Crypto crime topped $150 billion in 2025 as state-backed actors scaled onchain: Chainalysis

The professionalization of the illicit onchain ecosystem reached a new quantitative peak in 2025 as sovereign states integrated with established criminal supply chains to bypass global financial restrictions.

According to a new Chainalysis report shared with The Block on Jan. 8, total value received by illicit cryptocurrency addresses climbed to $154 billion for the year. This figure represents a 162% increase over the previous year’s revised total, a shift the blockchain intelligence firm said was driven largely by a surge in activity linked to sanctioned entities, including state-level sanctions evasion.

Notably, Chainalysis emphasized that the $154 billion figure is a lower-bound estimate.

“A year from now, these totals will be higher as we continue to identify more illicit addresses and incorporate their historical activity into our estimates. For perspective, when we published last year’s Crypto Crime Report, we reported $40.9 billion for 2024. One year later, our updated estimate for 2024 is substantially higher at $57.2 billion, with much of that growth coming from various types of illicit actor organizations providing onchain infrastructure and laundering services for high-risk and illicit actors,” the Chainalysis team wrote.

Despite the record nominal value, the illicit share of all cryptocurrency transaction volume remains below 1%. Chainalysis noted its methodology generally excludes revenues from non-crypto-native crimes, such as traditional drug trafficking, where crypto is used only as a payment method, because such transactions are indistinguishable from legitimate activity using onchain data alone.

State actors and stablecoins define new threat landscape

Chainalysis attributed a significant share of 2025’s illicit volume to a narrow set of state-linked actors, led by North Korea, Russia, Iran-aligned networks, and Chinese money laundering groups.

North Korean-linked hackers stole $2 billion in 2025, per the report, which Chainalysis described as their most destructive year to date in both value and sophistication. The majority of that sum originated from the Bybit exploit in February — a nearly $1.5 billion incident identified as the largest digital heist in crypto history.

Russia accounted for another major portion of state-linked onchain activity through the ruble-backed A7A5 stablecoin, according to the firm. Chainalysis said the token facilitated more than $93.3 billion in transactions within its first year after launching in February 2025, despite escalating enforcement actions.

The U.S. Office of Foreign Assets Control sanctioned the network behind A7A5 on Aug. 14, 2025, stating it was created for Russian customers to facilitate cross-border settlements for sanctions evasion. The European Union sanctioned the stablecoin on Oct. 23, 2025, calling it a “prominent tool for financing activities supporting the war of aggression.”

Beyond Russia and North Korea, Chainalysis highlighted Chinese money laundering networks as a dominant force, offering laundering-as-a-service and infrastructure supporting fraud, hack proceeds, and sanctions evasion.

Per the report, Iranian proxy networks also facilitated over $2 billion in onchain activity for money laundering, illicit oil sales, and arms procurement, with groups including Hezbollah, Hamas, and the Houthis using crypto at unprecedented scales.

Stablecoins accounted for 84% of all illicit transaction volume in 2025, the report found. Chainalysis noted this mirrors broader ecosystem trends, with criminals preferring stablecoins for their easy cross-border transferability and lower volatility.

According to Chainalysis, illicit crypto activities increasingly rely on full-stack illegal infrastructure providers offering hosting, domain registration, exchange access, and laundering services designed to withstand takedowns and enforcement actions. The blockchain intelligence firm noted that the same providers are used by ransomware operators, scam networks, and state-aligned actors.

The firm also pointed to a growing overlap between onchain crime and physical violence, including cases of human trafficking and coercive attacks aimed at forcing victims to transfer crypto assets, often timed around periods of heightened market activity.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.