Illicit cryptocurrency activities surged to unprecedented levels in 2025, with criminal addresses receiving at least $154 billion—a staggering 162% increase from the previous year. This record-breaking figure, driven largely by a 694% spike in funds flowing to sanctioned entities, underscores the growing intersection of digital assets with global geopolitical tensions.
According to Chainalysis‘s 2026 Crypto Crime Report, even excluding sanctions-related inflows, 2025 marked a new high for crypto crime across various illicit categories.
While the illicit share of total crypto transaction volume remained under 1%, the absolute growth signals evolving threats that demand urgent attention from regulators, law enforcement, and industry players.
At the core of this escalation is the on-chain migration of nation-state sanctions evasion. Countries like Russia and Iran have increasingly turned to cryptocurrencies to bypass international restrictions.
Russia, for instance, introduced a ruble-backed stablecoin called A7A5 in February 2025, which facilitated over $93.3 billion in transactions within months.
This tool enabled Moscow to conduct cross-border payments and procure goods amid Western sanctions.
Similarly, Iran‘s proxy networks, including groups like Lebanese Hezbollah, Hamas, and the Houthis, laundered more than $2 billion through crypto for activities such as illicit oil sales, arms procurement, and terrorist financing.
These operations highlight how state actors are leveraging professionalized illicit infrastructure, blending traditional crime with geopolitical strategies.
Beyond sanctions, other crypto crimes flourished. Ransomware and hacking incidents proliferated, with North Korea-linked hackers stealing $2 billion in assets, including the historic $1.5 billion Bybit exploit in February 2025—the largest digital heist ever recorded.
These actors demonstrated heightened sophistication in both intrusions and subsequent laundering techniques. Scams, various abuse material platforms, and darknet markets also persisted, supported by resilient enablers.
Notably, Chinese money laundering networks (CMLNs) emerged as dominant players, providing “laundering-as-a-service” for fraud, North Korean hacks, and even terrorist financing, building on models like Huione Guarantee.
A disturbing trend is the intersection of crypto with violent crime.
Human trafficking rings and physical coercion attacks—where victims are forced to transfer assets under duress—spiked, often timed with crypto market highs to maximize gains.
Stablecoins dominated illicit flows, comprising 84% of the volume, due to their stability, cross-border utility, and lower volatility compared to volatile assets like Bitcoin.
This shift reflects broader ecosystem trends, where decentralized finance (DeFi) and blockchain tools offer both innovation and anonymity for wrongdoers.
Looking ahead to 2026, the report implies continued expansion in these threats, with nation-states deepening their crypto involvement and illicit ecosystems becoming more professionalized.
To counter this, Chainalysis urges enhanced cooperation among stakeholders.
Law enforcement must leverage blockchain intelligence for better tracking, while regulators should focus on compliance in stablecoin and DeFi sectors.
Crypto businesses, too, play a pivotal role in effectively implementing know-your-customer (KYC) measures and sharing intelligence.
This surge in crypto crime not only erodes trust in digital assets but also poses risks to global security.
As adoption grows, so does the imperative for proactive measures to ensure cryptocurrencies serve legitimate purposes without becoming tools for evasion and exploitation.
Chainalysis concluded that the 2025 data serves as a wake-up call: the on-chain world is no longer a fringe arena but a critical battleground in the fight against illicit finance.