Monero Activity Holds Steady Despite Exchange Delistings, TRM Labs Reports

TLDR:

• TRM Labs found that 48% of newly launched darknet markets in 2025 accept only Monero as payment. 
• Nearly 14–15% of reachable Monero network peers displayed non-standard peer-to-peer protocol behavior. 
• Ransomware actors prefer XMR, yet most real-world ransom payments are still completed in Bitcoin. 
• Monero’s on-chain cryptography remains intact, but network-layer dynamics may affect privacy assumptions.

Monero continues to maintain stable on-chain transaction activity despite growing regulatory pressure. TRM Labs released new research showing that XMR usage has remained above pre-2022 levels.

Even after major exchanges removed the privacy coin, demand has not dropped. The findings also reveal unusual peer-to-peer network behavior affecting roughly 14 to 15 percent of observable nodes.

Darknet Markets and Ransomware Drive Persistent Demand

Monero’s appeal in high-risk environments has grown considerably over the past few years. Nearly 48 percent of newly launched darknet markets in 2025 support XMR exclusively.

That figure marks a sharp rise compared to earlier years when Bitcoin remained the dominant option. Western-facing markets are leading this shift, partly due to improved tracing capabilities on transparent blockchains.

Ransomware groups still express a clear preference for receiving payments in Monero. However, most actual ransom settlements continue to occur in Bitcoin due to liquidity advantages.

Bitcoin remains easier to acquire and convert at scale, even though it is more traceable. That gap between preference and practice reflects a real tension between privacy and usability.

TRM Labs addressed this directly, stating, “Most ransomware payments still occur in BTC—liquidity matters.” The firm also noted that “48% of new darknet markets in 2025 are XMR-only,” indicating a measurable structural shift in how high-risk actors choose to operate.

Monero’s thinner market structure also contributes to higher price volatility. Over the past 30 days, XMR showed realized volatility roughly 2.5 times that of Bitcoin.

Despite fewer on-ramps and reduced exchange support, on-chain Monero usage has not contracted meaningfully. This pattern points to a user base that actively seeks privacy rather than casual retail participation.

Users accept higher friction and fewer options to preserve anonymity. That behavior keeps Monero relevant even as other assets become more transparent.

Network-Layer Behavior Introduces New Investigative Considerations

TRM Labs also collaborated with academic researchers to study Monero’s peer-to-peer network behavior. Around 14 to 15 percent of reachable peers showed non-standard behavior compared to protocol expectations.

These deviations included irregular handshake patterns, unusual message timing, and atypical peer list composition. The behavior persisted across multiple observation periods, suggesting systematic rather than random causes.

Infrastructure concentration emerged as a recurring pattern within the non-standard peer data. A small number of hosting environments accounted for a disproportionately large share of these peers.

TRM Labs noted that “14–15% of Monero peers show non-standard network behavior,” adding that “network-layer dynamics can influence real-world privacy assumptions.” That visibility can matter even when cryptographic protections remain fully intact.

TRM emphasized that these findings do not reflect a failure of Monero’s cryptography. The on-chain privacy features, including ring signatures and stealth addresses, remain technically sound.

As TRM Labs put it, “Monero’s cryptography remains strong,” yet the firm cautioned that peer-to-peer behavior can introduce structural visibility affecting theoretical anonymity models. Real-world conditions can introduce observable structure that affects certain investigative threat models.

The research does not assign intent or identify specific operators behind the non-standard nodes. It instead describes behavioral patterns that deviate from standard client implementations.

Those patterns, combined with growing XMR-only market adoption, give investigators new structural data points to consider. Monero remains a distinct challenge, but its network layer now draws greater scrutiny.

The post Monero Activity Holds Steady Despite Exchange Delistings, TRM Labs Reports appeared first on Blockonomi.