Illicit cryptocurrency addresses received at least US$154 billion in 2025, driven largely by nation-state activity and the growing professionalisation of on-chain crime.
Chainalysis’s Introductory Chapter of the Crypto Crime Report showed that illicit cryptocurrency activity reached a new high in 2025, reflecting a structural shift in how criminal and state-linked actors use digital assets.
According to preliminary data, illicit addresses received at least US$154 billion over the year, representing a 162% increase year-on-year. While illicit activity remains a small fraction of total crypto transaction volume, the scale and composition of this growth mark a significant evolution in the on-chain threat landscape.
The sharp rise was primarily driven by a 694% increase in value received by sanctioned entities, highlighting the expanding role of crypto in sanctions evasion. Nation-state involvement also continues to be a defining factor, with North Korea-linked actors continuing to dominate stolen-fund activity. At least US$2 billion was stolen during the year, including proceeds from the Bybit exploit in February 2025.
Other state actors increasingly used crypto as part of their strategies. Russia launched its ruble-backed A7A5 token in February 2025, and the token facilitated more than US$93.3 billion in under a year. Iran and Iran-aligned groups also continued to use cryptocurrency at scale for money laundering, illicit oil sales, procurement, and terrorist financing as well.
Stablecoins played a central role in this activity, accounting for 84% of all illicit transaction volume, mirroring their growing dominance across the wider crypto ecosystem. Their price stability, liquidity, and ease of cross-border transfer make them a practical choice for both legitimate users and illicit actors, reinforcing the trend that criminal usage often follows the same functional incentives as lawful activity.
The rise of Chinese money laundering networks (CMLNs) is also another enabler of illicit crypto flows. These networks operate as full-service infrastructure providers, offering laundering-as-a-service, financial intermediation, and technical support to a wide range of actors, from scammers and ransomware groups to nation-state operators. Their emergence reflects the increasing professionalisation and specialisation of the illicit on-chain economy.
The report also points to a growing intersection between crypto crime and physical-world harm. Human trafficking operations and violent coercion attacks are increasingly linked to on-chain activity, demonstrating that crypto crime is no longer confined to digital environments.
Overall, the 2025 data indicate that the rise in illicit crypto received is being driven less by isolated criminal actors and more by organised, state-aligned, and infrastructure-enabled operations.
Read the report here.
Stay updated on crypto and AI by following our socials.
