Crypto Crime Hits Record $154 Billion as Sanctioned States Turn to Blockchain

Illicit cryptocurrency activity surged to a record $154 billion in 2025, driven largely by a sharp increase in sanctions evasion by nation-states using blockchain networks, according to a new report from blockchain analytics firm Chainalysis.

The report finds that funds flowing to sanctioned entities jumped 694% year over year, making sanctions evasion the fastest-growing category of crypto crime.

But even excluding sanctioned activity, 2025 would still mark a record year for illicit on-chain transactions as criminal activity rose across most categories, Chainalysis said.

Despite the surge in illicit volumes, crypto crime still represents less than 1% of total crypto transaction activity, the report notes, underscoring how criminal use remains small relative to the broader ecosystem.

Nation-States Move On-Chain

The most striking development is the growing involvement of governments and state-aligned actors in crypto crime infrastructure.

Chainalysis says sanctioned jurisdictions increasingly use digital assets to bypass financial restrictions and move funds globally. Russia, for example, launched a ruble-backed token called A7A5, which transacted over $93 billion in less than a year and was used to facilitate sanctions evasion.

Meanwhile, North Korea remained the most prolific state-linked hacking group, stealing roughly $2 billion in crypto during 2025, including a nearly $1.5 billion exploit of the Bybit exchange, the largest digital asset theft on record.

Iranian networks have also increasingly used crypto to facilitate oil sales, arms procurement, and money laundering, moving more than $2 billion through wallets tied to sanctioned entities, according to the report.

Together, these trends signal a shift in the crypto crime landscape from isolated cybercriminals to state-aligned financial ecosystems operating on-chain.

Stablecoins Dominate Illicit Transactions

Stablecoins have become the primary vehicle for illicit crypto activity.

According to Chainalysis, 84% of illicit crypto transaction volume now involves stablecoins, reflecting their growing role across the broader crypto economy due to their price stability and cross-border usability.

The shift mirrors the wider market, where stablecoins increasingly serve as the core settlement asset for trading, payments, and international transfers.

Chinese Laundering Networks Expand Rapidly

Another key finding is the rise of Chinese-language money laundering networks (CMLNs), which have emerged as a central hub in the global crypto crime ecosystem.

These networks provide “laundering-as-a-service” infrastructure, processing funds from scams, hacks, and sanctions-related activity. Chainalysis estimates they now account for about 20% of known illicit crypto laundering flows, handling billions of dollars annually.

The networks operate through a variety of mechanisms—including money mule networks, informal over-the-counter brokers, gambling platforms, and discounted “Black U” markets for illicit stablecoins—often coordinating activity through Telegram marketplaces.

Scams Become Industrialized

Fraud remains one of the largest categories of crypto crime. Chainalysis estimates scammers received at least $14 billion in crypto in 2025, with the figure potentially exceeding $17 billion as additional illicit addresses are identified.

Impersonation scams surged the fastest, rising more than 1,400% year over year, as criminals increasingly use AI tools and phishing-as-a-service infrastructure to scale attacks.

These operations have become highly professionalized, with separate vendors providing phishing kits, victim databases, messaging tools, and laundering services.

A More Professionalized Illicit Ecosystem

Taken together, the findings point to a crypto crime landscape that is becoming more structured and industrialized.

State actors, organized crime groups, and specialized service providers now operate large-scale on-chain infrastructure, offering everything from laundering services to cyberattack tools.

While blockchain transparency still allows investigators to trace many of these activities, Chainalysis warns that the increasing intersection of geopolitics, cybercrime, and crypto finance raises the stakes for regulators and law enforcement.

“On-chain illicit activity is increasingly interwoven with sophisticated, state-aligned ecosystems that exploit crypto’s global reach,” the report notes, highlighting how crypto is reshaping the financial infrastructure used by both criminals and sanctioned states