Study finds $188 billion in risky funds linked to crypto exchanges

Global Ledger has identified $187.75 billion in high risk exposure across 99 crypto exchanges, with 10 platforms accounting for 90.9% of flagged inflows between 2021 and 2025.

Global Ledger, a blockchain analytics company, examined $36.28 trillion in deposits and withdrawals involving Bitcoin, Ethereum and USDT on Tron for its High-Risk Benchmark report, shared with crypto.news. Its analysis traced connections to identified high risk sources and destinations through as many as five blockchain transfers.

Across the sample, the report recorded $90.55 billion entering exchanges from flagged sources and $97.21 billion leaving for flagged destinations. One unnamed exchange accounted for $70.84 billion in combined exposure, including 41.3% of all risky inflows.

“Exposure represents proximity to identified high-risk entities rather than proof that an exchange or its customers knowingly participated in illicit activity,” the report’s methodology stated.

Crypto exchange exposure remained concentrated in 10 platforms

Within the 10 largest recipients and senders of flagged funds, the report counted $167.66 billion in combined exposure. Another 89 exchanges accounted for $20.09 billion.

Large dollar totals did not always correspond to high exposure rates. Among the top 10 platforms, the report put risky inflows between 0.07% and 2.25% of deposits, compared with the study’s industry benchmark of 0.68%.

Across the full sample, the analysis found individual exchange rates reaching 7.79% for inflows and 24.78% for outflows. Those maximum rates covered a different comparison group from the 10 exchanges ranked by exposure value.

Annual exposure fell from $60.80 billion in 2021 to $23.85 billion in 2023 before recovering to $34.61 billion in 2025, according to the study. Exchange transaction volume grew faster during the recovery, leaving flagged activity with a smaller percentage share.

In 2025, the report put risky inflows at 0.50% of deposits and risky outflows at 0.21% of withdrawals. Its five year outflow benchmark stood at 0.42%.

Sanctions and USDT on Tron accounted for most recent flows

Sanctions became the largest category in the study, generating $74.09 billion in combined exposure over five years. By 2025, the report attributed 62.2% of risky inflows and 53.8% of risky outflows to sanctions.

Fraud and hacks had supplied more than four fifths of flagged inflows in 2021, according to the analysis. Their respective inflow totals fell to $4.16 billion and $1.51 billion in 2025, while sanctions reached $11.02 billion.

Alongside that change, the report found USDT on Tron accounted for 68% of risky inflows and 80.4% of risky outflows in 2025. Bitcoin supplied 11% of flagged inflows, down from 83.1% in 2021.

Bitcoin nevertheless represented around 40% of all exchange deposits in 2025, compared with USDT’s 36%, according to the study. Its asset coverage was limited to Bitcoin, Ethereum and Tron based USDT.

In July 2025, the report recorded $2.48 billion in sanctions related inflows, representing approximately 84% of that month’s risky deposits.

Larger transfers carried much of the flagged value

Across the study period, the report identified 5,878 deposits exceeding $1 million that carried $33.77 billion, or 37.24% of risky deposit value. Such transfers represented only 0.02% of flagged deposit transactions.

Average risky transaction size rose from $392 in 2021 to $5,237 in 2025 as transaction counts fell from approximately 155 million to 6.6 million, according to the analysis.

Within the study’s tracing window, the value weighted average distance between exchanges and flagged entities rose from 1.51 transfers in 2021 to 2.73 in 2025.

Its methodology warned that funds can lose their original attribution through mixers, bridges, privacy services and unidentified wallets. Connections beyond five transfers were outside its scope, so falling identified exposure did not necessarily establish a comparable fall in the underlying activity.

Customer restrictions can follow separate exchange reviews. On Sept. 2, OKX CEO Star Xu warned that high risk deposits could trigger reviews lasting 15 days or longer, during which account functions and funds might be restricted.

Xu’s warning covered transfers involving Telegram escrow groups and Huiwang variants, with the duration depending on the circumstances. His statement did not establish a fixed review period.

Garantex disruption produced a different result from designation

Garantex remained connected to the sampled exchanges for almost three years after its April 2022 U.S. sanctions designation, according to the benchmark report.

Following the March 2025 infrastructure disruption, the study calculated that average daily flagged inflows associated with Garantex fell 98.9%, while outflows fell 99.7%.

According to the Justice Department, U.S. authorities seized three Garantex domains on March 6, 2025, and announced the operation March 7. German and Finnish authorities seized servers, while U.S. authorities froze more than $26 million.

Treasury subsequently identified Grinex as a successor that received Garantex customers and funds. The benchmark found lower exposure after Grinex and A7A5 were designated in August 2025, but higher average daily exposure after Bitpapa’s March 2024 designation.

Japan’s Ministry of Foreign Affairs included Garantex in its Oct. 2 sanctions package covering 33 entities and nine individuals, according to coverage published Oct. 4.

An Oct. 9 account detailed UK restrictions targeting Cryptomus, Heleket and TokenSpot. TRM Labs investigators cited in that coverage traced more than $950 million in combined transfers from TokenSpot to A7, Garantex and Grinex.

Licensing estimates relied on website traffic

Among 10 exchanges examined for licensing, the benchmark estimated $52.33 billion in exposure associated with jurisdictions where platforms held recorded licenses.

Its methodology allocated transaction exposure using the geographic distribution of website visits because infrastructure could not generally be separated by licensed legal entity. The estimate did not establish where individual transactions originated.

Separately, the study found that 17 exchanges authorized under the EU’s Markets in Crypto-Assets Regulation by August 2026 had recorded $83.18 billion in historical exposure. Their transaction records covered 2021 through 2025, largely before the authorization status used for comparison.

Within a separate North Korea analysis, the report recorded $544.40 million in combined exchange exposure. Its methodology excluded withdrawals representing the original theft from exchanges targeted in incidents attributed to North Korean actors.