Crypto criminals have moved on from bitcoin to other cryptocurrencies, was the main takeaway from a report released Wednesday by blockchain analytics company TRM Labs.

While crypto prices have been depressed over the past couple of years, the earnings of scammers and hackers have not, the Elicit Crypto Ecosystem Report showed. Crypto Ponzi schemes extracted at least $7.8 billion from victims in 2022. Overall, over $9 billion in crypto has been sent to addresses associated with various frauds and scams in 2022, including Ponzi schemes. Such frauds most often use USDT based on the Tron blockchain.

Various DeFi exploits brought attackers $3.7 billion, including $2 billion stolen from cross-chain bridges. And around $1.5 billion went to darknet marketplaces selling illegal drugs, TRM said.

To cover their tracks, crypto criminals increasingly rely on so-called chain hopping, moving money from one blockchain to another so that it’s harder to track the funds from the outside. As a result, bitcoin’s share in such crimes decreased from 97% in 2016 to 19% in 2022, TRM wrote.

“In 2016, two-thirds of crypto hack volume was on Bitcoin; in 2022, it accounted for just under 3%, with Ethereum (68%) and Binance Smart Chain (19%) dominating the field,” the report. TRM also found that bitcoin is no longer the preferred coin for terrorism financing: now USDT on the Tron blockchain is dominating that market. The cryptocurrency is especially popular with ISIS and its affiliates in Pakistan and Tajikistan, TRM said.

To be sure, both bitcoin and tether (USDT) are among the most popular and liquid cryptocurrencies, making them a preferable payment method for many use cases outside of crime, too.

Read also: This Is How Scammers Can Drain Your Crypto Wallet

In some corners of the criminal underworld, bitcoin is still king, for example, Russian darknet marketplaces, which are dominating the sector (80% of the market), mostly accept bitcoin only as payment for narcotics and other illegal goods. Large Western marketplaces of this kind often accept monero as well, but their share in the overall darknet economy is much smaller, TRM wrote.

Websites offering pornographic photos and videos of children (known as child sexual abuse materials, or CSAM) received no less than $3.32 million in 2022, however, more than two thirds of those funds went not to actual CSAM vendors but to scammers who sold access to non-existing content, TRM said.