Crypto adoption is broadening, but governance still lags

At a glance

What this is: Chainalysis’ 2025 Global Crypto Adoption Index shows crypto use broadening across regions, with APAC leading growth and methodology shifting to better capture institutional activity.

Why it matters: For IAM, fraud, and financial crime teams, the report matters because adoption at scale changes verification, access, and monitoring expectations around exchange accounts, wallet controls, and transaction risk.

By the numbers:

• In the 12 months ending June 2025, APAC emerged as the fastest-growing region for on-chain crypto activity, with a 69% year-over-year increase in value received.
• The 2025 Global Crypto Adoption Index ranks India first and the United States second, with Pakistan, Vietnam, and Brazil completing the top five.
• Chainalysis estimates that its index covers more than 13 billion web visits across hundreds of millions of cryptocurrency transactions.

👉 Read Chainalysis’ 2025 Geography of Crypto report on global adoption patterns

Context

Crypto adoption is no longer a narrow consumer trend. The report shows a market that now spans retail users, institutional flows, and cross-border utility, which means the control problem is shifting from simple account onboarding to ongoing verification, transaction monitoring, and risk-based access governance.

That shift has a direct identity angle. Exchange access, wallet usage, stablecoin movement, and institutional participation all depend on identity verification, account lifecycle controls, and fraud detection signals that IAM, PAM, and trust and safety teams have to align around.

Key questions

Q: How should security teams govern identity assurance for crypto platforms and wallets?

A: Security teams should separate retail identity assurance from institutional and operational access. Customer onboarding, wallet recovery, API entitlements, and transfer approvals all carry different risk profiles. The most effective programmes tie stronger verification and step-up controls to the ability to move value, change permissions, or operate on behalf of others, rather than using one blanket rule for all users.

Q: Why do crypto adoption trends matter for IAM and fraud programmes?

A: Crypto adoption changes which identities are trusted, what they can do, and how quickly value can move. As usage grows across exchanges, stablecoins, and custodial services, IAM and fraud teams need to coordinate around account assurance, recovery abuse, and high-risk access paths. Without that alignment, legitimate growth and suspicious activity can look too similar to govern well.

Q: What do security teams get wrong about analysing crypto adoption data?

A: Teams often mistake activity volume for trustworthy maturity. A country can show strong adoption because of remittances, inflation pressure, institutional flows, or concentrated exchange use, and those patterns imply different governance needs. The right question is not whether adoption is high, but which identity and access controls support the dominant use case.

Q: Who is accountable when crypto custody fails?

A: Accountability should sit with the team that owns the key lifecycle, transaction policy, and monitoring model, not only with the people who move funds. In practice, that means compliance, security, and operations must share clearly documented responsibility for authority, review, and escalation.

Technical breakdown

How the Global Crypto Adoption Index weights activity

Chainalysis builds the index from four sub-indices that combine on-chain activity, web-traffic-based estimates, population, and purchasing power. The geometric mean reduces the chance that one very large category dominates the outcome, while normalization to a 0 to 1 scale makes country comparisons easier. The methodology also uses four service types, which means the index is not a simple volume ranking. It is an attempt to approximate grassroots adoption rather than raw exchange throughput.

Practical implication: treat country rankings as a composite signal, not a direct proxy for user count or regulatory maturity.

Why removing retail DeFi changes the picture

By removing retail DeFi as a standalone sub-index, Chainalysis is acknowledging that high-volume protocol activity can distort adoption signals when user frequency is comparatively low. This is a measurement choice, not a claim that DeFi is unimportant. It means the index now puts more weight on centralized services and user behaviours that are easier to observe, compare, and tie to real-world participation patterns.

Practical implication: governance teams should avoid using a single on-chain metric to make decisions about risk, controls, or market readiness.

Why institutional activity now matters in crypto governance

Adding an institutional sub-index reflects a structural change in the market. Transfers over $1 million are being used as a marker for professional investors, custodians, and other large entities, which changes how adoption should be interpreted. For security and compliance teams, that means the identity of the actor matters as much as the asset flow. Institutional use creates higher expectations for account assurance, privileged access control, and transaction oversight, especially where regulated entities are involved.

Practical implication: align onboarding, entitlements, and monitoring controls to the difference between retail, institutional, and service-provider behaviour.

Threat narrative

Attacker objective: The attacker aims to convert trusted account access into irreversible value transfer, fraud, or operational control over crypto activity.

1. Entry begins when identity trust is extended to exchange accounts, wallet workflows, or third-party platforms that participate in crypto movement.
2. Escalation follows when attackers exploit weak verification, account takeover, or over-trusted access paths to move value or alter transaction behaviour.
3. Impact occurs when stolen access or manipulated trust flows enable fraud, illicit transfers, or loss of control over digital assets.

NHI Mgmt Group analysis

Crypto adoption is now an identity-governance problem as much as a market-analysis problem. The report tracks where activity is growing, but the operational question for practitioners is who is being trusted, how they are verified, and how access is controlled once that trust is granted. As crypto use spreads across retail, institutional, and service-provider contexts, the boundary between identity assurance and transaction risk becomes thinner. Practitioners should align fraud controls, IAM, and monitoring around that boundary.

Institutional crypto activity introduces a sharper privileged-access question than retail adoption alone. Once flows over $1 million are being used as part of the market picture, governance must account for custodians, trading desks, payment intermediaries, and API-connected service accounts. That creates a broader blast radius if account assurance, approvals, or access recertification are weak. The control model should distinguish between ordinary customer access and operational access that can move large value fast. Practitioners should review high-value entitlements separately from consumer journeys.

Population-adjusted rankings expose a verification trust gap in emerging-market adoption. Where adoption is driven by remittances, inflation pressure, or banking friction, verification pathways and fraud exposure often look different from developed-market exchange activity. That does not make the signal less real; it means the governance burden shifts toward identity proofing, local fraud patterns, and account recovery controls. For practitioners, the lesson is to calibrate assurance to local usage patterns rather than exporting one global rulebook.

Stablecoin growth makes transaction governance more operationally important than asset branding. The report shows that USDT and USDC still dominate volumes even as regulated alternatives gain ground. For identity teams, the relevant issue is not which token wins, but how access, approvals, and monitoring behave when payments, treasury, and settlement functions rely on digital assets. The more stablecoins become infrastructure, the more controls need to treat wallet and platform access as privileged business capability. Practitioners should govern the path, not just the asset.

What this signals

Secret-lifecycle discipline still underpins digital asset governance. When access paths can move value quickly, slow detection and slow revocation become business risks, not just hygiene issues. In our research, the average estimated time to remediate a leaked secret is 27 days, which is far too long for any environment where keys, tokens, or wallet-adjacent credentials can be abused immediately.

Teams should expect more overlap between payment controls, fraud analytics, and identity security as crypto platforms and stablecoin rails mature. That means access reviews, recovery workflows, and privileged entitlements need to be designed with transaction impact in mind, not only user convenience.

Verification trust gap: when activity is driven by remittances, institutional flows, or regional workarounds, the real control challenge is proving who is acting and whether their access should persist. That is where identity proofing, recertification, and anomaly detection have to connect.

For practitioners

• Segment identity assurance by participant type Separate retail, institutional, custodial, and service-provider access paths in onboarding, authentication, and approvals so controls match the risk of the transaction flow. Apply stronger verification to accounts that can move large value or call APIs on behalf of others.
• Review privileged access around digital asset movement Inventory the accounts, keys, and tokens that can authorise transfers, alter wallet settings, or change exchange permissions. Revalidate these paths on a shorter lifecycle than ordinary customer access, and tie them to explicit ownership and recertification.
• Tune fraud detection to local adoption patterns Use regional signals, payment behaviour, and account recovery telemetry to distinguish legitimate cross-border use from account takeover and laundering patterns. A single global threshold will miss the difference between remittance-heavy adoption and high-value institutional activity.
• Govern stablecoin access as infrastructure access Treat wallet administration, exchange APIs, and treasury workflows as privileged access paths, not ordinary payment tools. Put approvals, logging, and anomaly detection in place before stablecoin usage becomes embedded in business processes.

Key takeaways

• Crypto adoption is widening across regions and use cases, but the governance challenge is still about who gets trusted and what they can do.
• Chainalysis’ methodology now gives more weight to institutional flows and less to retail DeFi, which makes the index more useful for operational interpretation.
• Security and IAM teams should treat exchange access, wallet workflows, and stablecoin infrastructure as privileged environments that need tighter verification and monitoring.

Key terms

• Crypto adoption index: A crypto adoption index measures how widely cryptocurrency is used across countries or regions, usually by combining transaction activity, service usage, and demographic weighting. In this report, the index is designed to reflect grassroots participation rather than just raw trading volume, which makes methodology choices central to interpretation.
• Institutional activity sub-index: An institutional activity sub-index estimates large-scale cryptocurrency usage by professional investors, custodians, and other entities moving high-value transactions. It is useful because institutional flows behave differently from retail behaviour, and they create different governance, access, and monitoring requirements for security and compliance teams.
• Stablecoin: A stablecoin is a cryptocurrency designed to hold a relatively stable value by linking itself to another asset, usually a fiat currency. In practice, stablecoins function as payment and settlement infrastructure, which means access to wallets, issuers, and exchange rails becomes a governance issue as much as an asset-selection issue.
• Identity proofing: Identity proofing is the process of checking that a person or organisation is who they claim to be before access is granted. In crypto environments, it underpins account creation, recovery, and high-risk transaction approval, and it has to be matched to the value and privilege of the activity being enabled.

What's in the full report

Chainalysis’ full report covers the methodological detail this post intentionally leaves for the source:

• The sub-index calculations behind the 151-country ranking, including weighting by population and purchasing power.
• The methodology change rationale for removing retail DeFi and adding institutional activity over $1 million.
• The country-by-country top 20 tables for the overall index and the population-adjusted view.
• The stablecoin and regional growth breakdowns that support deeper market and adoption analysis.

👉 The full Chainalysis report includes the methodology, regional trends, and country tables behind the index.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and access lifecycle controls. It is built for practitioners who need to connect identity governance to operational risk across modern security programmes.