2025 Crypto Crime Analysis: Stablecoins Lead $154B in Illegal Activity

Trade Now

This article was first published on The Bit Journal.

Illegal crypto crime activity reached a peak in 2025, with blockchain analytics firm Chainalysis reporting that illicit cryptocurrency addresses received at least $154 billion in illicit flows,  a 162 percent increase over 2024. 

This surge was propelled by the activity of large state-backed actors, sanctions evasion, and now the increasing trend of using stablecoins to aid in moving illicit value across borders. 

High Illicit Global Crypto Transactions Record in 2025

In 2025, illicit cryptocurrency transactions reached at least $154 billion, the largest annual sum on record. This represents a 162 percent increase year-on-year from the $59 billion total seen in 2024, Chainalysis reported. 

The figure is a conservative estimate, as it is only based on illicit addresses at present known by the analytics firm. Even with this rapid expansion, the illegal flows are still under 1 percent of total crypto transaction volume, indicating that the vast majority of crypto activity remains lawful.

Stablecoins Dominate Illicit Transactions

There were a few characteristics of the illicit crypto activity in 2025 and one of them was the heavy reliance on stablecoins. Chainalysis data shows stablecoins comprised 84 percent of illicit transaction volume, a substantial jump from previous years when assets such as Bitcoin dominated. 

The transaction activity is due to stablecoins’ low volatility, ease of transferring across borders and broad liquidity on exchanges, features that attract both criminals and sanctioned entities. 

Meanwhile, Bitcoin’s proportion of illicit crypto activities fell to about 7% in 2025.

As a result, popular stablecoins like Tether’s USDT and Circle’s USDC are in high use because of these features and tight integration into global crypto exchanges. Their price-stability profile limits the risk of price swings, making them preferable for large-scale illicit settlements.

Nation-State Actors and Sanctions Evasion

Most of the illicit growth in 2025 was driven by activity connected to sanctioned nation-state actors. These actors help run operations that use blockchain technology to evade global financial restrictions. 

Amongst them,  hackers linked to North Korea, including the notorious Lazarus Group, were responsible for the theft of nearly $2 billion in cryptocurrency. Most of these funds were obtained during the Bybit hack in February 2025, which involved the stealing of almost $1.5 billion in what is currently considered one of the largest crypto heists so far.

Russia was also a major driver of illicit crypto flows. In February 2025, the country introduced its ruble-backed A7A5 stablecoin, which saw more than $93.3 billion in transactions by year’s end, despite US Office of Foreign Assets Control and European Union sanctions. 

Iran-associated networks were also identified. Proxies associated with the Islamic Revolutionary Guard Corps are said to have moved more than $2 billion for money laundering, sale of oil illegally and purchase of arms. Furthermore, paramilitary and terrorist groups including Hezbollah and Hamas were found to have increasingly employed cryptocurrency more than ever before.

Emerging Illicit Infrastructure and Violence

While illegal crypto activity grew in 2025, so did the infrastructure that facilitates these crime-related transactions.. Chinese Money Laundering Networks (CMLNs) were among the principal actors that provide critical services for criminals seeking to launder funds stolen from victims and circumvent sanctions through various tools, including domain registration, exchange access, and transactional layering.

A disturbing increase in physical violence associated with stolen cryptocurrency was also found out. More attackers are resorting to coercion to compel victims into handing over control of wallets and devices. 

Since 2020, there have been at least 215 such instances documented, and in 2025 that figure has almost doubled relative to the previous year, indicating an alarming meeting point between on-chain crime and real-world crime.

Implications for Crypto Crime Trends

The 2025 surge in illegal crypto activity shows a transition into what Chainalysis describes as a “third wave” of crypto crime. 

The first wave (from 2009 to 2019) was organized mainly by individual niche hackers, while the second wave (from 2020 to 2024) is dominated mainly by professional criminal organizations. The third wave, identifiable in 2025, features the involvement of states and well- resourced, high-sophistication-level targeted campaigns with apparent interest on evasion of sanctions and geopolitical machinations. 

This development has larger implications both for illegal interaction with decentralized technology and around complex regulatory issues.

Even with this historical spike, it is clear that illicit transactions are still a small percentage of overall cryptocurrency behavior.

Conclusion

Illegal crypto activity reached unexpected heights in 2025 with illicit addresses receiving at least $154 billion worth of digital currency,  a 162% increase over the previous year. 

The increase was largely wrought by state-sponsored nation-state actors and the overwhelming use of stablecoins, which represented 84 percent of illicit transaction volume. 

Russia’s A7A5 stablecoin, North Korea’s Lazarus-linked hacks and Iran-related networks were all major contributors. 

What further characterized this age were the emerging underworld infrastructures, Chinese laundering networks and growing real world violence associated with crypto theft. 

Although these nefarious activities have exploded, it represents less than 1 percent of the total crypto economy.

Glossary

Illicit Crypto activity: Unauthorized or illegal cryptocurrency transactions used to launder money, evade sanctions, commit ransomware attacks and other crimes.

Stablecoin: A kind of cryptocurrency tied to a stable asset, usually the U.S. dollar or another fiat currency, popular for ease of transferring and reduced volatility.

Sanction Evasion: Bypassing trade embargoes with financial instruments (including cryptocurrencies).

State-Backed Actors: Individuals or organizations that are backed or otherwise able to call on support from a foreign government in conducting cyber operations or illegal financial activity.

Laundering Networks: Groups that are set up to effectively obscure the source of stolen or rogue coins on a coin’s blockchain.

Frequently Asked Questions About Illegal Crypto Activity in 2025

What was the total value of illegal crypto activity in 2025?

This illicit activity hit at least $154 billion according to Chainalysis data, a peak, based on the blockchain analysis records.

How many illicit transactions were conducted using stablecoins?

Stablecoins represented 84 percent of all illicit crypto transaction volume in 2025.

Whose actions had the greatest illicit impact on crypto flows?

Among the biggest contributors were nation-state actors such as North Korea’s Lazarus Group and Russia’s A7A5 stablecoin network.

What is the use of stablecoins in illicit transfers?

Stablecoins provide low volatility, easy movement across borders and deep liquidity, all characteristics that would be more appealing for large illicit transfers.

Is illegal crypto activity taking over the entire crypto market?

No. Despite illicit activity growing to $154 billion, illegal crypto activity remained less than 1 percent of total blockchain transaction volume.

Reference

Chainalysis