Illicit cryptocurrency activity surged to a record US$154 billion in 2025, driven by a sharp rise in nation-state involvement, large-scale sanctions evasion, and increasingly professional criminal networks, according to new data released by blockchain analytics firm Chainalysis.
The total value of funds received by illicit cryptocurrency addresses rose by 162 percent year on year, marking the highest level of crypto-related crime ever recorded. Chainalysis said that even without growth in activity linked to sanctioned entities, overall illicit volumes in 2025 would still have surpassed previous records, as increases were observed across nearly all major categories of crypto crime.
The findings highlight how crypto crime has evolved over the past 15 years, shifting from small-scale cyber fraud to a highly organised ecosystem and, more recently, to a financial tool used by nation-states at scale. While illicit transactions still account for less than 1 percent of total attributed cryptocurrency activity, the absolute value involved has reached levels that raise serious consumer protection and national security concerns.
Nation-state actors were the largest contributors to the surge in 2025. Activity linked to sanctioned entities rose by 694 percent compared with 2024, reflecting the growing reliance of governments and state-aligned groups on cryptocurrency infrastructure originally developed by organised crime networks. These actors either used established illicit service providers or developed their own systems to bypass traditional financial controls.
Russia emerged as a major driver of illicit crypto volumes following the launch of its ruble-backed A7A5 token in February 2025. In less than a year, the token facilitated more than US$93.3 billion in transactions, making it one of the largest known tools for on-chain sanctions evasion. Chainalysis said the token illustrates how state-backed digital assets can be rapidly scaled to move funds outside the reach of international financial restrictions.
Iran-linked networks also continued to rely heavily on cryptocurrency for money laundering, illicit oil sales, and procurement activities. Wallets associated with Iranian sanctions designations moved more than $2 billion during the year. Iran-aligned groups, including Hezbollah, Hamas, and the Houthis, were found to be using cryptocurrency at levels not previously observed, underscoring the growing role of digital assets in geopolitical conflict financing.
Stolen funds remained a major threat in 2025, particularly from state-sponsored hacking groups. Hackers linked to North Korea stole approximately US$2 billion over the year, largely driven by a series of large-scale breaches. The most significant incident was the February exploit of the Bybit exchange, which resulted in losses of nearly $1.5 billion, making it the largest digital theft in the history of the cryptocurrency sector.
The report also points to a clear shift in the types of assets used for illicit activity. Stablecoins accounted for 84% of all illicit transaction volume in 2025, reflecting their growing dominance in the broader crypto market. Chainalysis said stablecoins offer criminals and sanctioned actors lower volatility, faster settlement, and greater utility for cross-border transfers compared with more volatile assets.
Bitcoin’s share of illicit activity continued to decline, falling from more than 70% in 2020 to less than 10% in 2025. Ethereum and other altcoins also lost relative prominence as illicit actors increasingly prioritised efficiency and liquidity over decentralisation.
At the organisational level, crypto crime has become more structured. Chinese money laundering networks emerged as a dominant force, providing laundering services, technical infrastructure, and logistical support for scams, ransomware operations, sanctions evasion, and terrorist financing.
Chainalysis also identified a growing link between cryptocurrency and violent crime. Human trafficking networks increasingly relied on digital assets, while incidents of physical coercion rose, with criminals using violence or threats to force victims to transfer cryptocurrency holdings.
Despite the record figures, Chainalysis stressed that illicit activity remains a small fraction of the overall crypto economy. However, the scale, sophistication, and degree of state involvement observed in 2025 mark a turning point for the sector, presenting mounting challenges for regulators, law enforcement agencies, and crypto businesses worldwide as they seek to contain financial crime without stifling innovation.
