Bitcoin and crime: Silk Road, ransomware and the myth of anonymity

Ask most people to name Bitcoin's dark side and they reach for the same story: it is the money of drug dealers, ransomware gangs and hitmen. The link between Bitcoin and crime is real, and this guide does not dodge it. But almost everything the headlines imply about it runs backwards, starting with the biggest assumption of all: is Bitcoin anonymous? I spent years writing explainers at Binance Academy, and no topic attracts more confident nonsense than this one. So let us take the famous cases, the Silk Road, WannaCry, Colonial Pipeline, and see what they actually teach about criminals, cash and a public ledger that never forgets.

Is Bitcoin actually anonymous?

No. Bitcoin is pseudonymous, not anonymous. Every transaction is recorded on a public ledger that anyone can read and that never disappears. Your name is not attached to an address, but patterns of spending, plus a single link to your real identity, can unmask the lot. In practice it is often more traceable than cash.

An address is a string of characters, closer to a pseudonymous username than a numbered Swiss account. Nothing on the Bitcoin blockchain records who owns it. The catch is that the ledger is public, permanent and complete: every payment an address has ever made or received sits there for anyone to inspect, forever. Cash is the opposite. A used banknote carries no history and names no one, and once it changes hands the trail goes cold. A bitcoin carries its entire history in plain view.

That permanence is why the anonymity is so shallow. Link one address to a real person, just once, and you can often walk the chain backwards and forwards through everything connected to it. The link usually comes from an exchange, where buying or holding bitcoin now means handing over a passport and proof of address. Investigators do not need to break any cryptography. They need one name against one address, and the blockchain supplies the rest.

Bitcoin and crime: the Silk Road and Ross Ulbricht

The Silk Road was a dark-web drugs market that ran from 2011 to 2013, using Bitcoin for payment and the Tor network for access. Its founder, Ross Ulbricht, was caught, convicted and given a double life sentence. It remains the case most people picture when they talk about Bitcoin and crime.

The Silk Road worked like a grim version of eBay: accounts, listings, buyer reviews and a star-rating system that kept dishonest dealers in check. It sold drugs, forged documents and stolen card details, reachable only through Tor, the anonymising network that layers your connection through other people's computers. Bitcoin was simply the payment rail that let strangers transact without a bank in the middle.

Here is the part that matters. Its founder, who went by "Dread Pirate Roberts", was not undone by any weakness in Bitcoin. Investigators traced an early internet forum post promoting the site back to an email address that carried his real name. That was Ross Ulbricht, then 29 and living in San Francisco. Agents arrested him in a public library in October 2013, staging a loud distraction so they could seize his laptop while it was open and logged in. Blockchain evidence corroborated the case, but old-fashioned mistakes cracked it.

Ulbricht was sentenced in 2015 to a double life term plus forty years without parole, a punishment many found grotesque for a non-violent first offence, whatever one makes of the site itself. He was granted a full presidential pardon by Donald Trump in January 2025 and released, a fact worth stating plainly because so much older writing still describes him as jailed for life. The wider tale is murkier still: two federal agents on the investigation, one from the DEA and one from the Secret Service, were themselves jailed for stealing bitcoin during the case. Even they were caught the same way, by the public ledger. The full charge sheet sits in the Department of Justice sentencing release.

Why do ransomware gangs both use Bitcoin and get caught by it?

Ransomware locks a victim's files and demands payment to release them. Bitcoin appeals to the attackers because it settles quickly and needs no bank's permission. The trap is that every payment is logged forever in public, so the very feature that lets a gang collect a ransom is the feature that lets investigators follow it.

Ransomware predates Bitcoin. Living in Berlin around 2010, I had a laptop locked by an early version that demanded I buy gift cards from a petrol station and send over the codes. I did not pay, but the method shows the problem criminals faced: moving money anonymously online used to be clumsy and embarrassing. Bitcoin looked like the upgrade, and through the 2010s it became the ransom of choice.

The Colonial Pipeline attack of May 2021 is the cautionary tale. A gang called DarkSide froze the systems of a firm carrying roughly 45% of the US East Coast's fuel and extracted a ransom of 75 bitcoin, then worth about $4.4 million. Within weeks the FBI had clawed back 63.7 of those coins. It did so, in the department's own words, by reviewing the Bitcoin public ledger and following the money to a wallet whose key it obtained. Read that Department of Justice seizure notice and the lesson is unmistakable: paying in bitcoin did not make the trail vanish, it created one.

WannaCry, in May 2017, makes the opposite point about scale. It spread through a leaked intelligence-agency exploit, infected millions of machines worldwide and crippled parts of the UK's National Health Service, causing some 19,000 cancelled appointments. For all that damage, it collected only around $130,000, because the bitcoin it demanded was so obviously watched that few victims could pay and cash out safely. The FBI's IC3 ransomware guidance still makes the blunt case that paying rarely ends well. Gangs use Bitcoin because it is fast and permissionless. They keep getting caught because it is permanent and public.

What are darknet markets and coin mixers?

Darknet markets are hidden online shops for illegal goods, reached through Tor and paid for in cryptocurrency. Coin mixers, sometimes called tumblers, are services that pool many people's bitcoin together to blur which coins came from where. Both try to buy back the privacy that a public ledger otherwise strips away.

The Silk Road was the first big darknet market, not the last. Successors appear and get taken down in a slow game of legal whack-a-mole, all built on the same template. Coin mixers are the other half of the laundering toolkit. The idea is simple: hundreds of users deposit bitcoin into a common pool, then withdraw the same amount, minus a fee, to fresh addresses. On paper, the link between your old coins and your new ones is broken.

In practice the tactic is fading. A mixer only works if plenty of law-abiding users want privacy too, and enforcement has made that costly. Major exchanges now flag or freeze coins that have passed through known mixers, and several mixing services have themselves been sanctioned and prosecuted. Proceeds from theft and scams, the subject of our guide to Bitcoin hacks and fraud, tend to end up here, which is precisely why the whole category draws so much scrutiny. The privacy a mixer offers is real but shrinking, and depositing washed coins at a regulated exchange increasingly undoes the wash.

How does blockchain forensics actually work?

Forensic firms treat the public ledger as one giant, permanent database. They cluster addresses that appear to share an owner, label the ones tied to exchanges and known criminals, and watch the choke points where cryptocurrency meets the regulated world. At those exchanges, know-your-customer checks attach a real name to the pseudonym.

The core trick is clustering. When a single transaction spends several inputs at once, those addresses almost certainly share one owner, so software groups them. Repeat that across the whole chain and millions of loose addresses collapse into a far smaller number of likely wallets. Firms such as Chainalysis and Elliptic then tag the clusters they can identify: this one belongs to a given exchange, that one to a sanctioned group, another to a known ransomware strain.

The decisive move is watching the choke points. Bitcoin may be borderless, but the moment a criminal wants to turn it into rent or a car, they usually pass through an exchange, and exchanges now demand identity documents under know-your-customer rules. That is where the pseudonym meets the passport. When Hamas solicited bitcoin donations from 2019, promoting fresh addresses for each appeal to look untraceable, US and Israeli investigators simply followed the flows to those choke points, identified donors and seized the funds. By 2021 the group had abandoned the effort. The public ledger had made it more dangerous than useful.

How much crime actually uses Bitcoin?

Less than most people assume, and the share is falling. Chainalysis put illicit activity at about 0.34% of all cryptocurrency transaction volume in 2023, down from 0.42% the year before. The overwhelming majority of on-chain value moves for ordinary, lawful reasons, and the criminal slice keeps shrinking as tracing improves.

That 0.34% is worth sitting with, because it is so far from the impression the headlines leave. In dollar terms it is still a large number, but as a proportion of everything happening on-chain it is a rounding error, and the trend has been downward as forensic tools sharpen and more addresses get identified. The figure comes from the Chainalysis 2024 Crypto Crime Report, which the firm revises upward over time as new criminal addresses surface, yet the number still lands well under half of one percent.

Set that against traditional money. Widely cited United Nations estimates suggest that between 2% and 5% of global GDP, trillions of dollars a year, is laundered through the conventional banking system. Whichever way you cut it, the overwhelming majority of financial crime still runs on banks and on the US dollar, not on Bitcoin.

Is "criminals use it" a good argument against Bitcoin?

Not really. Criminals use whatever money works, and cash and the US dollar remain their overwhelming favourites. A tool being misused says little about the tool. By that logic we would ban banknotes, the banking system and the internet, all of which serve crime on a scale Bitcoin never approaches.

The "criminals use it" line is an easy applause point that falls apart on contact. Every useful technology gets turned to harm. Cars carry getaway drivers, phones coordinate fraud, and physical cash, anonymous and untraceable by design, is the true currency of the underworld. Nobody proposes abolishing banknotes because robbers like them.

Bitcoin is a weaker tool for crime than its reputation suggests, precisely because it keeps receipts. Cash keeps none. If you genuinely set out to design money that helped criminals disappear, you would invent physical cash, not a permanent public ledger that every forensic firm on earth can download. None of this excuses the people in this article. It is a plea to judge the technology by what it actually does, which you can explore across the rest of our Bitcoin guide series.

Frequently asked questions

Is Bitcoin anonymous or traceable?

Traceable. Bitcoin is pseudonymous: addresses carry no names, but every transaction is public and permanent. Link an address to a real identity once, usually at an exchange with identity checks, and investigators can follow the money in both directions. For determined law enforcement it is often easier to trace than cash.

Can police recover stolen or ransomed bitcoin?

Sometimes, yes. Because the ledger is public, investigators can track coins to a wallet and, if they obtain the private key or freeze the funds at an exchange, seize them. The FBI recovered most of the Colonial Pipeline ransom this way. Recovery is never guaranteed, but "untraceable" is a myth.

What happened to Ross Ulbricht?

He founded the Silk Road, was convicted in 2015 and sentenced to a double life term plus forty years without parole. He served around eleven years before Donald Trump granted him a full presidential pardon in January 2025, and he was released. The case remains the defining example of Bitcoin's early links to crime.

Do criminals prefer Bitcoin to cash?

No. Despite the headlines, cash and the US dollar remain the dominant tools of financial crime, and United Nations estimates put laundering through the banking system in the trillions each year. Chainalysis estimated illicit activity at roughly 0.34% of crypto volume in 2023, a small and shrinking share.