Bitcoin's high transaction fees, delays, and limited anonymity spur cybercriminals towards altcoins like Monero
Danny Palmer / ZDNet :
Context & Ripple Effects
When cyber-extortionists first demanded Bitcoin ransoms from financial-sector targets in 2015, the currency's pseudonymity was the draw — but its public ledger left a trail. The shift had already begun on the demand side: in 2016, AlphaBay began supporting Monero, giving darknet buyers a genuinely obscured alternative.
This report marks the tipping point: Bitcoin's own success — congestion, high fees — plus its traceability made it impractical for crime, and the pattern held. By 2021, ransomware gangs were routinely demanding Monero to defeat blockchain analysis, with cash-outs routed through unlicensed exchanges and OTC brokers.
First-order effects
- Ransomware operators and darknet vendors pricing demands in Bitcoin face slower confirmations and higher per-transaction costs, directly cutting into extorted margins and pushing them to quote victims in Monero instead.
- Bitcoin loses a segment of transaction volume that prized anonymity over liquidity, while Monero gains adoption as the default criminal settlement rail.
Second-order effects
- Blockchain forensics firms pivot their tracking business from Bitcoin heuristics to Monero-mixing and exchange chokepoints, since the ledger itself no longer yields leads — shifting interdiction from-chain to off-chain.
- Exchanges and regulators face pressure over where Monero converts back to fiat, making unlicensed exchanges and OTC brokers the new bottleneck for law enforcement rather than the payment chain itself.
Third-order effects
- If the pattern holds, criminal preference becomes a forcing function for privacy-coin regulation: the currencies that win illicit adoption attract the compliance crackdowns that shape which coins mainstream exchanges can list.
- Ransomware economics decouple from any single cryptocurrency — even the 2024 weakening of LockBit and BlackCat leaves the payment infrastructure intact, so disruption of one gang does not disrupt the rails the next gang inherits.
The trend: Illicit crypto adoption is migrating from transparent ledgers toward privacy coins and off-ramp brokers, with each crackdown on cash-out points — not on the coins themselves — defining the next battleground.