Illicit crypto flows hit $154B as sanctions drive record on-chain activity

Chainalysis says illicit crypto hit $154B in 2025, driven by sanctioned nation-states using stablecoins and ruble token A7A5, while hacks and scams keep rising.

Illicit cryptocurrency activity reached record levels in 2025 as sanctioned nation-states and entities increasingly utilized blockchain networks to circumvent financial restrictions, according to a report released Thursday by blockchain analytics firm Chainalysis.

Illicit crypto addresses received at least $154 billion during the year, representing a 162% increase from $59 billion in 2024, the report stated. The surge was largely attributed to sanctioned entities moving funds on-chain at scale.

Chainalysis characterized 2025 as a turning point, citing “unprecedented volumes associated with nation-states’ on-chain behavior” and describing it as the latest phase in the evolution of the illicit crypto ecosystem. The firm noted that the scale and coordination of activity differed from prior years, reflecting growing sophistication among sanctioned actors.

Chainalysis identifies threat actors

Russia, which has faced extensive international sanctions since its invasion of Ukraine, emerged as a major contributor to the increase. In February 2025, the country launched a ruble-backed token designated as A7A5. The token processed more than $93.3 billion in transactions in less than a year, according to the report.

The expansion of sanctions worldwide has intensified pressure on sanctioned parties to seek alternative payment systems. The Global Sanctions Inflation Index estimated in May that nearly 80,000 entities and individuals were under sanctions globally. Research from the Center for a New American Security found that the United States added 3,135 entities to its Specially Designated Nationals and Blocked Persons List in 2024, the highest annual total on record.

Stablecoins accounted for 84% of all illicit transaction volume in 2025, according to Chainalysis. The firm attributed their prevalence to price stability, ease of cross-border transfer, and widespread liquidity, noting that the same features driving legitimate adoption have also attracted sanctioned users.

Despite the sharp rise in illicit volumes, criminal activity remains a small fraction of the overall crypto economy, Chainalysis reported. Illicit transactions still account for less than 1% of total on-chain activity, though their share increased slightly year over year.

Blockchain security firm PeckShield documented 26 major exploits in December, with address-poisoning scams and private-key leaks accounting for substantial losses. One victim lost $50 million after copying a fraudulent address that visually mimicked the intended destination, according to the firm. Another incident involved a private key leak tied to a multi-signature wallet, resulting in losses of approximately $27.3 million.

Brooklyn resident Ronald Spektor faces charges for allegedly stealing $16 million from approximately 100 Coinbase users by impersonating company employees, according to legal filings.