Monero Activity Holds Steady Despite Exchange Delistings, TRM Labs Reports
Monero (XMR) has shown resilience in transaction activity despite significant exchange delistings and regulatory scrutiny, with TRM Labs reporting that 48% of new darknet markets in 2025 accept only XMR. The preference for Monero among ransomware actors highlights its appeal in high-risk environments, although Bitcoin remains the currency of choice for actual payments due to liquidity. Overall, demand for Monero has remained stable, indicating a structural shift in its usage among illicit actors.
TLDR: TRM Labs found that 48% of newly launched darknet markets in 2025 accept only Monero as payment. Nearly 14–15% of reachable Monero network peers displayed non-standard peer-to-peer protocol behavior. Ransomware actors prefer XMR, yet most real-world ransom payments are still completed in Bitcoin. Monero’s on-chain cryptography remains intact, but network-layer dynamics may affect privacy assumptions. Monero continues to maintain stable on-chain transaction activity despite growing regulatory pressure. TRM Labs released new research showing that XMR usage has remained above pre-2022 levels. Even after major exchanges removed the privacy coin, demand has not dropped. The findings also reveal unusual peer-to-peer network behavior affecting roughly 14 to 15 percent of observable nodes. Darknet Markets and Ransomware Drive Persistent Demand Monero’s appeal in high-risk environments has grown considerably over the past few years. Nearly 48 percent of newly launched darknet markets in 2025 support XMR exclusively. That figure marks a sharp rise compared to earlier years when Bitcoin remained the dominant option. Western-facing markets are leading this shift, partly due to improved tracing capabilities on transparent blockchains. Ransomware groups still express a clear preference for receiving payments in Monero. However, most actual ransom settlements continue to occur in Bitcoin due to liquidity advantages. Bitcoin remains easier to acquire and convert at scale, even though it is more traceable. That gap between preference and practice reflects a real tension between privacy and usability. TRM Labs addressed this directly, stating, “Most ransomware payments still occur in BTC—liquidity matters.” The firm also noted that “48% of new darknet markets in 2025 are XMR-only,” indicating a measurable structural shift in how high-risk actors choose to operate. Despite exchange delistings and enforcement pressure, XMR activity on Monero remains above pre-2022 levels. Key ...
Comments
Log in to comment