The world of cryptocurrency has undeniably moved into the mainstream in recent years. Beyond its initial association with cybercrime, digital assets are now increasingly used to facilitate a wide range of activities, from international trade and remittances to investments and payments. However, alongside this growth and diversification of legitimate use cases, the landscape of illicit activity on-chain has also evolved, becoming both more varied and professionalized. New services providing infrastructure for illicit actors, including laundering, have emerged, adding layers of complexity.
In this dynamic environment, a stark finding from blockchain security firm Blockaid casts a significant shadow: a majority of cryptocurrency tokens launched in 2024 were found to be malicious. This revelation underscores the persistent challenge of security in the rapidly expanding crypto market.
Blockaid's Alarming Discovery About New Tokens
Blockaid's analysis, drawing data from its on-chain detection and response (ODR) platform which processed billions of transactions and analyzed millions of tokens in 2024, revealed a concerning trend. According to Blockaid, 59% of crypto tokens that debuted in 2024 were malicious in nature. This figure ties directly into the rising popularity and narrative of memecoins seen throughout the current market cycle, which has led to a proliferation of new tokens across various blockchains like Ethereum, Base, and Solana.
Among the different types of malicious tokens identified, rug-pull scams remained a particularly prevalent threat, accounting for 27% of these nefarious tokens launched in 2024. While Blockaid's report highlights this high rate of malicious token creation, it's worth noting that their data indicates the total amount lost to hacks and scams in 2024 was $1.4 billion. This figure, though still substantial, is presented as a significant decrease compared to figures cited for 2023, such as the $5.6 billion reported by the FBI.
Understanding the Rug Pull Mechanism
Given that rug pulls constitute a significant portion of malicious tokens, it's crucial to understand how this common scam tactic works. A rug pull is a type of fraud where developers of a cryptocurrency project suddenly abandon it and steal investors' funds. It often occurs with "shitcoins" – tokens created cheaply with little to no underlying utility or long-term plan.
Here is a breakdown of the typical steps involved in a rug pull:
- Token Creation: The scammer creates a new token, often easily and cheaply using platforms or forking existing code. They typically hold a large, often majority, stake in this new token.
- Marketing Blitz: The token is then heavily marketed and promoted, often through social media communities, bots, paid influencers, and spamming tactics, to generate buzz and demand. Sometimes, even those buying are aware of the risks but hope to profit before the eventual crash.
- Price Inflation: As more people are persuaded to buy, the demand drives the token's price up. Scammers might even use tactics like wash trading (selling tokens to themselves) to create the illusion of high demand and further inflate the price.
- The "Pull": Once the price has been sufficiently inflated, the creator executes the "rug pull" by suddenly selling ("dumping") their large holdings onto the market. On decentralized exchanges, another common method is removing the liquidity pool that enables trading, which prevents other holders from selling their tokens.
- The Crash: The sudden influx of tokens onto the market (or the removal of liquidity) causes the token's price to crash dramatically, often plummeting to near zero.
- Scammer Profits, Investors Lose: The scammer walks away with the profits made from selling their tokens at the inflated price, leaving later buyers with tokens that have become virtually worthless.
While the legal standing of such schemes can be complex due to the sometimes unregulated nature of crypto, pump-and-dump schemes are often considered illegal, and rug pulls are widely described as fraud and illegal. Law enforcement has indeed taken action against such activities.
A Look at the Broader Crypto Crime Picture in 2024
Blockaid's focus on malicious tokens and rug pulls sits within a wider context of crypto crime trends observed in 2024 by other industry reports.
TRM Labs reported an overall 24% decline in illicit crypto volume in 2024 . However, this overall figure masks troubling increases in specific areas. They noted ransomware payments soaring to record highs, expanded use of digital assets for terrorist financing, continued prevalence of scams and fraud, and significant losses due to North Korea-linked hacks . North Korean hackers alone were responsible for nearly $800 million in stolen cryptocurrency in 2024 according to TRM Labs , and $1.34 billion, representing 61% of the total stolen amount for the year according to Chainalysis data .
Chainalysis, while initially reporting a lower figure of $40.9 billion received by known illicit addresses in 2024 compared to their updated 2023 figure ($46.1 billion) , anticipates that the final 2024 number will likely exceed $51 billion as they continue to identify more illicit addresses and incorporate historical activity . They initially estimated illicit activity constituted just 0.14% of total on-chain transaction volume in 2024 , a percentage they expect to rise over time, though historically it remains below 1% .
Other trends noted by Chainalysis include:
- Stolen funds increased by approximately 21% year-over-year, reaching $2.2 billion in 2024 . DeFi services saw the largest share of stolen funds, though centralized services were the most targeted in Q2 and Q3 . Private key compromises accounted for the largest share (43.8%) of losses.
- High-yield investment scams and pig butchering remained highly successful fraud types . The increasing use of AI in fraud and scams, such as in sextortion attacks and to bypass KYC requirements, was also observed.
- There's been a steady diversification away from Bitcoin (BTC) as the primary cryptocurrency for illicit activity, with stablecoins now accounting for the majority (63%) of all illicit transaction volume . This mirrors the broader trend of stablecoin adoption across the ecosystem . However, BTC remains dominant in specific crime types like ransomware and darknet market sales . Sanctioned entities, facing challenges accessing traditional USD, often have greater incentive to use stablecoins due to the desire for stability.
Navigating the Path Forward
The high percentage of malicious tokens highlighted by Blockaid, coupled with the persistent and evolving nature of other crypto crimes, underscores the critical need for robust security solutions and user education in the crypto space. As new users are drawn into the market, particularly by speculative trends like memecoins, they face significant risks, including falling victim to scams like rug pulls.
Companies like Blockaid are actively working to combat these threats by providing real-time security platforms designed to detect and prevent fraud, scams, financial risks, and smart contract exploits. Their approach involves dedicated security research, analyzing both on-chain and off-chain data (including leveraging AI and machine learning), and maintaining wide visibility across networks through integrations with popular wallets and dApps. Blockaid highlights its success in scanning billions of transactions, securing billions in assets, and preventing hundreds of millions of attacks, thereby averting billions in potential losses. Industry leaders have endorsed and implemented Blockaid's solutions, emphasizing their role in improving user security and paving the way for a safer Web3 future.
Furthermore, the prevalence of scams and hacks reinforces the importance of security audits for new tokens and smart contracts. As AuditOne stresses, these audits are crucial for identifying vulnerabilities and building user trust before tokens are launched.
While the crypto crime landscape remains complex and challenging, the efforts of security firms, coupled with increasing user awareness and proactive measures, are essential steps towards mitigating risks and fostering a more secure environment for participants in the digital asset ecosystem.
Sources of the above content for reference：
https://www.trmlabs.com/resources/reports/2025-crypto-crime-report
https://www.chainalysis.com/blog/2025-crypto-crime-report-introduction/
https://www.blockaid.io/