Stablecoins Now Drive 86% of All Illicit Crypto Flows, TRM Labs Finds

TLDR:

• Illicit stablecoin flows hit $141B in 2025, the highest figure TRM Labs has recorded in five years.
• Sanctions-linked networks drove 86% of all illicit crypto volume, anchored by Russia’s A7 platform.
• Guarantee services moved funds that were 99% stablecoin-denominated, peaking above $17B per quarter.
• Zedcex and Zedxion processed 83% of volume in USDT before receiving OFAC sanctions in 2026.

Stablecoins have quietly become the backbone of global crypto crime. New data from TRM Labs reveals illicit entities received $141 billion through stablecoin wallets in 2025. 

That figure marks the highest level recorded in five years. Monthly stablecoin transaction volumes surpassed $1 trillion several times throughout the year.

Sanctions Networks Fuel Stablecoin Crime Surge in 2025

According to the report by TRM Labs, sanctions-related activity accounted for 86% of all illicit crypto flows last year. That share climbs to 42% after removing volumes tied to the A7A5 token, a ruble-pegged stablecoin. 

TRM Labs traced much of this activity to the A7 network, a cross-border payment platform tied to Russia. The firm attributed at least $83 billion in direct volume to addresses linked to A7 following a communications leak.

Garantex and Grinex, both sanctioned Russian exchanges, maintained heavy exposure to A7. These platforms operated with stablecoins as internal settlement rails.

They used them to reconcile transactions across affiliated entities and shell companies. 

TRM noted bidirectional flows between A7 and entities registered in jurisdictions including Kyrgyzstan.

A7A5 itself functions almost entirely within sanctions-linked ecosystems, per TRM Labs. USDT and A7A5 together served as core payment instruments in these networks. 

State-linked entities tied to China, Iran, North Korea, and Venezuela intersected with these flows. Stablecoins enabled cross-border value movement outside traditional banking controls.

In January 2026, the US Treasury designated Zedcex and Zedxion. These were the first sanctions ever targeting digital asset exchanges for operating within Iran’s financial sector. 

Between 2024 and 2025, roughly 83% of incoming volume to both platforms was in USDT. TRM’s analysis confirmed they functioned as value-transfer intermediaries, not retail trading platforms.

Illicit Use Varies Sharply Across Crime Categories

Stablecoin adoption is not uniform across crime types. Illicit goods, services, and laundering networks show near-total reliance on stablecoins. .

Scams and ransomware operators favor Bitcoin at the point of offense before converting later. CSAM vendors recorded significantly lower stablecoin usage, leaning on fragmented payment structures instead.

Guarantee and escrow services showed particularly stark numbers. Roughly 99% of volume through these services moved in stablecoins. Quarterly activity in this category surged from under $1 billion to peaks above $17 billion by mid-2025. 

A sharp drop followed in late 2025 after enforcement actions hit Huione and Haowang Guarantee in October.

TRM Labs flagged professional facilitators as the primary source of stablecoin-linked illicit risk. These include guarantee services, OTC desks, and front-company exchanges. 

Stablecoins offer them speed, low costs, and price certainty at high transaction volumes. That combination makes them operationally attractive for industrial-scale laundering.

The post Stablecoins Now Drive 86% of All Illicit Crypto Flows, TRM Labs Finds appeared first on Blockonomi.