Blockchain analytics firm Chainalysis has released a report revealing that illicit cryptocurrency activity reached an unprecedented all-time high in 2025. Illicit addresses received at least $154 billion, marking a staggering 162% year-over-year increase from the previous year.
The dramatic surge was primarily fueled by a 694% spike in funds flowing to sanctioned entities. Chainalysis frames 2025 as the dawn of a "third wave" of crypto crime, characterized by large-scale nation-state activity aimed at evading international sanctions. This follows earlier waves defined by niche cybercriminals (2009-2019) and the professionalization of illicit on-chain infrastructure (2020-2024).
Stablecoins have become the dominant currency for crime, representing 84% of all illicit transaction volume in 2025. This is a complete reversal from 2020, when Bitcoin accounted for roughly 70% and stablecoins just 15%. Chainalysis attributes this shift to stablecoins' practical advantages: ease of cross-border transfers, lower volatility, and broader utility.
Key nation-state actors highlighted in the report include:
Russia, which launched its ruble-backed A7A5 stablecoin in February 2025, facilitating over $93.3 billion in transactions in less than a year under legislation designed for sanctions evasion.
North Korean hackers, who had their most destructive year yet, stealing $2 billion in 2025 alone. The February Bybit exploit accounted for nearly $1.5 billion of that total, making it the largest digital heist in crypto history. These actors prioritize high-liquidity stablecoins like USDT, USDC, and occasionally BUSD.
Iran, whose proxy networks facilitated over $2 billion in money laundering, illicit oil sales, and weapons procurement through confirmed wallets. Iran-aligned organizations like Hezbollah, Hamas, and the Houthis are now using cryptocurrency at unprecedented scales.
The report also details the emergence of dominant Chinese Money Laundering Networks (CMLNs), which offer "laundering-as-a-service" and full-service criminal infrastructure. Furthermore, Chainalysis warns of a sharp rise in violent "physical coercion attacks" tied to cryptocurrency price peaks, with over 215 such attacks recorded worldwide since 2020.
Despite the record figures, Chainalysis notes that illicit activity still represents less than 1% of all attributed crypto transaction volume, and the $154 billion is a "lower-bound estimate." The firm concludes that while the percentage remains small, "the stakes have never been higher for maintaining the integrity and security of the cryptocurrency ecosystem," calling for increased cooperation among law enforcement, regulators, and crypto businesses.
