Monero demand holds after delistings as darknet markets move to XMR

Monero’s on-chain activity has stayed relatively steady even after major exchanges pushed the privacy coin off their platforms, according to new research from TRM Labs. The firm says Monero usage in 2024 and 2025 remained above pre-2022 levels, despite tighter compliance pressure and fewer mainstream trading venues.

TRM links part of the demand story to a basic tradeoff. Criminal groups may prefer Monero’s privacy features, but paying and cashing out still requires liquidity. That helps explain why Bitcoin remains the dominant asset for completed ransomware payments, even when attackers request XMR or offer discounts for it. 

Darknet markets appear to be moving the other way. TRM found that 48% of newly launched darknet markets in 2025 supported only Monero, an increase versus earlier years. In the report’s framing, improved tracing across Bitcoin and stablecoins pushes some high-risk activity toward assets that are harder to follow on-chain. The research also zooms out from the blockchain itself and looks at how transactions propagate across Monero’s peer-to-peer network. TRM cites findings that roughly 14% to 15% of reachable Monero peers show “non-standard” behavior, including unusual relay timing and infrastructure concentration. That does not mean Monero’s cryptography has failed, but it suggests investigators may pursue network-level signals when on-chain analysis hits a wall. 

Monero developers have already treated the network layer as an attack surface. In October 2025, the project shipped the Fluorine Fermi (v0.18.4.3) update, which improved peer selection so wallets are less likely to connect to suspicious nodes. The Monero community uses the term “spy nodes” for nodes or clusters of nodes that try to correlate transaction broadcast patterns with users’ IP addresses.

For background on Monero’s privacy stack and why the ecosystem keeps attracting users even as regulated on-ramps shrink, see this overview of the privacy coin. 

Some wallets still keep native XMR support even as centralized exchanges reduce exposure to privacy coins. That matters for users who want to move, store, or swap XMR outside of the regulated exchange perimeter. As long as non-custodial wallet developers maintain native support for the protocol, the barrier between Monero and its users remains an issue of liquidity rather than technical access. This persistent wallet infrastructure, combined with ongoing network-layer hardening, ensures that Monero continues to function as a parallel financial system, even as its visibility on mainstream platforms fades.