2025 Crypto Crime: Sanctions, Stablecoins, and State-Linked Hacks

Record Highs and a Changing Threat Landscape

According to the latest Chainalysis report, crypto crime reached a record high in 2025, a year marked by a notable rise in nation-state activity and further maturation of the illicit on-chain ecosystem. The report frames this phase as one in which illicit organisations operate large-scale on-chain infrastructure to help transnational criminal networks procure goods and services and launder illicit crypto, while nation-states increasingly move into this space by both tapping into the same professionalised service providers and standing up bespoke infrastructure to evade sanctions at scale. As a result, government agencies as well as compliance and security teams face higher stakes across both consumer protection and national security.

Key 2025 Metrics: $154B Illicit Inflows and Sanctions-Driven Growth

The data presented indicate that illicit cryptocurrency addresses received at least $154 billion in 2025, representing a 162% year-on-year increase, and that this growth is primarily driven by a 694% increase in value received by sanctioned entities. The report also notes that this total is a lower-bound estimate based on illicit addresses identified to date, and that the figure may increase as additional illicit entities are identified and their historical activity is incorporated. Importantly, the report notes that even if the value received by sanctioned entities had been flat year-on-year, 2025 would still constitute a record year, as activity increased across most illicit categories.

Scale vs Share: Why ‘Below 1%’ Still Matters

At the same time, the report places those volumes in context by emphasising that illicit flows are dwarfed by the broader crypto economy, which largely consists of legitimate transaction volume. The estimate for the illicit share of all attributed crypto transaction volume increased slightly from 2024 but remains below 1%. This combination indicates that system-level exposure can intensify even when illicit activity constitutes only a minority of overall on-chain activity.

Stablecoins Dominate Illicit Flows

A key structural development highlighted is the continued shift in the types of assets used in crypto crime. Stablecoins are widely reported to have dominated illicit transactions in recent years and now account for 84% of all illicit transaction volume. The report links this to broader ecosystem trends in which stablecoins occupy a sizable and growing percentage of crypto activity due to practical benefits, including easy cross-border transferability, lower volatility, and broader utility. In effect, the asset composition of illicit activity is increasingly aligned with the instruments that offer operational convenience for moving value at speed and across borders.

Trend 1: Nation-State Threats and Mega-Hacks

The first major trend described is that nation-state threats drove record volumes, with stolen funds remaining a significant threat to the ecosystem. The report states that DPRK-linked hackers alone stole $2 billion in 2025, with that total driven by devastating “mega-hacks,” most notably the February Bybit exploit, described as the largest digital heist in crypto history at nearly $1.5 billion. It also characterises the year as the most destructive yet for North Korean hackers, both in value stolen and in the sophistication of intrusion and laundering tactics. The overall message is that theft at scale is not only ongoing but also evolving in its operational capabilities.

Within the same trend, the report emphasises that 2025 saw unprecedented volumes associated with nation-states’ on-chain behaviour, particularly in relation to sanctions evasion. It notes that Russia introduced legislation in 2024 to facilitate sanctions evasion via crypto, and that these efforts “came to fruition” in February 2025 with the launch of a ruble-backed token, A7A5, which is reported to have transacted over $93.3 billion in less than one year. The significance lies in the scale and explicit linkage to sanctions evasion: the report presents this as a concrete example of state-linked financial activity moving on-chain at scale.

The geopolitical framing extends further through discussion of Iran-linked networks and terrorist organisations. The report states that over the past several years, Iran’s proxy networks have continued to facilitate money laundering, illicit oil sales, and the procurement of arms and commodities on-chain to the tune of $2+ billion through confirmed wallets identified in sanctions designations. It adds that Iran-aligned terrorist organisations, including Lebanese Hezbollah, Hamas, and the Houthis, are using cryptocurrency at scales “never before observed,” despite various military setbacks. These findings reinforce the report’s broader claim that crypto-enabled illicit finance is increasingly intertwined with sanctions regimes, state-aligned networks, and security-relevant actors.

Trend 2: Professionalised Illicit Services and Laundering Networks

A second major trend is the diversification and professionalisation of crypto crime, driven by the rise of specialised service providers. The report highlights the emergence in 2025 of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These operations are described as having expanded the trend of professionalised crypto crime by offering a wide variety of specialised services, including laundering-as-a-service and other criminal infrastructure. Building on the framework established by operations such as Huione Guarantee, the report describes these networks as having created full-service criminal enterprises that support activities ranging from fraud and scams to proceeds from North Korean hacking, sanctions evasion, and terrorist financing. The implication is that illicit actors are not operating only as isolated groups; rather, an enabling market for services has matured, increasing capacity and repeatability.

Trend 3: Full-Stack Illicit Infrastructure Providers

A third major trend is the growing importance of “full-stack” illicit infrastructure providers that facilitate malicious cyber activity. While nation-state use of crypto is rising, the report states that more “traditional” cybercrime remains active, listing ransomware operators, CSAM platforms, malware distributors, scammers, and illicit marketplaces. These actors are described as depending on a dense layer of enablers to remain effective. The report further explains that illicit actors and nation-states alike are increasingly reliant on infrastructure providers offering a full stack of services that are visible on-chain, including domain registrars, bulletproof hosting services, and other technical infrastructure that can be leveraged for malicious cyber activity. It characterises these providers as having evolved from niche hosting resellers into integrated platforms designed to withstand takedowns, abuse complaints, and sanctions enforcement, and suggests that as such offerings scale, they are likely to play a key role in amplifying malicious cyber activity for both financially motivated criminals and state-aligned actors.

Trend 4: Crypto and the Link to Violent Crime

A fourth major trend is the risng intersection of crypto and violent crime, challenging the assumption that crypto crime is purely virtual. The report states that there are growing connections between on-chain activity and physical-world harm. It notes that human trafficking operations have increasingly leveraged cryptocurrency and describes a particularly disturbing rise in physical coercion attacks, in which criminals use violence to force victims to transfer assets, often timing assaults to coincide with cryptocurrency price peaks. This expands the framing from financial loss and market integrity to direct personal safety risks associated with illicit crypto activity.

The report also provides important interpretive caveats about measurement and scope. It emphasises that annual illicit totals typically increase over time as more illicit addresses are identified and their historical activity is incorporated. To illustrate this, it notes that the prior year’s report initially reported $40.9 billion for 2024, and that one year later the updated estimate for 2024 is substantially higher at $57.2 billion, with much of the growth coming from various types of illicit actor organisations providing on-chain infrastructure and laundering services for high-risk and illicit actors. It also explains that totals generally exclude revenue from non-crypto-native crime, such as traditional drug trafficking and other crimes where crypto may be used as a means of payment or laundering, because such transactions can be virtually indistinguishable from licit transactions in on-chain data without off-chain investigative information; where such information can be confirmed, those transactions can be counted as illicit.

Finally, the report explains the logic behind the illicit share metric by describing how the denominator is constructed: it is based on all inflows to known services across tracked assets, excluding internal transfers within services, and the illicit value received is divided by the total value received by all services. This methodological clarity is essential for avoiding misinterpretation of “share” measures, especially when the total market is large and heterogeneous and when attribution improves over time.

Converging Threats and Rising Expectations for Cooperation

Taken as a whole, the report’s introduction portrays 2025 as a year in which crypto crime scaled to record levels amid a broader maturation and professionalisation of illicit on-chain ecosystems, with nation-state activity and sanctions evasion moving on-chain at volume. The dominance of stablecoins within illicit flows underscores that the operational “rails” of illicit finance are concentrating around assets designed for practical transfer and utility, while the emergence of specialised money laundering networks and resilient infrastructure providers points to a deepening service layer that sustains both criminal and state-aligned misuse. The report’s closing message is that as threats evolve and converge, cooperation among law enforcement, regulatory bodies, and crypto businesses will be crucial; even if the overall percentage of illicit activity remains small relative to legitimate crypto usage, the stakes for maintaining the integrity and security of the ecosystem are described as having “never been higher.”

Source: 2026 Crypto Crime Report Introduction - Chainalysis