Crypto’s big growth on the books and in the shadows

TRM Labs' 2026 Crypto Crime Report finds illicit crypto activity reached an all-time high of about $158 billion in 2025, even as the proportion of crypto use tied to illicit activity declined because legitimate use cases grew faster. The data underscore expanding overall crypto adoption alongside persistent financial-crime risks, a dynamic likely to keep compliance, regulatory scrutiny and custody/AML considerations top of mind for investors and service providers.

Analysis

Market structure: Winners are compliance, custody and regulated on‑ramps (Coinbase/COIN, custodial banks, analytics providers) and cybersecurity vendors (CRWD, PANW) because $158B illicit flows rising in absolute terms will increase demand for AML/KYC tooling and insured custody over 12–24 months. Losers include privacy coins (XMR) and unregulated offshore venues plus anonymous DeFi rails that face increased de‑risking and higher cost of capital. Cross‑asset: expect tighter credit for crypto lending desks (wider bank credit spreads), higher implied vol in BTC-USD (short-term ±15–30%), and incremental energy demand volatility for miners impacting small-cap miners (MARA, RIOT).

Risk assessment: Tail risks include aggressive regulatory actions (US/EU blanket on‑ramp restrictions) that could depress unregulated tokens by 30–80% in weeks, and a major analytics/data breach that undermines proof trails. Immediate (days) risk: headline-driven BTC drawdowns of 10–25%; short-term (weeks–months): enforcement probes compress valuations of exchange tokens; long-term (years): structural consolidation to regulated providers. Hidden dependencies: stablecoin liquidity and correspondent banking access; a freezing of USD rails is a 1–3 month shock that propagates across venues. Key catalysts: DOJ/SEC enforcement actions or major exchange sanctions in next 30–90 days.

Trade implications: Direct plays: overweight regulated exchanges and security vendors; underweight privacy coins and non‑compliant exchange tokens. Use pair trades (long COIN, short BNB) to capture regulatory re‑rating; employ options (buy 3–6 month COIN calls 20–30% OTM for asymmetric upside; buy 3‑month 10–15% OTM puts on MARA/RIOT as tail hedges). Rotate from speculative DeFi/privacy into cybersecurity and custody over next 3–9 months.

Contrarian angles: Consensus focuses on illicit dollar figure; it understates that illicit share can fall while absolute illicit dollars rise—this favors incumbents able to scale compliance. Reaction may be overdone in liquid regulated exchange equity (COIN) versus exchange tokens (BNB) which historically reprice sharply on enforcement news; unintended consequence: harsh crackdowns could push illicit activity off‑chain, making on‑chain metrics temporarily less informative and increasing volatility.

Key Decisions for Investors

• Establish a 2–3% long position in Coinbase (COIN) with a 3–6 month horizon; scale in on pullbacks to $50–$80, target +25–35% if regulatory rotation favors regulated on‑ramps; hedge 0.5% with 3‑month calls 25% OTM for leveraged upside.
• Allocate 1.5–2% long to cybersecurity leaders CrowdStrike (CRWD) or Palo Alto (PANW) as secular beneficiaries of increased AML/cyber spend; 6–12 month hold, take profits at +20–30%.
• Enter a pair trade: long COIN 2% vs short BNB 2% (or equivalent exposure to Binance token) for 3–6 months to capture likely re‑rating; close if COIN/BNB performance diverges >20% or if no regulatory action within 120 days.
• Buy protective 3‑month puts on miners Marathon (MARA) or Riot (RIOT) 10–15% OTM sized at 0.5–1% of portfolio to guard against BTC-USD >20% downside triggered by enforcement shocks; sell puts if miners trade >40% off lows.