Illicit Crypto Flows Aren't Diffuse: Five Addresses Concentrate Almost Everything

Chainalysis has published the Brazil section of its annual crypto crime report, and the reading that circulated here was the predictable one: Brazil is facing an escalation. The report says something else — and what it says is more useful.

Two findings, in the reverse order of the one the coverage chose.

The first: Brazil's share is below the global average

According to the firm, in the six months through March 2026 Brazil's share of illicit flow came in below the global average. And the global average, in the main report, is under 1% of all attributed volume — up slightly from 2024 and still beneath that threshold.

That doesn't mean there is little money at stake. Brazil received US$318 billion in on-chain value between July 2024 and June 2025, roughly a third of all crypto in Latin America. One percent of a market that size is still a great deal.

But the difference between "Brazil has a proportionally larger problem" and "Brazil has a large market with a normal proportion of illicit activity" changes the entire conclusion. The first suggests something here attracts crime. The second says the country has grown large enough for absolute volume to matter — which calls for a response built to scale, not one built around an exception.

The second, and the one that actually matters: concentration

This is the number that deserved the headline.

The report notes that the number of deposit addresses exposed to illicit flow at the Brazilian exchanges analyzed ranges from 550 to 950 per quarter. A respectable universe. Except that the five most exposed addresses consistently account for between 75% and 90% of all illicit volume received. In March 2026, roughly 80% went to five distinct addresses.

Worth rereading slowly. It isn't that dirty money scatters across hundreds of points and defeats any attempt to follow it. It passes through many — and accumulates in very few.

That inverts the intuition underpinning much of the discourse on blockchain tracing. The standard image is the needle in the haystack: millions of transactions, pseudonymity, practical impossibility. The data describes something else — a haystack with five doors.

Who launders here

The report breaks down the categories of identified illicit flow to the Brazilian exchanges analyzed between 2023 and 2025. Three of them together account for more than half of the 2025 total:

Cartel-linked laundering is the largest identified category, which the firm ties to the country's geographic position as a cocaine trafficking corridor.

Chinese money laundering networks, or CMLNs, appear consistently — and this is the most instructive category. Chainalysis describes them as professionalized businesses providing laundering as a service, serving trafficking organizations, fraud operations and, increasingly, state actors. In the global on-chain laundering ecosystem they already account for roughly 20%, growing since 2021.

Sanctioned Russian entities became a more visible component in 2024–2025. And guarantee services showed up in the Brazilian data in 2025.

Read together, the picture is that Brazil is not merely a destination for Brazilian dirty money. It is a transit point for laundering infrastructure that operates at international scale and sells the service to whoever needs it.

The rail is now stablecoins

One figure from the main report completes the picture: stablecoins have come to account for 84% of all illicit transaction volume. They stopped being a marginal asset and became the default medium.

The reason is the same one that made them useful to everyone else — price stability, fast settlement, frictionless cross-border transfer. Whoever moves illicit value has the same operational requirements as whoever moves licit value, and chooses on the same grounds.

What changes for anyone who has to make a decision

Three practical consequences, and none of them is about technology.

Concentration is an opportunity for intervention, not a comfort. That volume piles up at a handful of points means targeted measures reach disproportionately further than broad sweeps. It also means the absence of direct exposure says very little: the money reaches the point of accumulation after passing through many others.

Category matters more than origin. If laundering as a service is sold to third parties, knowing that a flow is "cartel" or "fraud" describes the client, not the operator. The structure doing the moving is the same one, and it is the structure that resurfaces in the next case.

The regulatory clock is already running. BCB Resolutions 519, 520 and 521 took effect in February 2026, reporting obligations began in May, and the authorization deadline for service providers falls in October. From then on, transacting with an unauthorized counterparty stops being an internal policy choice and becomes a compliance matter — which makes the question of who is on the other side considerably less rhetorical.

A caveat on what this piece does not claim

Nothing here attributes an address to a person or organization. The report cited works with aggregate categories, and that is how the numbers should be read. Saying that a specific address belongs to a given group is an assertion of a different kind, one that requires its own basis — and that rarely belongs in a public text.

All data comes from the Chainalysis crypto crime report, 2026 edition, linked above. The reporting periods are the firm's own and do not align with one another — value received covers July 2024 to June 2025, while the illicit flow share covers the six months through March 2026.