TRM Labs finds Monero on-chain activity stable, ransomware preference persists

Blockchain analytics firm TRM Labs reported that Monero's (XMR) on-chain transaction activity remained broadly stable throughout 2024 and 2025. Despite delistings and restrictions from major exchanges like Binance and Coinbase, activity levels have stayed higher than they were before 2022. The report noted that while ransomware groups still prefer Monero for payments, the majority of actual ransoms are paid in Bitcoin (BTC). Additionally, TRM Labs found that approximately half of new darknet markets in 2025 support Monero-only payments, indicating growing adoption of XMR in high-risk environments.