Illicit Crypto Address Detection: A Complete Guide to On-Chain Threat Categories

Illicit crypto address detection is not a single technical operation: it is a classification challenge. Before any detection system can flag a wallet as high-risk, it must first understand what categories of illicit activity produce flagged addresses. A blocklist without a taxonomy is a static artifact that ages poorly. This article maps the seven categories of illicit on-chain activity that detection systems must cover, and explains how modern detection infrastructure identifies addresses across each category.

Why Illicit Address Detection Requires a Taxonomy, Not a Blocklist

A blocklist is a snapshot. It captures addresses that were already known to be illicit at the time the list was compiled. It does not identify addresses that will be flagged next week, next month, or after the next enforcement action.

A taxonomy-based detection approach starts from category understanding. Each category of illicit activity has a distinct behavioral signature on-chain. Terrorist financing uses specific wallet clustering patterns. DaaS operations have identifiable revenue-splitting mechanics. Pig-butchering networks route through recognizable aggregator addresses. Understanding the structure of each category allows detection systems to identify novel addresses before they appear on a static blocklist.

FATF's 2025 targeted update establishes the regulatory baseline. VASPs must demonstrate that their AML programs address the full range of illicit activity types, not just sanctioned entity screening. (FATF Virtual Assets Targeted Update 2025) A compliance program built on a blocklist alone cannot demonstrate coverage of emerging threat categories.

OFAC reinforces this point at the enforcement level. OFAC can and does designate blockchain addresses directly onto the SDN list. (OFAC FAQ 561) But SDN designation typically follows attribution work that takes months. Detection systems that rely solely on OFAC listings will always lag the actual threat landscape.

The Seven Categories of Illicit Crypto Activity

BlockSec's Compliance Handbook V3 (Ch3) maps seven distinct categories of illicit crypto activity. Each category represents a different threat actor profile, laundering methodology, and detection challenge.

(Compliance Handbook V3, Ch.3)

Each category requires a distinct detection approach (for the address-layer control that acts on these findings, see the KYA Compliance Guide). Terrorist financing detection depends on entity clustering across sanctioned organization networks. DeFi exploit detection requires tracing fund flows through smart contract interactions. Pig-butchering detection maps the aggregator wallet patterns that converge victim funds before laundering. A detection system optimized for one category will have blind spots in others.

Phishing at Scale: The DaaS Case

The phishing and draining category has industrialized in ways that blocklist-based detection cannot track in real time. Drainer-as-a-Service operations have created a franchise model for on-chain theft.

A 2025 joint study by BlockSec and Zhejiang University identified 9 Drainer-as-a-Service families that collectively stole $135 million from victims. The revenue model is franchise-style: operators retain 20%, affiliates keep 80%. (BlockSec's DaaS research)

Europol's IOCTA 2025 report confirms the broader trend: cybercriminal service markets, including DaaS, have reached a level of operational maturity that mirrors legitimate software distribution. (Europol IOCTA 2025) The implication for detection systems is significant. DaaS operations constantly rotate wallet addresses, spin up new drainer contracts, and use affiliate networks that create hundreds of distinct on-chain identities per campaign.

Static blocklists cannot keep pace with address rotation at this scale. Detection systems must identify the behavioral signatures of DaaS operations: the characteristic split-payment mechanics, the victim aggregation patterns, and the specific contract interaction sequences. They must do this rather than relying on a list of previously flagged addresses.

The detection coverage gap here is measurable. Of the 9 families identified in the BlockSec/Zhejiang study, the majority operated for months before appearing on any public blocklist. During that period, VASPs relying solely on static lists processed transactions from drainer-controlled addresses without any compliance flag.

Pig-Butchering and Southeast Asia Networks

Pig-butchering represents a category where the laundering infrastructure is as important as the fraud itself. These are not opportunistic scams. They are industrial-scale operations with dedicated money movement architecture.

The 2025 U.S.-UK joint operation seized $15 billion in Bitcoin from Southeast Asian pig-butchering networks. These scam operations ran forced labor camps and laundered proceeds through Huione Group. Huione processed $98 billion total, with $4 billion traced to illicit sources (BlockSec $15B Seizure Analysis).

The Huione case illustrates a structural feature of pig-butchering laundering: funds aggregate through a known intermediary before dispersal. Detection systems that can identify Huione-connected addresses, and similar aggregator nodes in other networks, can flag pig-butchering proceeds even when the original victim wallets are unknown.

The scale of $98 billion processed through a single intermediary network means that any VASP with significant volume has almost certainly received pig-butchering proceeds. The question is whether the detection system can identify the aggregator-layer addresses that connect those proceeds to their origin.

Detection at this category level requires entity-level graph analysis, not just address-level flagging. Individual victim addresses are numerous and rotate constantly. The aggregator nodes are the stable, identifiable points in the network.

How Detection Systems Identify These Addresses

Understanding the seven categories is necessary but not sufficient. Detection systems must translate category understanding into identification methods that work against novel, previously-unseen addresses.

The same challenge applies across all seven categories: detection requires behavioral signatures, not static lists. The Drainer-as-a-Service ecosystem documented above illustrates why: address rotation at franchise scale means a blocklist is always behind.

BlockSec's TxPhishScope system, published at ACM CCS 2023, has identified 33,130 phishing websites and 3,981 phishing accounts. Running since November 2022, it reports to MetaMask, Forta, and Etherscan. (BlockSec TxPhishScope Research)

TxPhishScope's methodology illustrates the broader principle. The system does not rely on a list of known phishing addresses. It identifies phishing by analyzing transaction-level behavioral patterns: the sequence of on-chain interactions that characterize a drainer operation. It then flags new addresses that match those patterns before they appear on any blocklist.

The same approach applies across all seven categories. Effective detection requires:

• Behavioral signature modeling: Each category has characteristic transaction patterns. Detection systems learn these patterns from historical cases and apply them to novel addresses.

• Entity clustering: Illicit actors control multiple addresses. Detection systems that identify clusters can flag newly-created addresses based on their connection to known entities, even if the new address itself has no prior history.

• Cross-chain tracing: Laundering operations routinely cross blockchain boundaries. A detection system limited to a single chain will miss fund flows that are deliberately routed through cross-chain bridges.

• Real-time label updates: New enforcement actions, exploit attributions, and sanctions designations must propagate into the detection database immediately, not on a weekly batch schedule.

The combination of behavioral modeling and entity clustering is what allows detection systems to identify illicit addresses faster than static blocklists can be updated.

Building a Detection-Ready Compliance Program

A compliance program that covers all seven illicit activity categories must translate the category analysis above into concrete detection capabilities.

The practical requirements follow from the category analysis above. Terrorist financing and sanctions detection requires integration with international designation databases. DaaS and phishing detection requires behavioral signature modeling of drainer operations. Pig-butchering detection requires entity-level graph analysis of aggregator networks. Ransomware and darknet market detection requires cross-chain tracing capability.

Detection is one input to the broader crypto AML compliance program; once an address is flagged, where you screen it across the transaction lifecycle is a separate deployment discipline covered in Crypto AML Address Screening. For a complete example of illicit address detection in production, see Interlace's case study for how it implemented Phalcon Compliance's detection pipeline.

No single data source covers all seven categories with adequate depth. A compliance program that relies solely on OFAC SDN listings will have strong sanctions coverage but weak DaaS and pig-butchering coverage. A program that relies solely on blockchain analytics labels will have coverage gaps in newly-emerged threat categories that have not yet been formally attributed.

The standard that FATF's 2025 update implicitly requires is a detection system that can demonstrate coverage across all seven categories, with documented methodology for how novel addresses in each category are identified and flagged.