CSAM (youngster sexual abuse materials) is an understudied a part of the crypto crime ecosystem. The trade is broadly conscious that there are digital areas the place CSAM will be purchased and offered utilizing crypto, and there are well-publicized cases of regulation enforcement shutting down crypto-based CSAM marketplaces like Welcome to Video. 

Not all CSAM exercise includes cryptocurrency, and in lots of instances, customers merely commerce CSAM amongst themselves. However cryptocurrency-based gross sales of CSAM are a rising drawback. Tamsin McNally, Hotline Supervisor on the Web Watch Basis (IWF) shared with us that they “find virtual currency is the dominant choice for buyers and sellers of commercial child sexual abuse content, so much so that we now have a dedicated crypto unit that works with law enforcement and the finance industry to help provide evidence for investigations.” This analysis is our first try to supply a complete, goal measure of the CSAM-cryptocurrency ecosystem.

First, we debut a strategy for measuring the scope of the crypto-based CSAM ecosystem throughout quite a few completely different variables, primarily based on on-chain exercise. General, our knowledge means that whereas the dimensions of the crypto-based CSAM market has decreased in 2023, the sophistication of CSAM sellers and in flip their resilience to detection and takedowns has elevated over time. As well as, we’ll take a look at CSAM distributors’ use of obfuscation measures equivalent to mixers and privateness cash like Monero, and look at how distributors could profit from them. 

The entire CSAM knowledge we analyze right here relies on a subset of over 400 on-chain CSAM vendor wallets we’ve recognized that have been energetic between 2020 and 2023 and met a selected threshold of transaction exercise. We noticed over 10,000 wallets that despatched funds to CSAM vendor wallets in 2023, which for the needs of this analysis we label as CSAM consumers. Figuring out CSAM distributors isn’t straightforward, as most shrink back from promoting even on the darknet as a result of stigma related to this notably abhorrent type of crime — just about all darknet markets, for instance, explicitly ban the sale of this materials. Our identifications of CSAM vendor wallets come from a wide range of sources, together with the IWF, different companions and clients, and our personal investigations. 

We’re nearly definitely not capturing all on-chain CSAM exercise, however given the breadth of sources we draw from, in addition to the truth that now we have a sufficiently big pattern measurement to measure non-scale primarily based traits like longevity and class, we consider this analysis sheds helpful mild on how on-chain CSAM marketplaces function and have modified over time. 

How crypto’s CSAM drawback has modified over time: A four-component measurement

We quantify most types of cryptocurrency-based crime based on the crypto worth acquired by illicit addresses. Nevertheless, this could be deceptive within the case of CSAM. As a current research report by the European Parliament explains, there’s extra CSAM on the web than ever earlier than, and it’s by no means been cheaper to supply. Given the flood of cheap materials, and the truth that every bit of content material inherently includes abuse, we don’t consider {that a} greenback determine can precisely measure the true harm of CSAM. 

As an alternative, we’ve come up with a four-component measurement to evaluate the distinctive drawback of CSAM over time primarily based on completely different on-chain metrics. For any given time period, we will assign a rating for every of the 4 parts, and in that manner see how the cryptocurrency-based CSAM market modifications throughout every part over time. These 4 parts are:

Scale: Scale captures the dimensions of the CSAM market when it comes to transactions and contributors. On-chain metrics right here embody:

• Variety of wallets sending to CSAM distributors [1]
• Variety of distinct CSAM distributors energetic in the course of the time interval
• Variety of transactions incoming to CSAM distributors
• Whole worth despatched to CSAM distributors

Severity: Severity is meant to seize the extremity and quantity of the content material being shared on a per transaction foundation. Whereas this could’t be straight seen on-chain, we will infer these traits primarily based on the price of particular person transactions with CSAM distributors. On-chain metrics right here embody:

• Imply cost measurement 
• Median cost measurement
• Variety of CSAM distributors which have acquired funds of $70 or extra in measurement — these characterize the best tier of funds that CSAM distributors sometimes cost in a single transaction for content material. We’ll clarify the five-tier cost classification system consultants use for CSAM market analysis in additional element later. 

Sophistication: Sophistication refers back to the stage of obfuscation measures taken by CSAM suppliers throughout a given time interval. Later within the report, we’ll look at the connection between sophistication and CSAM distributors’ capacity to remain in operation for longer. On-chain metrics right here embody:

• Inflows to CSAM distributors from mixers (which we assume to be buyer funds made by way of mixers)
• Outflows from CSAM distributors to mixers (which we assume characterize efforts by CSAM distributors to launder funds)
• Outflows from CSAM distributors to instantaneous alternate providers that help privateness cash like Monero (which we assume are doable conversions into privateness cash by CSAM vendor operators for cash laundering functions)

Resilience: Resilience refers to CSAM distributors’ capacity to turn out to be energetic and keep in enterprise. On-chain metrics right here embody:

• Common cumulative lifespan of energetic CSAM distributors
• Variety of CSAM distributors that turned inactive in the course of the time interval (this could negatively impression the resilience rating)
• Variety of new providers that turned energetic in the course of the time interval
• The web progress or decline of CSAM distributors, calculated by subtracting the variety of providers that turned inactive throughout a given yr from the variety of new providers that emerged in that yr

Let’s take a look at how the crypto-based CSAM market has modified during the last 4 years alongside every of these 4 axes.

General, we see that the dimensions and severity of CSAM exercise peaked in 2021 after comparatively low exercise in 2020. The fluctuations in severity turn out to be clearer after we incorporate our five-tier cost classification system. This tiered pricing system has been recognized by IWF as being utilized by many CSAM distributors, with larger tiers being costlier and giving customers a better quantity of content material, and infrequently extra excessive content material, within the context of a single buy. The tiering system is as follows:

• Tier 1: $10 – $20 
• Tier 2: $20 – $35
• Tier 3: $35 – $50
• Tier 4: $50 – $70
• Tier 5: >$70

As we will see on the chart under, purchases in Tiers 4 and 5 have decreased as a share of general CSAM transactions over time since 2021, whereas the share for Tiers 1 and a couple of has elevated. 

This will likely point out that the CSAM being disseminated is turning into much less excessive, or that much less materials is being supplied on a per buy foundation. After all, it may additionally imply that the market is being flooded with content material, resulting in price drops throughout the board whatever the extremity of the content material. As an illustration, researchers have famous that AI is enabling the dissemination of artificial CSAM — a glut of such content material may drive costs down. 

We additionally see that the resilience of CSAM distributors has gone up. Have a look at the chart under, which exhibits the lifespan of all CSAM distributors we observe by begin date and finish date.

Lifespans are trending upwards: In 2023, the lifespan of the common energetic CSAM vendor is 884 days, up from 560 days in 2022. Nevertheless, comparatively few new CSAM distributors have cropped up in 2023 — simply 43, in comparison with 112 in 2022. Nonetheless, how is it that so many CSAM distributors are capable of persist for thus lengthy, and why is resilience going up? 

After all, there are numerous steps CSAM distributors may very well be taking to obfuscate their exercise that don’t have anything to do with cryptocurrency, equivalent to the usage of web anonymity instruments like Tor. However in terms of crypto particularly, the information suggests CSAM distributors could also be benefiting from the usage of Monero. Monero is the most well-liked of the so-called “privacy coins,” that are cryptocurrencies whose blockchains make use of distinctive privateness enhancing options that make it harder to observe the movement of funds or discern their unique supply.   

Many CSAM distributors have adopted Monero in recent times, although Bitcoin is by far probably the most broadly used cryptocurrency for CSAM buying. In actual fact, whereas the screenshot above exhibits a vendor asking customers to pay in Monero, the information suggests Monero’s function is extra prevalent in CSAM distributors’ efforts to launder their on-chain earnings, somewhat than to obscure the purchases themselves. It’s troublesome to point out Monero’s function straight on-chain utilizing commonplace blockchain analysis strategies, however we can take a look at CSAM distributors’ use of Monero-friendly instantaneous exchangers to estimate their potential Monero use. In contrast to conventional centralized exchanges (CEXes), which have largely delisted Monero, instantaneous exchangers are non-custodial and usually don’t supply crypto-to-fiat conversion — however in contrast to, say, a DeFi protocol, they’re centrally managed by a single group. Immediate exchangers sometimes draw on the liquidity of a number of CEXes to provide customers the very best costs, and facilitate the alternate of 1 crypto for an additional straight between customers’ wallets, such that the transaction is usually troublesome to hint on-chain. That, together with the truth that many instantaneous exchangers don’t require KYC, could make them useful for concealing the unique supply of cryptocurrency. 

It’s additionally doable that CSAM distributors are swapping into different cryptocurrencies, together with privateness cash aside from Monero. However primarily based on distributors’ particular solicitation of Monero and our personal investigations, we consider Monero to be the forex of alternative for laundering by way of instantaneous exchangers.

Our knowledge exhibits that CSAM distributors’ utilization of instantaneous exchangers that enable for Monero conversion has elevated considerably over the previous few years.

Conventional CEXes have at all times been the most important recipient of funds despatched by illicit providers, together with CSAM distributors. Nevertheless, Monero-friendly instantaneous exchangers have narrowed the hole in recent times, suggesting that CSAM vendor wallets could also be growing their utilization of Monero for cash laundering functions, though they proceed to obtain the majority of buyer funds in Bitcoin. Some CSAM distributors have transitioned nearly completely away from direct sending to CEXes, as an alternative sending funds solely to Monero-friendly instantaneous exchangers. We will see two examples of CSAM distributors that made that change in 2022 on the chart under.

If CSAM distributors’ utilization of Monero-friendly instantaneous exchangers does certainly correlate with precise utilization of Monero, the information means that Monero could also be serving to these CSAM distributors survive longer. Take a look at the chart under, which compares the survival charges over time of a pattern of CSAM distributors that ship funds to Monero-friendly instantaneous exchangers versus these that don’t.

CSAM distributors that use Monero-friendly instantaneous exchangers are more likely to outlive initially than people who don’t — inside 50 days of launching, the survival charge of potential Monero utilizing CSAM distributors is roughly 77.6%, in comparison with simply 57.0% for all others. Moreover, on the 1,000 day mark, 19.2% of potential Monero utilizing CSAM distributors are nonetheless energetic, in comparison with simply 3.8% of all others. Whereas the shortage of KYC at many instantaneous exchangers and incapability to hint by these centralized providers may play a task, the information means that Monero may very well be an enormous boon to CSAM distributors.

It’s necessary to notice that the usage of an instantaneous exchanger doesn’t essentially present anonymity for customers. Some instantaneous exchangers do have KYC and different compliance processes, together with transaction monitoring. We additionally know that many adjust to regulation enforcement requests associated to investigations, together with ones involving CSAM. 

General, 52.0% of CSAM vendor wallets energetic in 2023 have despatched funds to Monero-friendly instantaneous exchangers. One purpose that quantity isn’t larger may very well be Monero’s comparative issue of use. Many exchanges don’t help Monero for off-ramping functions, although customers may at all times swap again from Monero to a special cryptocurrency that’s simpler to transform into money. Regardless, the information means that the supply of privateness cash like Monero could assist CSAM distributors keep in enterprise longer. Legislation enforcement could take into account funding in specialised blockchain analysis providers that may make tracing Monero and different belongings doable, and instantaneous exchangers that don’t make use of conventional compliance practices could take into account constructing applications that contribute to a safer ecosystem.

Finish notes:

[1] For the needs of this analysis, we don’t depend transactions from providers to CSAM distributors, which may additionally characterize individuals buying this materials. We additionally don’t depend cases the place one particular person could also be buying CSAM from one other who made the preliminary buy from a CSAM vendor. For instance, if private pockets 1 transfers to CSAM vendor 1, after which private pockets 2 transfers to private pockets 1, we don’t depend that second transaction, which is likely to be redistribution. Once more, we’re nearly definitely not capturing all on-chain CSAM exercise.

This materials is for informational functions solely, and isn’t supposed to supply authorized, tax, monetary, funding, regulatory or different skilled recommendation, neither is it to be relied upon as an expert opinion. Recipients ought to seek the advice of their very own advisors earlier than making most of these choices. Chainalysis doesn’t assure or warrant the accuracy, completeness, timeliness, suitability or validity of the data herein. Chainalysis has no accountability or legal responsibility for any determination made or every other acts or omissions in reference to Recipient’s use of this materials.