The 1% problem: Stop confusing crypto’s criminals with its customers

Cryptocurrency still walks into a South African boardroom wearing a balaclava. Mention bitcoin, and someone reaches for ransomware, sanctions evasion, or a suitcase of unmarked tokens. The reflex is understandable. The cases are real, they are ugly, and they travel well. They are also a poor description of how the system is used, especially on the corridors that actually matter to this region.

The latest forensic evidence is blunt. In 2025, identified illicit addresses received at least $154 billion in cryptocurrency, a sharp rise in nominal terms driven largely by sanctioned entities and stablecoins (Chainalysis, 2026).

TRM Labs (2026) independently estimates $158 billion. Both still place illicit activity at below 1% to 1.2% of attributed on-chain volume. That is the number that should sit next to every morality play about “crypto and crime”.

A share of around 1% is not a clean bill of health. It is a demolition of the claim that digital assets are pervasively used for nefarious finance.

Read: Fed proposes payment stablecoin issuer identification program

The myth survives because a public ledger makes the worst 1% visible, while the equivalent flows in cash, hawala, trade mis-invoicing and correspondent banking remain comfortably opaque. In Southern Africa that opacity has a price tag, and working households pay it every month.

Start with the corridor, not the courtroom

South Africa is not a footnote in this debate. It is a sending hub. Outbound remittances from South Africa to neighbouring countries exceeded R19.4 billion in 2024, more than three times the 2016 figure (Katende, 2026).

Millions of Zimbabwean, Mozambican, Malawian, Basotho and eSwatini workers move value home from Gauteng, the mines and the farms.

Sub-Saharan Africa remains the most expensive region in the world to receive that money. World Bank data put the cost of sending $200 to the region near 8% in 2025, almost three times the UN Sustainable Development Goal target of 3%.

Some South Africa-origin corridors to Zimbabwe, Malawi and Lesotho have been quoted far higher, in places approaching 15% (World Bank, 2025; South African Reserve Bank, 2025).

Read: Africa’s next payments leap: Stablecoins on every corner

SADC’s own integration story is uneven. Shared settlement and the Transactions Cleared on an Immediate Basis scheme are real progress.

Average SADC remittance costs still sit above the Sub-Saharan mean on several measures, because the region is not a single payments market and because cash-out, compliance and thin competition still extract rent (FinMark Trust, 2024; Sarb, 2025).

That is the system against which crypto should be judged here: not a Swiss mixer, but a R2 000 transfer that arrives late and light.

Between July 2024 and June 2025, Sub-Saharan Africa received more than $205 billion in on-chain value, up 52% year on year, the third-fastest-growing crypto region in the world (Chainalysis, 2025).

Transfers under $1 000 took a larger share of regional volume than the global average. That is the fingerprint of bills, payroll and family support, not of oligarchs. Stablecoins now dominate much of that flow.

Households did not adopt dollar-linked tokens because they wished to finance ransomware. They adopted them because the official rail was slow, expensive or closed.

Read: Blockchain is quietly powering everyday life across Africa

None of this is an argument for lawless capital flight. South African exchange control still applies. Using crypto to move value offshore without the required permissions is not a clever workaround; it is a compliance failure, as recent Reserve Bank litigation has underlined.

The adult position is simpler. Licence the on- and off-ramps, apply the same customer due diligence expected of any money transmitter, and stop treating a cheaper rail as a moral defect.

What the scandal file actually proves

The file is not empty. In November 2024 Ukraine’s High Anti-Corruption Court sentenced MP Andriy Odarchenko to eight years for offering a bitcoin bribe, the country’s first documented cryptocurrency inducement (High Anti-Corruption Court of Ukraine, 2024).

Alexander Vinnik, operator of the early exchange BTC-e, pleaded guilty in the United States in 2024 to money-laundering conspiracy and was released in a February 2025 prisoner exchange (United States Department of Justice, 2024; 2025).

Garantex, a Moscow-linked exchange long associated with ransomware proceeds, had its domains seized in March 2025 by the US Secret Service working with Europol, Germany and Finland. Within days a successor brand, Grinex, was moving client liquidity and a rouble-linked stablecoin (United States Department of Justice, 2025; TRM Labs, 2025).

Read: SA bitcoin ‘ponzi’ scheme out of regulator’s reach

These episodes prove capability, not prevalence. A crowbar can open a safe. That does not make every hardware store a criminal enterprise.

The same public blockchain that lets a corrupt official send 0.39 bitcoin is the reason investigators could identify the wallet, confiscate the coins and obtain a conviction. A cash envelope sent from Johannesburg to Harare does not offer the prosecution that courtesy.

The older academic picture belongs in the same frame. Foley, Karlsen and Putnins (2019), in The Review of Financial Studies, estimated that in bitcoin’s dark-net years roughly a quarter of users and close to half of transaction counts were tied to illegal activity.

That paper is peer-reviewed and still the most cited academic estimate of early bitcoin crime. It also documented the decline in the illegal share as legitimate users arrived. Treating a 2013-2017 market structure as the 2026 reality is how a useful paper becomes a misleading slogan.

The comparator nobody wants

If the test is “does this rail carry dirty money?”, every monetary system fails it.

The United Nations Office on Drugs and Crime has, for more than a decade, placed global money laundering in a band of 2-5% of world GDP, hundreds of billions to several trillion dollars a year, almost all of it still moving through banks, cash, companies and trade (UNODC, 2011).

Ernst & Young (2025) puts the broader shadow economy near 12% of GDP across a large country sample. High-denomination notes, cash-intensive businesses, professional enablers and offshore companies have moved far more stolen value than any mixer.

Transparency International’s work on Russian trade through the British Virgin Islands and Bermuda makes that point without any blockchain in sight.

Russia’s score of 22 out of 100 on the 2025 Corruption Perceptions Index is a governance fact, not a bitcoin fact (Transparency International, 2025).

Two further comparisons matter. First, detection. On a public ledger, analytics firms can follow more than 80% of identified illicit flows after the first hop (Binance Research, 2026).

In the fiat system, UNODC has long estimated that only around 1% of laundered proceeds are seized. Second, composition. Some 84% of 2025 illicit crypto volume was in stablecoins, not in “anonymous bitcoin” (Chainalysis, 2026).

Criminals follow liquidity and low volatility, exactly as they follow dollars, euros and rand. The asset is not the motive.

None of this is an argument against regulation. The Financial Action Task Force’s Recommendation 15 already requires virtual asset service providers to apply customer due diligence, the travel rule and suspicious-activity reporting (FATF, 2019; 2026).

South Africa’s Financial Sector Conduct Authority had approved 310 crypto asset service provider licences from 533 applications by the end of March 2026 (CryptoSlate, 2026).

Read: The dangers of over-regulating crypto

The European Union’s 21st Russia sanctions package of 23 July 2026 created a tool to ban crypto-asset services in third countries that host evasion platforms (Council of the European Union, 2026). Those are adult responses. Equating the entire asset class with the 1% that abuses it is not.

Where the tool is better than the system we have

The adult comparison is not crypto versus virtue. It is crypto versus the rails people in this region actually use.

More than a billion adults remain unbanked; many more are underbanked (World Bank, 2025). A SWIFT transfer of a few hundred dollars can take days and carry fixed fees that punish the poor.

In the Johannesburg-Harare, Johannesburg-Maputo and Johannesburg-Blantyre corridors, a stablecoin transfer that settles in minutes at a fraction of the bank quote is not ideology. It is a cheaper middle mile.

The honest caveat is the same one the Bank of Italy recorded in live tests: the chain leg is cheap; the on-ramp and the cash-out are where cost and delay return (Banca d’Italia, 2026).

That is an argument for better licenced off-ramps and faster local settlement, including SADC’s TCIB rails, not for pretending the old stack is fine.

Programmable settlement has the same commercial logic as any well-designed incentive scheme. Escrow that releases on delivery, payroll that cannot be quietly diverted, aid that can be traced to the intended wallet: these are control systems.

They are difficult to replicate in correspondent banking without layers of intermediaries, each extracting rent and adding delay.

Organisations that already pay for results rather than for theatre should recognise the pattern. The tool is not the integrity problem. The design of the on- and off-ramps is.

The next users will not be human

The argument is about to be overtaken by volume of a different kind.

Autonomous software agents cannot open a current account at a Sandton branch, pass a face-to-face interview or wait three days for a correspondent bank.

They can hold a wallet, present a cryptographic identity, and pay a few cents for an API call, a dataset or a burst of compute. Coinbase’s x402 protocol, now governed as an open standard under a Linux Foundation-backed body with card networks, cloud providers and stablecoin issuers among its members, turns the long-dormant HTTP 402 “Payment Required” code into instant stablecoin settlement (Coinbase Developer Platform, 2025; Linux Foundation, 2026).

Production activity is no longer theoretical. Researchers report tens to hundreds of millions of agentic payments, almost all in USDC, at ticket sizes cards cannot price (Gong, 2026).

This is not a curiosity. Visa and Mastercard are building machine-payment infrastructure because card economics break below about 30 cents. Circle’s nanopayments experiment with transfers down to a millionth of a dollar.

Agent-to-agent marketplaces already escrow work, settle in stablecoins and write a reputation score on-chain. Hui Gong’s 2026 paper on agent-to-agent finance treats programmable settlement, smart wallets and verifiable identity as emerging market infrastructure, not a hobbyist overlay.

Read:

Mastercard adds stablecoin settlement support for merchants

Visa, Mastercard race to tame a $253bn crypto threat

Stablecoin has long road to mainstream payments

Don’t put your head in the sand: Stablecoin adoption is not going away

Once software becomes a counterparty, three properties stop being optional. Settlement must be 24/7 and cross-border without a human compliance officer on every micropayment. Identity must be cryptographic and portable, not a PDF of a municipal account.

The audit trail must be machine-readable, because the volume will exceed what a suspicious-activity team can read. Public blockchains, for all their governance fights, were built for that combination. Traditional rails were built for branches, batches and bankers’ hours.

The transformation will not be that “crypto replaces banks”. It will be that value starts to move at the speed and granularity of software. Payroll between agents, procurement of compute, parametric insurance payouts, inventory that pays its own freight, remittances that cannot be skimmed by a local gatekeeper: these are settlement problems.

They will force the existing financial system to become more programmable, or to watch a parallel stack grow around it. For a SADC economy that already leaks value through expensive corridors, that is a competitiveness question, not a culture-war question.

Crime will travel with that stack, as it travelled with the telegraph, the eurodollar and the prepaid card. The response that works is the one already visible in the Garantex takedown and the Odarchenko conviction: identity at the on- and off-ramps, analytics on the ledger, and coordinated enforcement against the service providers who specialise in opacity.

The response that fails is to treat a sub-1% illicit share as the defining fact of a technology that is about to become the payment layer for machines, and that is already the cheaper way for a miner in Rustenburg to support a household in Bulawayo.

The ledger does not care about our moral panic. It will record the bribe and the remittance with equal indifference. Our job is to stop confusing the two.

Key finding: Chainalysis places 2025 illicit crypto volume below 1% of attributed on-chain activity ($154 billion received by identified illicit addresses). TRM Labs estimates 1.2% ($158 billion). Traditional money laundering remains 2-5% of global GDP. Sub-Saharan Africa is still the world’s most expensive remittance region.

Dr Chris Blair is group director of 21st Century.