TL;DR

• Cryptocurrency flows to suspected human trafficking services, largely based in Southeast Asia, grew 85% in 2025, reaching a scale of hundreds of millions across identified services.
• Telegram-based “international escort” services show sophisticated integration with Chinese-language money laundering networks (CMLNs) and guarantee platforms, with nearly half of transactions exceeding $10,000.
• Analysis reveals global reach of Southeast Asian trafficking operations, with significant cryptocurrency flows from destinations across the Americas, Europe, and Australia.
• CSAM networks have evolved to subscription-based models and show increasing overlap with sadistic online extremism (SOE) communities, while strategic use of U.S.-based infrastructure suggests sophisticated operational planning.
• Unlike cash transactions, cryptocurrency’s inherent transparency creates unprecedented opportunities for law enforcement and compliance teams to detect, track, and disrupt trafficking operations.

The intersection of cryptocurrency and suspected human trafficking intensified in 2025, with total transaction volume reaching hundreds of millions of dollars across identified services, an 85% year-over-year (YoY) increase. The dollar amounts significantly understate the human toll of these crimes, where the true cost is measured in lives impacted rather than money transferred.

This surge in cryptocurrency flows to suspected human trafficking services is not happening in isolation, but is closely aligned with the growth of Southeast Asia–based scam compounds, online casinos and gambling sites, and Chinese-language money laundering (CMLN) and guarantee networks operating largely via Telegram, all of which form a rapidly expanding local illicit ecosystem with global reach and impact. Unlike cash transactions that leave no trace, the transparency of blockchain technology provides unprecedented visibility into these operations, creating unique opportunities for detection and disruption that would be impossible with traditional payment methods.

Our analysis tracks four primary categories of suspected cryptocurrency-facilitated human trafficking:

1. “International escort” services: Telegram-based services that are suspected to traffic in people
2. “Labor placement” agents: Telegram-based services that facilitate kidnapping and forced labor for scam compounds
3. Prostitution networks: suspected exploitative sexual service networks
4. Child sexual abuse material (CSAM) vendors: networks of individuals engaged in the production and dissemination of CSAM

Payment methods vary significantly across these categories. While “international escort” services and prostitution networks operate almost exclusively using stablecoins, CSAM vendors have traditionally relied more heavily on bitcoin. However, even within CSAM operations, bitcoin’s dominance has decreased with the emergence of alternative Layer 1 networks. Broadly, the predominant use of stablecoins by “international escort” services and prostitution networks suggests that these entities prioritize payment stability and ease of conversion over the risks that these assets might be frozen by centralized issuers.

As we detail below, the “international escort” services are tightly integrated with Chinese-language money laundering networks. These networks rapidly facilitate the conversion of USD stablecoins into local currencies, potentially blunting concerns that assets held in stablecoins might be frozen.

Nearly half of Telegram-based “international escort” service transactions exceed $10,000, demonstrating professionalized operations

The distribution of transaction sizes reveals distinct operational models across different types of suspected trafficking services. “International escort” services show the highest concentration of large transactions, with 48.8% of transfers exceeding $10,000, suggesting organized criminal enterprises operating at scale. In contrast, prostitution networks cluster in the mid-range, with approximately 62% of transactions between $1,000-$10,000, indicating potential agency-level operations.

These “international escort” services operate with sophisticated business models, complete with customer service protocols and structured pricing. For example, one prominent operation advertises across major East Asian cities with a tiered pricing system ranging from 3,000 RMB ($420) for hourly services to 8,000 RMB ($1,120) for extended arrangements, including international transport. These standardized pricing models create identifiable transaction patterns that investigators and compliance teams can use to detect suspicious activity at scale.

CSAM vendors and marketplaces

CSAM operations demonstrate different but equally concerning patterns. While approximately half of CSAM-related transactions are under $100 – unfortunately, there’s more CSAM on the internet than ever before, and it’s never been cheaper to produce – these operations have evolved sophisticated financial and distribution strategies. In 2025, we observed that, while these networks still collect payments in mainstream cryptocurrencies, they increasingly use Monero for laundering proceeds. Instant exchangers, which provide rapid and anonymous cryptocurrency swapping without KYC requirements, play a crucial role in this process.

The business model for CSAM operations has largely consolidated around subscription-based services rather than pay-per-content transactions, generating more predictable revenue streams while simplifying administration. These subscriptions typically cost less than $100 per month, creating a lower barrier to entry while establishing regular revenue for operators.

A disturbing trend emerged in 2025 with increasing overlap between CSAM networks and sadistic online extremism (SOE) communities. Following law enforcement actions against groups like “764” and “cvlt,” we observed SOE content appearing within CSAM subscription services, commonly advertised as “hurtcore.” These SOE groups specifically target and manipulate minors through sophisticated sextortion schemes, with the resulting content being monetized through cryptocurrency payments, perpetuating cycles of abuse.

The scale of these operations became particularly evident in July 2025, when Chainalysis identified one of the largest CSAM websites operating on the darkweb following a UK law enforcement lead. This single operation utilized over 5,800 cryptocurrency addresses and generated more than $530,000 in revenue since July 2022, surpassing the notorious “Welcome to Video” case from 2019.

Geographic analysis of clearnet CSAM operations reveals strategic use of U.S. infrastructure [1]. While U.S.-based IP addresses account for a large portion of CSAM activity associated with surface websites, IPs from other countries like South Korea, Spain, and Russia show smaller flows. This suggests that these operations leverage U.S.-based infrastructure for scale, reliability, and an initial appearance of legitimacy that helps the activity blend into normal traffic and delays detection. Further, if the operators are outside the U.S., it reduces their personal exposure.

Chris Hughes, Internet Watch Foundation Hotline Director, told us, “In 2025, the Internet Watch Foundation identified 312,030 reports containing child sexual abuse images and videos. This is more than ever before, with an increase of 7% from the previous year. Early analysis of IWF data indicates that most clearweb sites offering virtual currency as a payment for child sexual abuse are hosted in the US, while darkweb sites were the second highest. Any payment information that we identify on commercial websites is captured and shared with global law enforcement and organisations like Chainalysis to disrupt further distribution of criminal imagery and to help in the investigation of those who create, share and profit from the sale of child sexual abuse material.”

Despite these concerning trends, 2025 saw significant law enforcement successes, including the takedown of “KidFlix” by German authorities and increased arrests of CSAM consumers across the United States. These cases demonstrate how blockchain analysis can provide critical evidence for identifying, investigating, and prosecuting both operators and consumers of CSAM networks.

Telegram-based services show deep integration with Chinese-language money laundering networks (CMLNs) and guarantee platforms

“International escort” services

The cryptocurrency footprint of escort services reveals sophisticated integration with established financial infrastructure, particularly CMLNs and guarantee platforms. While some escort services operate legally, cryptocurrency transaction patterns help identify potential trafficking operations through their distinct financial behaviors.

The majority of cryptocurrency movements flow through a combination of mainstream exchanges, institutional platforms, and guarantee services like Tudou and Xinbi. This creates both vulnerabilities and opportunities: while these platforms provide easier access to the financial system, they also serve as critical chokepoints where compliance teams can detect and investigate suspicious patterns.

“Labor placement” agents

It’s been widely reported that scam operations — pig butchering schemes in particular — are deeply intertwined with human trafficking. Victims are often lured by fake job offers before being forced to work in Southeast Asian scam compounds, where they face brutal conditions and are coerced into operating romance/investment scams under threat of violence.

These operations utilize guarantee services’ “human resource” vendors to facilitate recruitment. Channel participants inquire about methods to transport workers who have been detained at immigration checkpoints, while compound administrators provide updates concerning regional developments that might affect their operations, such as the ongoing border tensions between Thailand and Cambodia.

Blockchain analysis shows that recruitment payments typically range from $1,000 to $10,000, aligning with advertised pricing tiers. This provides another opportunity to leverage identifiable transaction patterns to detect suspicious activity at scale. These agents maintain presence across multiple guarantee platforms to maximize their reach, with some operating through mainstream cryptocurrency exchanges.

The involvement of established criminal organizations became evident through our analysis of trafficking-related channels. For example, we identified an administrator account linked to the “Fully Light Group,” a Kokang-based organization previously flagged by the United Nations Office on Drugs and Crime (UNODC) for illegal gambling and money laundering. Their presence in channels facilitating transactions between scam compounds and “labor placement” agents suggests how established criminal networks provide critical financial infrastructure for trafficking operations.

Southeast Asian organizations facilitating potential trafficking show global reach through cryptocurrency

Geographic analysis of “international escort” services in 2025 reveals how Southeast Asian services, particularly Chinese-language operations, have expanded their reach globally through cryptocurrency adoption [2]. The transparency of the blockchain provides valuable insight into broader trafficking patterns and financial flows of these types of operations.

Based on our data, Chinese-language services operating through networks spanning mainland China, Hong Kong, Taiwan, and various Southeast Asian countries demonstrate sophisticated payment processing capabilities and extensive international reach. Their large-scale cryptocurrency transactions show significant flows from countries including Brazil, the United States, the United Kingdom, Spain, and Australia, indicating the truly global scope of these operations.

While traditional trafficking routes and patterns persist, these Southeast Asian services exemplify how cryptocurrency technology enables trafficking operations to facilitate payments and obscure money flows across borders more efficiently than ever before. The diversity of destination countries suggests these networks have developed sophisticated infrastructure for global operations.

Key risk indicators and monitoring strategies

While the sophistication of cryptocurrency-facilitated trafficking operations continues to grow, the transparent nature of blockchain technology provides powerful tools for detection and prevention. Our analysis has identified several key indicators that compliance teams and law enforcement can monitor:

• Large, regular payments to labor placement services paired with cross-border transactions
• High-volume transactions through guarantee platforms
• Wallet clusters showing activity across multiple categories of illicit services
• Regular stablecoin conversion patterns
• Concentrated fund flows to regions known for trafficking operations
• Connections to Telegram-based recruitment channels

The increasing sophistication of these operations, particularly their growing intersection with legitimate businesses and professional money laundering networks, requires a comprehensive monitoring approach that leverages blockchain analysis alongside traditional anti-trafficking efforts and public education. As these networks continue to evolve, the transparency of blockchain technology provides unprecedented opportunities for detection, disruption, and enforcement that would be impossible with traditional payment methods.

[1] This analysis is limited to the clearweb portion of the CSAM industry. A significant portion of CSAM transactions are conducted peer-to-peer through encrypted messaging apps or the darkweb, where reliable IP addresses can not be obtained for this analysis.

[2] This analysis involved a combination of signals to estimate the country of origin, including web traffic data and the use of regional crypto exchanges.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. 

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.

PHOENIX (AZFamily) — The high-profile disappearance of Nancy Guthrie has brought new attention to the world of cryptocurrency, with multiple ransom notes sent to media outlets demanding payment in Bitcoin in exchange for Nancy Guthrie or her whereabouts.

What is cryptocurrency?

Cryptocurrency is digital money that only exists online. It operates on a network or blockchain rather than being controlled by a bank. It allows person-to-person transactions and uses a public ledger to record transactions. Crypto is most frequently used for online payments or investments.

Crypto expert Robert Hockensmith said every transaction is tracked and verified.

“Any time you buy it, any time you sell it, any time you use it to buy a product or service, any time you connect it or take it to another place, it is identified as you touching it. That’s how it works,” said Hockensmith, who works with AZ Money Guy.

Why criminals use cryptocurrency

Despite the tracking capabilities, criminals use crypto because it’s not that simple to trace. A cybersecurity expert said a lot of criminals have found creative ways to avoid being traced.

They’ll use multiple crypto wallets and addresses to obscure their identity. Funds can be transferred globally almost instantly, and if some IP addresses are hidden, they can be harder to locate. Once a transaction is confirmed, it’s extremely difficult to reverse.

“If you think about, for example, ID theft, cybercriminals might literally steal someone’s identity and that might include their access to something like Coinbase and then use that victim’s Coinbase to receive stolen funds and move it somewhere else, same way they used to do it with wire transfers,” said Eric Foster, cybersecurity and crypto expert and CEO of Tenex.AI.

Another crypto expert said criminals will keep moving their crypto over and over again, making it harder and harder to trace. He calls crypto the modern way of transporting large sums of money and said it has become the currency of choice for criminals.

See a spelling or grammatical error in our story? Please click here to report it.

Do you have a photo or video of a breaking news story? Send it to us here with a brief description.

Copyright 2026 KTVK/KPHO. All rights reserved.