Stablecoins dominate illicit crypto activities, eclipsing Bitcoin

The era of the hooded hacker hoarding Bitcoin in a dark web wallet is over.

In 2025, the center of gravity in the illicit cryptocurrency economy shifted decisively away from the volatility of the original cryptocurrency and toward a dense, dollar-linked shadow system.

According to new Chainalysis data shared with CryptoSlate, stablecoins accounted for 84% of the $154 billion illicit transaction volume last year, marking a clear shift in risk toward programmable dollars.

This structural shift has enabled Chinese money laundering networks to scale “laundering-as-a-service” operations while nation-states like North Korea, Russia, and Iran plugged into these same rails to evade Western controls.

Why criminals ditched Bitcoin

The most striking trend in the 2025 data is the displacement of Bitcoin as the primary currency of crime. For over a decade, Bitcoin was synonymous with illicit online activity, but its dominance has eroded steadily since 2020.

As shown in the illicit activity chart below from 2020 to 2025, Bitcoin’s share of dirty flows has plummeted year after year, while stablecoins have surged to capture the vast majority of the market.

This migration is not accidental. It mirrors trends in the broader, legitimate crypto economy, where stablecoins are increasingly dominant due to their practical benefits: easy cross-border transferability, lower volatility than assets like Bitcoin or Ethereum, and broader utility in decentralized finance (DeFi) applications.

However, these same features have made stablecoins the preferred vehicle for sophisticated criminal enterprises.

So, the shift away from Bitcoin represents a modernization of financial crime.

By leveraging assets pegged to the US dollar, criminal actors effectively utilize a shadow version of the traditional banking system, one that moves at the speed of the internet and operates outside the immediate reach of US regulators.

This “dollarization” of crime allows cartels and state actors to settle payments in a stable unit of account without exposure to the wild price swings that characterize the rest of the crypto market.

The geopolitical pivot

If the period from 2009 to 2019 was the “Early Days” of rogue niche cybercriminals, and 2020 to 2024 was the era of “Professionalization,” 2025 marked the arrival of “Wave 3”: Large-scale nation-state activity.

In this new phase, geopolitics has moved on-chain. Governments are now tapping into the professionalized service providers originally built for cybercriminals while simultaneously standing up their own bespoke infrastructure to evade sanctions at scale.

Russia, in particular, demonstrated the viability of state-backed digital assets for sanctions evasion. Following legislation introduced in 2024 to facilitate such activities, the country launched its ruble-backed A7A5 token in February 2025.

In less than one year, the token transacted over $93.3 billion, allowing Russian entities to bypass the global banking system and move value across borders without relying on SWIFT or Western correspondent banks.

Similarly, Iran’s proxy networks have continued to leverage the blockchain for illicit finance.

Confirmed wallets identified in sanctions designations show that Iranian-aligned networks facilitated money laundering, illicit oil sales, and the procurement of arms and commodities to the tune of more than $2 billion.

Despite various military setbacks, Iran-aligned terrorist organizations, including Lebanese Hezbollah, Hamas, and the Houthis, are utilizing cryptocurrency at scales never before observed.

North Korea also recorded its most destructive year to date. DPRK-linked hackers stole $2 billion in 2025, a figure driven by devastating mega-hacks.

The most notable of these was the February Bybit exploit, which resulted in losses of nearly $1.5 billion, marking the largest digital heist in cryptocurrency history.

Money laundering industrialization

This surge in volume is supported by the emergence of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These networks have dramatically expanded the diversification and professionalization of crypto crime.

Building on frameworks established by operations such as Huione Guarantee, these networks have created full-service criminal enterprises.

They offer specialized “laundering-as-a-service” capabilities, supporting a diverse client base that ranges from fraudsters and scam operators to North Korean state-backed hackers and terrorist financiers.

A key trend identified in 2025 is the increasing reliance of both illicit actors and nation-states on infrastructure providers that offer a “full stack” of services.

These providers, which are themselves visible on-chain, have evolved from niche hosting resellers into integrated infrastructure platforms. They provide domain registration, bulletproof hosting, and other technical services specifically designed to withstand takedowns, abuse complaints, and sanctions enforcement.

By offering a resilient technical backbone, these providers amplify the reach of malicious cyber activity. They allow financially motivated criminals and state-aligned actors to maintain operations even as law enforcement agencies attempt to dismantle their networks.

Convergence of digital and physical threats

While the narrative of crypto crime often focuses on digital theft and laundering, 2025 provided stark evidence that on-chain activity is increasingly intersecting with violent crime in the physical world.

Human trafficking operations have increasingly leveraged cryptocurrency for financial logistics, moving proceeds across borders with relative anonymity.

Even more disturbing is the reported rise in physical coercion attacks. Criminals are increasingly using violence to force victims to transfer assets, often timing these assaults to coincide with cryptocurrency price peaks to maximize the value of the theft.

Illicit activity remains less than 1% of crypto economy

Despite these alarming trends, the broader context remains important. The illicit volumes tracked in 2025 remain less than 1%  of the legitimate crypto economy.

However, the qualitative shift in that 1% is what concerns regulators and intelligence agencies. The integration of nation-states into the illicit supply chain via stablecoins raises the stakes for national security.

As government agencies, compliance teams, and security professionals look toward 2026, the challenge will be disrupting a professionalized, state-sponsored shadow economy that has successfully weaponized the efficiency of modern finance.

Cooperation among law enforcement, regulatory bodies, and crypto businesses will be crucial, as the integrity of the ecosystem now intersects directly with global geopolitical stability.