Crypto analytics may be helping to uncover child abuse material sites, but trends “definitely suggest” that the value of virtual currencies sent to exploitation sites will continue to grow in 2020 as child porn buyers flock to bitcoin.

That’s according to Chainalysis, a leading blockchain intelligence firm, which says the cryptocurrency industry is facing a “concerning trend”—both from a moral and a reputational standpoint.

One address linked to a child abuse material site received regular payments for 0.0021 BTC (Photo: Chainalysis)

According to new figures, the company tracked about $930,000 worth of bitcoin (BTC) and ether (ETH) payments to addresses associated with child abuse material sites. That’s a 32% increase on 2018, which in turn was a 212% increase on 2017.

Chainalysis says that these substantial year-on-year rises are mostly down to cryptocurrencies becoming an increasingly popular method for purchasing child pornography, rather than a sudden surge in demand for explicit material.

The one sliver of good news is that authorities are beginning to be able to track bitcoin transactions back to child pornography websites, most notably in the Welcome to Video investigation that shut down a huge distributor late last year.

Disturbing trends

Although Chainalysis says that the number of overall transactions represents a tiny subset of all activity in the cryptocurrency industry, the analytics company has uncovered unsettling evidence of how child abuse content is being purchased.

A significant volume of the revenue making its way to these providers comes from large payments—but Chainalysis says the vast majority of transactions have a value of between $10 and $50. This can indicate two things: a one-off purchase, or a subscription to child abuse content.

“We only see what is on the blockchain, and certain payment patterns certainly suggest subscriptions. For example, repeated payments in low amounts suggest a subscription model,” Chainalysis economist Nina Heyden told Modern Consensus.

And the Bitcoin blockchain’s immutable records appear to offer evidence to support this theory. Research of a crypto address that has been flagged by the Internet Watch Foundation as belonging to a child abuse material site shows that nearly all of the transfers it receives are worth 0.0021 BTC—worth $14.93 at the time of writing.



Chainalysis will go into more detail about its report in a webinar scheduled for 11 a.m. ET on April 23. Heyden and Chainalysis Senior Investigator Aron Akbiyikian will be joined by Assistant United States Attorney Zia Faruqui and two agents of the IRS Criminal Investigation division, which shuttered “Welcome to Video.”

The warning signs

Chainalysis says these data points and other insights from financial crime experts can provide crucial warning signs that a crypto address is transacting on a regular basis with a child abuse material site.

Indicators can include small but frequent payments to addresses that belong to the same entity. Frequent transactions between the hours of 11 p.m. and 5 a.m. can also be a warning sign, with research from South Korea showing that most crypto payments to child abuse material sites were made during night-time hours. It’s also often the case that crypto funds are being topped up using prepaid credit or debit cards.

“Because of abusers’ reliance on cryptocurrency, their transactions can provide unique insight into this otherwise opaque criminal industry and generate important leads for law enforcement as they investigate these particularly heinous crimes,” Heyden said.

Difficult to stop

The Chainalysis figures show the game of whack-a-mole that crypto analysis firms and law enforcement agencies are continuing to endure as they try to clamp down on child abuse material sites—not to mention the wider threat of web-based human trafficking and exploitation.

Many of these platforms accept bitcoins and other cryptocurrencies as payment, with some enabling users to upload their own content in exchange for credits to view other material.

Federal prosecutors said the Oct. 15 Welcome to Video arrests made possible by back-tracing darknet bitcoin transactions enabled them to dismantle the largest child sexual exploitation market by volume of content ever to be discovered. Along with 337 users in 11 countries including the U.S. arrested, 23 children were rescued.

The darknet site contained 250,000 unique videos, eight terabytes worth, and half of them were unknown to law enforcement. It was run out of a South Korean man’s apartment.

Each user had received their own Bitcoin address when they created an account on the Welcome To Video website. Given that detectives uncovered one million such addresses, prosecutors believe the South Korea-based platform may have had capacity for a million users.