Why TRC-20 stablecoins dominate illicit flows in East Africa
Global blockchain crime reporting is written from a largely Western dataset, and it consistently under-weights the rail that matters most in this region. If your monitoring was designed around Bitcoin and Ethereum, you have a blind spot.
Read most international financial crime research and you will come away with a picture centred on Bitcoin, with Ethereum and its token ecosystem close behind. That picture is not wrong. It is just drawn from a dataset that does not look much like East Africa.
The rail that carries the most illicit value we encounter in regional casework is Tether issued on Tron, as a TRC-20 token. The concentration is significant enough that any monitoring programme built without it is going to miss a great deal.
Why this rail and not another
The reasons are practical rather than ideological, which is generally true of criminal method.
Fees. Moving value on Tron costs a fraction of a cent and settles in seconds. For a fraud operation aggregating many small payments from many victims, Ethereum gas costs are not an inconvenience, they are a business model problem. Tron removes it.
Price stability. A person laundering proceeds does not want market exposure between receipt and cash out. Bitcoin can move ten per cent in a day. A dollar stablecoin does not. Value that must sit for a week while an off-ramp is arranged sits far more comfortably in USDT.
Liquidity where it is needed. The regional peer to peer market has deep USDT liquidity and thin liquidity in almost everything else. A trader who wants Kenyan shillings for crypto today, in size, at a predictable rate, is trading USDT. Criminal proceeds follow the same liquidity as legitimate trade, because they have to.
Familiarity. Ordinary cross border commerce in this region increasingly settles in USDT on Tron. That is a genuinely useful development for traders facing correspondent banking friction. It also means illicit flows travel through channels that look entirely normal, because most of the traffic on those channels is entirely normal.
What this changes for tracing
Tron is not Bitcoin, and the analytical habits do not transfer cleanly.
There is no UTXO model and therefore no change output, so the entire family of change-identification heuristics simply does not apply. Tron uses an account model, which makes individual transfers easier to read but makes clustering harder, because you lose the co-spend evidence that lets you group Bitcoin addresses into a wallet.
Against that, the account model gives you a clean and complete history for any address, and the fee structure means actors are far less economical with transactions. People who are not paying meaningfully for transfers make a lot of transfers, and volume of behaviour is itself analytical material.
The freeze capability of the token issuer is the single most operationally important fact about this rail, and it is time-bound in a way investigators consistently underestimate.
USDT is a centrally issued token, and the issuer can and does freeze balances at specific addresses on request from law enforcement. This is a genuine avenue that does not exist for Bitcoin. It is also perishable. Once value has passed through an off-ramp into cash or mobile money, freezing is no longer relevant. The window in which the request matters is often hours, not days.
The mobile money edge
Nearly every regional case we see terminates at the same boundary: a peer to peer trade that converts USDT into a mobile money balance.
That boundary is where blockchain analysis stops and conventional financial investigation begins, and it is the point at which the two disciplines most often fail to meet. The chain gives you an address, a timestamp and an amount. The mobile money record gives you a registered identity. Connecting them requires the trade record held by the peer to peer platform or the individual trader, and that is a request that has to be made correctly and quickly.
Investigators who are strong on-chain frequently lose cases at exactly this handover, not because the analysis was wrong but because the request to the intermediary was late or badly framed.
Practical implications
For compliance teams: if your screening covers Bitcoin and Ethereum but treats Tron as a secondary integration, your coverage does not match your actual risk. Fix that before a supervisor asks you to explain it.
For investigators: build the muscle for fast issuer freeze requests before you need it. Know the format, know the contact route, and know what evidence must accompany the request. The case where it matters will not give you a week to work it out.
For everyone: be careful not to read this as "Tron is a criminal chain". It is not. Low fees and stable value are genuinely useful properties, and the overwhelming majority of activity on this rail is legitimate cross border commerce by people underserved by conventional banking. That is precisely why illicit flows hide there successfully.
Written by the NuruTrace team
We publish what we learn from casework and from reading the regime closely. If something here is relevant to a matter you are handling, we are happy to talk it through.