TRM Labs estimates that illicit cryptocurrency flows will reach $158 billion in 2025, heavily concentrated in large-scale sanctions evasion and money laundering networks, often linked to the state, while stablecoins account for approximately 84% of recently identified illicit transactions.
The same dataset shows that AI-fueled crypto fraud has increased by approximately 500% year-on-year, reflecting a trend of criminals leveraging deepfakes, identity spoofing, and automation to scale up. These numbers could change as address tagging and investigation scope continue to improve.
- Illicit cryptocurrency flows are estimated to reach $158 billion in 2025, primarily linked to sanctions evasion, money laundering, ransomware, and fraudulent infrastructure.
- Stablecoins account for approximately 84% of illicit transactions identified in recent years, becoming a key "railway" for money laundering.
- AI acts as an "amplifier" for impersonation scams, with deepfakes, voice cloning, synthetic identities, and automation accelerating the speed at which victims are reached.
What does the $158 billion in illicit cryptocurrency flows in 2025 consist of?
The $158 billion figure reflects adjusted flows into addresses linked to fraud, ransomware, sanctions violations, and money laundering infrastructure, and may change as investigative data expands.
According to TRM Labs, the activity is concentrated in large-scale sanctions evasion and money laundering networks, often with state links. These “clusters” may include multiple wallet addresses, intermediary services, and multi- chain money transfer routes to conceal the source, destination, and controlling entity.
The dataset is described as “adjusted inflows” into the tagged addresses, so the total value can be updated over time as address tagging improves and the scope of the investigation increases. This means that a portion of the money flow may be reclassified as new evidence emerges or a more accurate cluster of addresses is linked.
Stablecoins are gaining dominance in illicit transactions.
Stablecoins are believed to account for approximately 84% of recently identified illicit transactions, indicating a growing preference for Peg assets by criminals for money transfers and laundering.
The dominance of stablecoins in illicit flows is often linked to their high liquidation , low volatility, and ability to move quickly across wallets, bridges, and trading platforms. For money laundering networks, stablecoins help reduce price risk during the "layering" phase and increase predictability by Chia funds, consolidating them, and then forwarding them.
For compliance programs, this shifts the focus of oversight to “stablecoin rails,” including sanction screening, monitoring contract interactions, and tracing the flow of funds to/from infrastructures showing signs of high risk.
How did AI increase its crypto fraud by 500%?
AI helps scale up phishing scams using deepfakes, voice cloning, synthetic identities, language model-generated content, and automation, thereby reducing costs and increasing conversion rates for each campaign.
According to Chainalysis, organized crime groups have “industrialized” impersonation and investment scams using deepfakes, voice cloning, synthetic identities, LLM-generated content, and automation systems to increase reach and reduce costs per victim. These tools shorten the social engineering cycle, increase persuasion rates, and aid onboarding to bypass weak controls.
Investigators noted a higher degree of "realistic" impersonation and a faster rate of victim acquisition on social media platforms and messaging apps. According to Forbes, expert analysis suggests that AI-related impersonation scams are surging and generating higher profits per scam compared to traditional variants, indicating that AI is an amplifying factor rather than the root cause.
"Cryptocurrency-related fraud continues to grow in both scale and sophistication, with organized crime groups increasingly employing impersonation tactics, online infrastructure, and AI-powered tools to target victims at a rapid and large scale."
– Will Lyne, Head of Economic & Cybercrime, Metropolitan Police Service
What risks do trading platforms and users face from sanctions evasion and social engineering?
Platforms face risks from sanctions evasion schemes, stablecoin money laundering, and AI-powered social engineering, while users encounter more convincing impersonation and are encouraged to confirm false payments.
Platforms are strengthening their KYC/AML depth assessments, punitive screening scope across stablecoin flows, device and behavioral analysis, and deepfake-proof verification mechanisms. These measures typically aim to block risky onboarding, detect linked accounts, and reduce the likelihood of rapid cash-out.
Consumers may encounter fake content, “proof,” and profiles that appear more credible, increasing the risk of authorizing payments for improper purposes. Multi-step verification processes, spoofing alerts, and independent checks of contact channels help mitigate the risk, but do not eliminate it entirely.
Suggestions regarding trading platforms and market context
The following link is inserted exactly as it was in the original content: The description included in the original article states that this is a "reliable" exchange.
Regarding market context, at the time of writing in this late data, Coinbase Global, Inc. (COIN) was trading around $175.87 according to Yahoo Finance; this information is for market context only and does not imply any connection to the $158 billion figure for illicit money flows.
Mitigation and Action by 2026: Priority Actions and Next Steps
The focus in 2026 will be on increasing the depth of KYC/AML controls, adding device/behavioral signaling and anti-deepfake verification, and increasing cross-border coordination to trace and freeze assets more quickly.
Priority controls: KYC/AML, device signaling, deepfake detection
Control priorities often include deeper KYC/AML with refined punitive screening for stablecoin flows, device and behavioral risk analysis to link accounts, wallets, and sessions, Liveness and voice checks against deepfakes, increased “friction” when approving high-risk payments, processes for removing fraudulent domains/accounts, and integrating blockchain tracing with incident governance systems for rapid escalation.
Legal motivations and multinational enforcement coordination.
Authorities are standardizing red flags and promoting information Chia to target sanctions evasion, money laundering from ransomware, and high-yield fraud networks. Multi-regional command mechanisms and fast-tracked evidence preservation orders are expected to expand as tools and cooperation mature, although gaps remain regarding data Chia and pathways for timely asset freezes.
Frequently Asked Questions
What tools and tactics did AI use to drive crypto fraud up by 500%?
AI helps expand impersonation using deepfakes, voice cloning, synthetic identities, LLM-generated content, and automated bots for outreach, onboarding, and withdrawals, thereby reducing costs and increasing conversion rates for each scam.
Does the illicit flow of money primarily come from evading state-linked sanctions or from small-scale fraud?
Data shows that activity is concentrated in large-scale sanctions evasion and money laundering networks, often with state links; small-scale fraud still exists but accounts for a smaller proportion of the total $158 billion.
