Illicit crypto hit $154B in 2025, led by stablecoins – Chainalysis

Criminal networks moved funds through cryptocurrencies into Russia and other jurisdictions in 2025, relying on stablecoins and state-linked infrastructure, according to Chainalysis. The firm counted $154 billion sent to illicit addresses last year, a 162% increase from its revised 2024 total. Despite the increase, the illicit share of overall crypto transaction volume remained below 1% under its methodology.

Chainalysis classifies addresses as illicit when they belong to sanctioned entities, hacks, scams, ransomware and similar categories. Revenues from non-crypto-native crimes, such as traditional drug trafficking when crypto serves only as a payment method, are generally excluded because those transfers are indistinguishable from legitimate onchain payments.

A small group of state-linked actors accounted for a large share of activity. North Korean-affiliated hackers stole about $2 billion in 2025, with a February exploit at Bybit identified as the largest digital theft in crypto to date, a security-related incident mentioned in our Bybit vs Bitmex comparison review.

Russia featured through the ruble-backed A7A5 stablecoin, which recorded more than $93.3 billion in transactions within its first year after launching in February 2025. The U.S. Treasury’s Office of Foreign Assets Control sanctioned the A7A5 network on Aug. 14, 2025, citing use for sanctions evasion and cross-border settlements. The European Union followed on Oct. 23, 2025, describing the token as a “prominent tool for financing activities supporting the war of aggression.”

Chinese money laundering networks operated laundering-as-a-service and onchain infrastructure that supported fraud, hack proceeds and sanctions evasion.

Iran‑aligned proxy networks facilitated more than $2 billion in onchain activity tied to money laundering, illicit oil sales and arms procurement, including activity linked to Hezbollah, Hamas and the Houthis.

Stablecoins accounted for 84% of illicit transaction volume in 2025, mirroring broader market use. Chainalysis attributes the preference to ease of cross-border transfers and lower price swings compared with other tokens.

Illicit operations increasingly rely on full-stack service providers that offer hosting, domain registration, exchange access and laundering tools designed to withstand takedowns and enforcement. The same vendors support ransomware crews, large scam networks and state-aligned groups.

The report also notes a rising overlap between onchain crime and physical violence, citing cases of human trafficking and coercive attacks that force victims to transfer crypto assets, often during periods of heavy market activity.

The authors expect revisions as new illicit addresses are identified and their histories added: “A year from now, these totals will be higher… our updated estimate for 2024 is substantially higher at $57.2 billion, with much of that growth coming from illicit actor organizations providing onchain infrastructure and laundering services for high-risk and illicit actors.”

As we covered previously, the National Crime Agency (NCA) dismantled a billion-pound laundering network operating in 28 UK towns and cities that used cryptocurrency to convert proceeds from drug trafficking, firearms sales and other organized crime, routing part of the funds to Russian interests to evade sanctions and support Russia’s war effort.