A new report from ChangeNOW and CoinRabbit, released August 4, 2026, argues that regulators are looking in the wrong place. Titled 'Financial Privacy in the Digital Age,' the paper draws on data from TRM Labs, Chainalysis, RAND Corporation, UNODC, Statista, and U.S. Treasury disclosures. Its central claim: enforcement resources should target fiat off-ramps — the points where crypto converts to cash — rather than the privacy infrastructure that protects transactions.
The data on illicit finance
The report lays out a grim ledger. Pig-butchering fraud generated an estimated $75 billion in cumulative losses between 2020 and 2024. Physical 'wrench attacks' — where victims are forced to transfer crypto under threat — hit $124.1 million in 52 verified incidents in the first half of 2026 alone. That's a 33% increase in incidents and nearly 11 times the financial exposure compared to H1 2025.
Crypto payments linked to human trafficking networks in Southeast Asia grew 85% in 2025. Meanwhile, 36% of corporate board members now cite internal financial data becoming publicly accessible as a top governance concern. The average data breach cost sits at $4.44 million.
Two privacy models
The report profiles two distinct approaches to privacy. ChangeNOW's Private Crypto Transfers break the sender-receiver link without pooling funds — a design meant to preserve anonymity without creating a honeypot. CoinRabbit's custodial model uses dynamic per-user deposit addresses, giving each customer a unique on-chain identity that's harder to trace back to the individual.
Both architectures, the report argues, are legitimate tools. The problem isn't the tech — it's the lack of oversight where crypto meets the traditional banking system.
Regulatory recommendations
The paper offers five recommendations for regulators. The headline: shift enforcement resources toward fiat off-ramps and cross-jurisdictional intelligence sharing. The logic is straightforward — chasing privacy protocols is a game of whack-a-mole, while off-ramps are finite choke points where illicit actors have to show up in person or use a regulated intermediary.
The report doesn't name specific exchanges or jurisdictions, but the implication is clear. If you want to stop the $75 billion in pig-butchering losses, you don't ban mixers. You watch the bank accounts.
Whether regulators will listen is an open question. The U.S. Treasury has been tightening rules around unhosted wallets and decentralized finance, not just off-ramps. The report's release this week adds a data-driven counterargument to that approach — one that the industry will be watching closely.
