According to a comprehensive report from blockchain intelligence firm TRM Labs, illicit cryptocurrency inflows reached a staggering $158 billion in 2025, marking a five-year peak and reversing a previous multi-year decline. This represents a sharp 145% increase from the $64.5 billion recorded in 2024. The surge was largely driven by sophisticated, state-aligned financial networks, particularly those linked to Russia, using crypto to evade international sanctions.
The report highlights the A7 network, a Kremlin-backed financial architecture, as a primary conduit. This network connects Russian actors with counterparts in China, Southeast Asia, and Iran, functioning as a dedicated sanctions evasion infrastructure. In 2025, the A7 group of wallets alone added $39 billion in sanctions-evasion activity. Leaked internal communications allowed TRM to attribute specific wallet clusters to this coordinated activity.
Stablecoins were the vehicle of choice, facilitating nearly 95% of inflows to sanctioned entities. While Tether (USDT) was widely used, the report specifically identifies the A7A5 stablecoin as a critical tool within these evasion networks. The use of A7A5 to evade sanctions increased by over 400% year-on-year, with the token processing a total volume of $72 billion. TRM's analysis indicates approximately 34% of A7A5's trading volume was wash trading, artificially inflating its apparent liquidity.
The ecosystem supporting these flows involved authorized exchanges like Garantex and Grinex, which maintained a two-way exposure worth over $2 billion with the A7 network. Furthermore, illicit participants increasingly shifted to high-risk services and decentralized platforms, where related flows surged by more than 200% between 2024 and 2025.
Parallel to the Russian networks, Chinese-language underground banking services processed an adjusted crypto volume of $103 billion in 2025, a massive increase from just $123 million in 2020. These networks assist in large-scale stablecoin transactions, integrating crypto into formal systems through OTC brokers and money-mule networks to support scams, cybercrime, and sanctions evasion.
Beyond sanctions evasion, other crime categories also grew: hacked or stolen funds rose 31% to $2.87 billion (driven by fewer but larger attacks), darknet market activity expanded 20%, and scams funneled about $35 billion to fraud-linked wallets. Despite the absolute increase, the proportion of illicit activity to total crypto volume slightly declined to 1.2% in 2025 from 1.3% in 2024, as overall market volume grew.
The report also notes sustained crypto use in other sanctioned economies like Iran (processing ~$10 billion in transactions) and Venezuela, where stablecoins are used for payments and remittances. TRM concludes that digital assets have transformed into a "peripheral technology to embedded financial infrastructure," presenting enforcement agencies with increasingly advanced, state-sponsored evasion systems.
