- Illicit cryptocurrency transactions reached $158 billion in 2025, up 145% annually.
- The proportion of illicit activity declined to 1.2% from 1.3% in 2024 overall.
- Russia-linked A7A5 stablecoin processed $72 billion in total volume during the year.
Cryptocurrency associated with illegal activities reached $158 billion in 2025, according to TRM Labs analysis. This is a 145% increase from the previous year’s $64.5 billion. Despite this growth in absolute dollar terms, illicit transactions represented a declining share of overall blockchain activity, falling to 1.2% from 1.3% in 2024.
The difference between rising illicit volume and falling percentage share shows legitimate cryptocurrency adoption is outpacing criminal usage. TRM introduced a new statistic indicating that criminal enterprises accounted for 2.7% of available crypto liquidity in 2025, framing risk in terms of deployable capital rather than raw transactions.
Sanctions Activity Dominated by Russia-Linked Flows
Sanctions-related cryptocurrency transactions grew over 400% year-over-year, driven predominantly by Russia-linked networks. The A7A5 ruble-pegged stablecoin processed more than $72 billion in total volume during 2025. The wallet cluster associated with the Russian sanctions evasion network A7 handled at least $39 billion. This shows concentrated activity linked to state-aligned financial infrastructure.
Iranian cryptocurrency activity totaled approximately $10 billion in 2025 compared to $11.4 billion in 2024. Chinese-language escrow services and underground banking networks processed over $100 billion, operating as critical infrastructure for global illicit markets. These flows functioned as coordinated networks rather than state-directed operations.
The increase in detected illicit activity partly shows improved attribution capabilities through TRM’s Beacon Network, a real-time intelligence-sharing system enabling law enforcement to flag addresses linked to financial crime.
Cryptocurrency Theft Reached $2.87 Billion Across Hacking Incidents
Illicit actors stole $2.87 billion across nearly 150 hacks during 2025, representing fewer incidents than the previous year but higher total losses. The Bybit breach alone accounted for $1.46 billion, representing 51% of annual theft totals. This single event drove much of the year-over-year increase in hack-related losses.
Attack vectors shifted toward operational infrastructure compromises rather than smart contract exploits. Sophisticated actors, particularly those linked to North Korea, targeted keys, wallets, and control systems instead of focusing on code vulnerabilities. Infrastructure attacks generated $2.2 billion in losses across 45 incidents, averaging approximately $48.5 million per event.
Darknet marketplace activity generated $1.7 billion in incoming volume, a 20% increase from 2024. Russian-language platforms accounted for more than 90% of darknet market-related volume. Stablecoins dominated illicit transactions, with actors preferring these assets for liquidity and broad exchange acceptance.
Related: Co-founder of BTC Prague Warns of Sophisticated Phishing Attack
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
