Blockchain analytics firm TRM Labs has released a report indicating that during 2025, the cryptocurrency landscape witnessed an unprecedented spike in illicit activities, totaling $158 billion in volume—a 145% surge from the $64.5 billion recorded the previous year. According to insights from TRM Labs, this marked a reversal of a downward trend that had persisted since 2021’s peak of $85.9 billion.
However, TRM Labs pointed out that when viewed as a share of the overall crypto transaction volume, illicit dealings dipped slightly to 1.2%, down from 1.3% in 2024 and 2.4% in 2023, signaling a maturing ecosystem where legitimate growth outpaced criminal exploitation.
TRM Labs’ 2026 Crypto Crime Report introduces a fresh metric: illicit entities siphoned off 2.7% of available crypto liquidity, emphasizing risks tied to deployable capital rather than sheer transaction totals.
Sanctions evasion dominated the illicit scene, with $93 billion in related flows, primarily linked to Russia. Networks like the A7A5 token and A7 wallet cluster handled $72 billion and $39 billion respectively, facilitating shadow economies amid geopolitical tensions.
Stablecoins accounted for 95% of inflows to sanctioned entities, underscoring their role in bypassing restrictions.
Venezuela and Iran also leaned heavily on crypto, with Iran’s activity climbing 35% to $10 billion despite ongoing conflicts.
Chinese-language escrow services processed over $103 billion, blending legitimate and illicit operations.
Cyberattacks and exploits inflicted $2.87 billion in losses across 150 incidents, a shift toward infrastructure breaches that claimed 76% of the total.
The Bybit hack alone stole $1.46 billion, representing over half the year’s haul.
North Korea-affiliated hackers netted $1.92 billion, laundering funds through Chinese networks.
Fraud schemes raked in about $35 billion, with investment scams (62% of cases) and Ponzi pyramids surging 49% to $6.1 billion. AI tools amplified these operations, boosting efficiency by 500%, while stablecoins captured 84% of inflows.
Ransomware remained resilient, with 93 new variants emerging—a 94% jump—totaling 161 active strains. Inflows stayed high, though more victims resisted payments; laundering shifted to cross-chain bridges (up 66%) from mixers (down 37%).
Groups like Akira pulled in $150 million.
Darknet markets, mostly Russian-language platforms, generated $1.7 billion, a 20% increase, while individual vendor sales dropped 60% to $1 billion. Precursor chemical inflows for drugs rose to $39.1 million.
Money laundering outflows from illicit wallets topped $60 billion, with escrow services like Huione Pay handling $73 billion before crackdowns.
Terrorism financing evolved, with ISIS affiliates in Syria using USDT on Tron for donations and operations, totaling hundreds of thousands of dollars.
Iranian proxies like Hamas, Hezbollah, and Houthis persisted in crypto use despite seizures exceeding $350 million in wallet volumes.
The report highlights crypto’s deepening integration into both licit and illicit financial systems, with professionalized networks adopting AI and faster laundering tactics.
Enforcement actions disrupted ecosystems, prompting rebrands, but state-aligned actors continue building parallel infrastructures. Looking ahead, 2026 may see sustained growth in these threats, urging enhanced cross-sector coordination and advanced attribution tools to mitigate risks in an expanding digital economy.