Crypto crime surged to unprecedented levels in 2025, fueled by a combination of nation-state activity, large-scale thefts, and increasingly professionalized criminal infrastructure, according to newly compiled data from Chainalysis shared with Bitcoin Magazine.
Illicit crypto addresses, an account involved in criminal activities like scams, ransomware, darknet markets, etc, received at least $154 billion over the year — a 162% increase from 2024 — with sanctioned entities accounting for a dramatic 694% of that growth.
Even excluding sanctioned actors, 2025 still set a record for illicit crypto activity, highlighting the broadening scope of the threat landscape, according to the report.
While these numbers represent a lower-bound estimate based on known illicit addresses, they signal an ecosystem that is maturing, diversifying, and, increasingly, intersecting with global geopolitical tensions.
The report cautioned that although illicit activity remains under 1% of total crypto volume, the implications for national security, consumer protection, and regulatory oversight are growing.
Nation-states are driving new crypto crime records
Perhaps the most striking trend of 2025 was the rise of nation-state activity on-chain.
Russia’s ruble-backed A7A5 token alone transacted over $93.3 billion within its first year, marking one of the clearest real-world examples of state-backed crypto-enabled sanctions evasion.
Iran, meanwhile, continued to leverage proxy networks for money laundering, illicit oil sales, and arms procurement, funneling more than $2 billion through wallets confirmed in sanctions designations.
North Korea also intensified its operations: DPRK-linked hackers stole $2 billion last year, including the largest crypto heist on record, the February Bybit exploit, which netted nearly $1.5 billion, per the report.
These developments underscore a massive shift: nation-states are now participating in the same professionalized crypto service ecosystem originally designed to facilitate cybercrime and organized crime.
By leveraging “full-stack” illicit infrastructure providers, states can conduct large-scale operations while minimizing exposure to enforcement.
Stablecoins are dominating illicit crypto activity
Stablecoins emerged as the preferred asset for illicit actors, accounting for 84% of all illicit transaction volume in 2025, according to the report. Stablecoin liquidity, price stability, and ease of cross-border transfer as primary drivers.
As the broader crypto ecosystem relies on stablecoins for transactions and settlements, their dominance in illicit activity highlights a potential blind spot for regulators and compliance teams.
Chinese money laundering networks expanded
The year also saw the consolidation of Chinese money laundering networks (CMLNs) as major players in the illicit ecosystem. These operations provide a wide range of services, including laundering-as-a-service and technical infrastructure, supporting everything from North Korean hack proceeds to sanctions evasion and terrorist financing.
By offering end-to-end criminal infrastructure, these networks have professionalized illicit finance in ways that mirror legitimate corporate operations, making enforcement increasingly complex.
The human cost of on-chain crime
While headlines often focus on hacks and sanctions evasion, the report emphasized that crypto crime is increasingly tied to physical-world violence. Human trafficking operations, coercion attacks, and other crimes now intersect with on-chain activity, sometimes timed to exploit cryptocurrency price volatility.
This convergence of digital and physical crime underscores the importance of coordination among law enforcement, regulatory bodies, and crypto platforms, the report claimed.
As the on-chain ecosystem continues to grow, so too does the sophistication of those seeking to exploit it. Nation-states, transnational criminal networks, and professionalized infrastructure providers are converging, creating threats that span finance, security, and public safety.
While illicit activity remains a small fraction of total crypto volume, 2025 demonstrates that even a small share can translate into tens of billions of dollars in illicit volume.
Chainalysis is a blockchain analytics company that provides software and data to governments, law enforcement, exchanges, and financial institutions to track, analyze, and investigate cryptocurrency transactions for compliance and criminal investigations.
