Key Facts
- ✓ Illicit crypto addresses received at least $154 billion in 2025, a 162% increase from 2024.
- ✓ Stablecoins accounted for 84% of all illicit transaction volume.
- ✓ North Korean hackers stole $2 billion, including the $1.5 billion Bybit exploit.
- ✓ Russia's A7A5 token transacted over $93.3 billion within its first year.
- ✓ Iran funneled more than $2 billion through wallets confirmed in sanctions designations.
Quick Summary
Illicit cryptocurrency activity surged to unprecedented levels in 2025, with illicit addresses receiving at least $154 billion over the year. This represents a 162% increase from 2024, driven largely by sanctioned entities.
Nation-state activity was a primary driver of this growth. Russia introduced the A7A5 token, which transacted over $93.3 billion to evade sanctions. North Korean hackers stole $2 billion, including the $1.5 billion Bybit exploit, while Iran funneled more than $2 billion through proxy networks.
Stablecoins dominated illicit transaction volume, accounting for 84% of all activity due to their liquidity and stability. Additionally, Chinese money laundering networks expanded their services, offering laundering-as-a-service to support these criminal operations. The report highlights that while illicit activity remains under 1% of total crypto volume, the implications for national security and consumer protection are growing.
Nation-States Drive New Records
The most striking trend of 2025 was the rise of nation-state activity on-chain. Governments are increasingly utilizing blockchain technology to bypass restrictions and fund operations.
Russia introduced the ruble-backed A7A5 token. Within its first year, this token transacted over $93.3 billion. This serves as a clear example of state-backed crypto-enabled sanctions evasion.
Iran continued to leverage proxy networks for money laundering, illicit oil sales, and arms procurement. Data shows that Iran funneled more than $2 billion through wallets confirmed in sanctions designations.
North Korea also intensified its operations. DPRK-linked hackers stole $2 billion last year. This total includes the largest crypto heist on record: the February Bybit exploit, which netted nearly $1.5 billion.
These developments underscore a massive shift. Nation-states are now participating in the same professionalized crypto service ecosystem originally designed to facilitate cybercrime.
Stablecoins and Professional Networks 📈
Stablecoins emerged as the preferred asset for illicit actors. They accounted for 84% of all illicit transaction volume in 2025.
The dominance of stablecoins is driven by three main factors:
- Liquidity availability
- Price stability
- Ease of cross-border transfer
As the broader crypto ecosystem relies on stablecoins for transactions, their dominance in illicit activity highlights a potential blind spot for regulators.
The year also saw the consolidation of Chinese money laundering networks (CMLNs). These operations provide a wide range of services, including laundering-as-a-service and technical infrastructure. They support everything from North Korean hack proceeds to sanctions evasion and terrorist financing. By offering end-to-end criminal infrastructure, these networks have professionalized illicit finance in ways that mirror legitimate corporate operations.
The Human Cost of On-Chain Crime
While headlines often focus on hacks and sanctions evasion, the data emphasizes that crypto crime is increasingly tied to physical-world violence.
Human trafficking operations, coercion attacks, and other crimes now intersect with on-chain activity. These crimes are sometimes timed to exploit cryptocurrency price volatility.
This convergence of digital and physical crime underscores the importance of coordination among law enforcement, regulatory bodies, and crypto platforms. As the on-chain ecosystem continues to grow, so too does the sophistication of those seeking to exploit it.
Even though illicit activity remains a small fraction of total crypto volume, 2025 demonstrates that even a small share can translate into tens of billions of dollars in illicit volume.
Conclusion
The data from 2025 paints a complex picture of the cryptocurrency landscape. While the technology offers innovation, it also presents new challenges for national security and consumer protection.
The intersection of nation-states, transnational criminal networks, and professionalized infrastructure providers creates threats that span finance and public safety. The rapid growth of illicit volume, driven by sanctioned entities and state-sponsored actors, suggests that regulatory oversight will remain a critical focus in the coming years.
