Stablecoins have gradually become the dominant asset in illicit transactions, currently accounting for 84% of the total volume of illicit transactions.
Written by: Chainalysis
Compiled by: Chopper, Foresight News
In 2025, we observed a significant increase in national-level cryptocurrency-related activities, marking a new stage of maturity in the development of the illicit on-chain ecosystem. Over the past few years, the specialization of the crypto-crime field has deepened; illicit organizations have now built large-scale on-chain infrastructure to support transnational criminal networks in procuring goods and services and laundering crypto-crime proceeds. Against this backdrop, governments have also begun to enter this field, leveraging these established professional service providers while simultaneously building their own customized infrastructure to circumvent sanctions on a large scale. As governments access this illicit cryptocurrency supply chain initially designed for cybercriminals and organized crime groups, government agencies, compliance, and security teams now face significant challenges in terms of both consumer protection and national security.
How are these trends and other industry changes specifically manifested on the blockchain? Next, we will analyze this by combining data and macro trends.
According to our monitoring data, the inflow of funds into illicit cryptocurrency addresses reached at least $154 billion in 2025, a surge of 162% year-over-year. This growth was primarily driven by a sharp increase in inflows from sanctioned entities, which saw a 694% year-over-year surge. However, even excluding the growth from sanctioned entities, 2025 was still a record year for crypto crime, as the vast majority of illicit activity categories saw an increase in scale.
Nevertheless, the scale of these illicit transactions remains minuscule compared to the overall cryptocurrency economy, with legitimate transactions still dominating the cryptocurrency market. Our estimates suggest that while the proportion of illicit transactions in the total traceable cryptocurrency transactions will slightly increase in 2025 compared to 2024, it will still be less than 1%.
As shown in the figure below, we also observed that the types of assets involved in crypto crime are constantly changing.
Over the past few years, stablecoins have gradually become the dominant asset in illicit transactions, currently accounting for 84% of the total illicit transaction volume. This trend aligns with the overall development characteristics of the cryptocurrency ecosystem: thanks to its advantages such as convenient cross-border transfers, low volatility, and wide range of applications, stablecoins continue to expand their share in the overall cryptocurrency trading.
The following analysis will delve into several key trends that will define the landscape of cryptocrime in 2025, trends that will continue to warrant close attention in the future.
National threats drive up transaction volume: North Korean theft hits record high; Russian A7A5 tokens help circumvent large-scale sanctions.
In 2025, stolen funds remained a major threat to the cryptocurrency ecosystem, with North Korean-linked hacking groups alone stealing $2 billion. This figure was primarily driven by several highly destructive large-scale hacking attacks, most notably the Bybit exchange attack in February. This attack, involving nearly $1.5 billion, is the largest digital asset theft in cryptocurrency history. While North Korean hackers have long been a major threat to the cryptocurrency ecosystem, the past year has seen record-breaking amounts stolen and sophisticated intrusion and money laundering methods.
Of particular note is the unprecedented scale of on-chain activity by governments worldwide in 2025. Russia enacted legislation in 2024 to promote the use of cryptocurrencies to circumvent sanctions, a measure that officially took effect in February 2025. The country launched the ruble-backed token A7A5, and within a year of its launch, its trading volume exceeded $93.3 billion.
Meanwhile, over the past few years, Iran's proxy network has been conducting money laundering, illicit oil transactions, and large-scale arms procurement on the blockchain through verifiable wallet addresses that are already on the sanctions list, with a total transaction volume exceeding $2 billion. Despite multiple military strikes, Iranian-backed terrorist organizations such as Hezbollah, Hamas, and the Houthis in Lebanon continue to use cryptocurrencies on an unprecedented scale.
In 2025, Chinese money laundering networks emerged, becoming a dominant force in the illicit blockchain ecosystem. These sophisticated organizations have significantly propelled the diversification and specialization of cryptocrime, offering a range of specialized services, including money laundering. Building upon earlier illicit models such as "Huiyin Guarantee," these networks have developed into comprehensive criminal enterprises, covering areas such as fraud, deception, laundering proceeds stolen from North Korean hackers, sanctions evasion, and terrorism financing.
Full-stack illicit infrastructure providers fuel malicious cyber activities.
While governments worldwide are rampant in their use of cryptocurrencies, traditional cybercrime remains rampant: ransomware operators, child sexual abuse and cybercrime platforms, malware distributors, fraudsters, and illicit marketplaces still rely on vast support networks to operate. Criminals and governments are increasingly depending on on-chain infrastructure providers that offer full-stack services, including domain registrars, secure hosting services, and other technological infrastructure available for conducting malicious cyber activities.
These infrastructure providers have evolved into comprehensive infrastructure platforms capable of withstanding platform shutdowns, abuse of complaints, and enforcement sanctions. As these services continue to expand, they may become a key force driving economic crime and state-sponsored activities to extend their malicious cyber activities.
The link between cryptocurrencies and violent crime is growing.
Many people believe that cryptocrime remains confined to the virtual world. The perpetrators are seen as anonymous individuals hiding behind keyboards, posing no real-world threat. However, the link between on-chain activity and violent crime is deepening. Human trafficking rings are increasingly using cryptocurrencies for transactions; simultaneously, alarmingly, there is a significant rise in violent coercion attacks, where criminals use violence to force victims to transfer crypto assets, often targeting cryptocurrency price peaks.
Looking ahead, collaboration among law enforcement agencies, regulators, and cryptocurrency companies will be key to addressing these complex, evolving, and intertwined threats. While illicit transactions still represent a limited percentage of legitimate cryptocurrency transactions, maintaining the integrity and security of the cryptocurrency ecosystem has never been more important.
