled. It does not tell you at what remove, through how many intermediate hops, what proportion of the value now in front of you is actually affected, or when the underlying label was last verified. Vendors reach different conclusions on the same address because they hold different attribution sets and apply different propagation rules. Chainalysis itself spent June and July 2026 publishing arguments about what data quality means in blockchain analytics and why cluster counts are a poor proxy for it. When an industry is still negotiating in public the standard by which its own output should be judged, a compliance officer should be slow to treat a single number from it as a finding.
Clustering is inference, and its failure mode is silent
The workhorse of Bitcoin-era analysis is the common-input-ownership heuristic: if several addresses sign as inputs to one transaction, one party is assumed to control them all. Layered on top are change-address heuristics that guess which output returns to the sender. These are assumptions about how wallet software behaves, not facts about ownership, and they fail. Malte Möser and Arvind Narayanan, presenting at Financial Cryptography in 2022, built a ground truth set of transactions with known change and showed that naive application of change heuristics produces cluster collapse, in which distinct entities merge until a single supercluster absorbs 133.1 million transactions. Nothing in the output flags this. The graph looks the same. The answer is simply wrong, and it is wrong with the visual confidence of a correct one.
Stablecoin work rarely involves those heuristics at all, which makes matters worse rather than better. USDT and USDC on Ethereum, Tron and Solana sit on account-based ledgers where there is no change output and no multi-input transaction to cluster on. Attribution then rests on deposit-address reuse at exchanges, on who funds the gas, on timing, on amounts that happen to match invoices, and on off-chain intelligence the analyst may simply not possess. Add peel chains, mixers, privacy pools and bridges. Elliptic counted 21.8 billion dollars laundered through decentralised exchanges, bridges and no-KYC swap services by mid-2025, close to three times the 2023 figure, and reported that in its sample of investigations with more than three plotted clusters, over a third crossed more than three blockchains and one in five crossed more than ten.
Everything stops at the point of custody
Tracing runs until value reaches somebody who holds it on behalf of others, and then it stops. Deposits into a custodial exchange enter an internal ledger no external observer can read, and what leaves the platform bears no reliable relationship to what entered. Continuity beyond that point becomes a legal question about the platform's jurisdiction, its record keeping and its willingness to answer. The FATF reported in June 2025 that only 3.8 percent of the 1.46 billion dollars stolen from Bybit had been recovered, which is a fair measure of what the visible path is worth once custody intervenes.
Two intermediaries deserve far more attention than they receive in African corridors. OTC brokers convert stablecoins into local currency at the parallel rate, frequently through personal bank accounts and mobile money wallets, and they are often the real counterparty behind a customer who describes an incoming transfer as family support. Nested services operate inside a larger exchange's account structure, so their traffic appears on chain as the host exchange's traffic and remains invisible until somebody reconciles internal records. Neither surfaces as a flagged address.
Centralised issuers do offer investigators one thing no bank rail provides, which is a kill switch. Tether blacklisted 4,163 USDT addresses during 2025 and froze roughly 1.26 billion dollars across Ethereum and Tron. That capability is real, and it is self-limiting: an issuer able to freeze is an issuer that users will eventually route around. The FATF's July 2026 update records a financial services conglomerate with links to criminal networks developing its own stablecoin engineered to resist freezing and seizure. Plan on the freeze function weakening as a control over the next several years.
Most jurisdictions now have a travel rule; far fewer have travel rule supervision
The FATF published its seventh targeted update on 16 July 2026. Ninety-one of 109 surveyed jurisdictions, 83 percent, now have travel rule legislation in force, against 73 percent a year earlier, with a further eleven reporting implementation under way. The same exercise found that roughly half of the jurisdictions with the rule on their books had carried out no inspection and taken no enforcement action in respect of it. Legislation without supervision produces originator and beneficiary fields that are technically transmitted and practically unverified.
European institutions work to a stricter text. Regulation (EU) 2023/1113 applies to every crypto-asset transfer executed by a CASP, with no de minimis threshold at all, and requires verification of ownership or control for self-hosted wallets above 1,000 euros. That asymmetry is the operational problem in a Gabonese or Nigerian corridor. The Estonian or French institution at one end is fully bound. The counterparty at the other may be offshore, unlicensed, nested inside another platform, or supervised by an authority that has never inspected anyone. FATF commentary this year returns repeatedly to offshore providers as the unresolved gap, and prohibition regimes fare no better, since a jurisdiction that bans virtual asset services still has to detect them.
What a compliance function should change on Monday
These corridors are not marginal. Sub-Saharan Africa received more than 205 billion dollars in on-chain value between July 2024 and June 2025, up around 52 percent year on year, with Nigeria alone accounting for 92.1 billion. Chainalysis also observed regular multi-million dollar stablecoin transfers tied to trade flows between Africa, the Middle East and Asia, in energy and merchant payments rather than in speculation. The IMF's 2025 departmental paper puts stablecoin holdings in Africa and the Middle East at 1.5 percent of total deposits by 2024, up from close to zero in 2020, against foreign currency deposits of around 20 percent. None of this reverses because a tool flags an address.
So here is the change worth making, and it costs less than another analytics licence. Stop scoring addresses and start scoring off-ramps. For every customer whose stablecoin activity terminates at a service, record which service, in which jurisdiction, under which licence, and whether that service has ever answered a request for information from your institution or from your supervisor. Refresh the register quarterly and let it drive the customer's rating rather than the reverse. An address is a pseudonym you cannot subpoena. An exchange in Lagos, Dubai or Tallinn is a legal person with a regulator, a bank account and a reputation, and it is the only point in the corridor where an enquiry from you can compel an answer. Build the file around the counterparty you can actually reach.
Sources
Chainalysis, 2026 Crypto Crime Report, January 2026. TRM Labs, 2026 Crypto Crime Report, January 2026. FATF, Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs, sixth update June 2025 and seventh update July 2026. Elliptic, The State of Cross-Chain Crime 2025, July 2025. Malte Möser and Arvind Narayanan, Resurrecting Address Clustering in Bitcoin, Financial Cryptography and Data Security, 2022. International Monetary Fund, Understanding Stablecoins, Departmental Paper, 2025. Chainalysis, 2025 Geography of Cryptocurrency Report, September 2025. BlockSec, USDT Blacklisting in 2025, February 2026.