Illicit Crypto Crime Hits Record $158B in 2025 After Years of Decline

Global cryptocurrency crime jumped to a staggering new high in 2025, reversing a multi-year decline and raising fresh alarms about the rising financial power of criminal networks and sanctioned states. New data from blockchain intelligence specialists shows illicit crypto flows surged dramatically last year, driven largely by sanctions evasion networks, state-aligned actors and major hacks.

The sharp rise underlines an unsettling shift in how digital assets are used around the world and what law enforcement and regulators will face in the coming years.

Record Illicit Crypto Flows in 2025

Global illicit cryptocurrency flows reached approximately $158 billion in 2025, the highest annual total on record. This represents about a 145 percent increase from the roughly $64.5 billion tracked in 2024, reversing a steady decline from $86 billion in 2021 to $64 billion in 2024. This rebound was confirmed in the latest 2026 Crypto Crime Report from blockchain analysis firm TRM Labs.

Even as the total amount rose sharply, illicit transactions made up a slightly smaller share of overall on-chain volume in 2025, about 1.2 percent compared with 1.3 percent in 2024, showing that cryptocurrency usage is growing fast overall even as criminal totals expand.

Why the Surge Happened

According to analysts, several key trends explain the jump:

• Sanctions-linked crypto activity exploded, particularly involving Russia-associated networks and stablecoins tied to ruble trading.

• State-aligned actors in Iran and Venezuela expanded their use of digital assets as an alternative financial network under traditional sanctions.

• Improved tracking and attribution tools surfaced previously hidden illicit flows, meaning more activity was visible to investigators than in past years.

These factors combined to generate a volume of illicit transactions not seen in years, reshaping how crypto crime is understood.

Sanctions Evasion and Stablecoin Networks

The most dramatic contributor to the 2025 surge was sanctions-linked activity, overwhelmingly tied to Russian networks. Data shows that Russia-related crypto volumes soared, anchored by flows through an emerging ruble-linked stablecoin and associated wallet clusters that moved tens of billions of dollars.

Experts describe this activity as less about small-scale evasion and more like coordinated financial infrastructure, enabling sanctioned actors to move large amounts of value outside traditional banking channels. This has raised fresh concern among regulators about how sanctions can be bypassed using digital assets.

This shift highlights how global politics and financial technology are intersecting in complex ways, often in the shadows of legitimate markets.

Hacks, Scams and Ransomware Trends

Illicit crypto activity in 2025 also reflected ongoing criminal enterprise across familiar categories.

Major Hacks

Crypto platforms and services continued to be targets for cyberattacks. Analysts recorded nearly 150 hacks last year, resulting in about $2.87 billion in stolen funds. The most significant incident was the February breach of a major exchange, which alone accounted for roughly half of the total losses. This level of theft wasn’t unique to 2025, but the sheer scale of the leading incident made it a defining element of the year’s numbers.

Widespread Scams

Scammers also remained active throughout 2025, with more than $35 billion in cryptocurrency sent to fraudulent schemes. Most of these scams were categorized as investment frauds, including Ponzi schemes, romance baiting fraud and fake task scams. Observers noted an increase in the professionalism and reach of these operations, attributing some of this sophistication to the use of artificial intelligence in crafting and disseminating fraudulent content.

Ransomware Activity

Ransomware-related flows continued to be significant, though they did not surpass levels seen in some previous years. Interestingly, while more victims were listed on extortion portals than ever before, many victims chose not to pay ransoms, suggesting a shift in awareness or ability to resist extortion demands.

Changing Laundering and Settlement Patterns

The patterns of laundering stolen or illicit crypto saw notable evolution in 2025. Traditional mixing services, once thought to be central to laundering, saw lower usage as newer cross-chain routers and decentralized bridge services gained traction. These newer services allow funds to be transferred across different blockchain networks, making tracking and tracing more complex for investigators.

At the same time, settlement through regional underground banking networks increased, especially through networks tied to Chinese language services and escrow operators. These channels processed more than $100 billion in value and behaved like an alternate settlement layer for illicit markets, blurring the lines between pure crime infrastructure and quasi-financial networks.

What This Means for the Future

The record illicit crypto flows in 2025 show that despite growing regulatory oversight and improved tracking tools, criminal networks and sanctioned actors are adapting and scaling their financial operations. These trends challenge policymakers and law enforcement to rethink approaches to monitoring digital asset markets and enforcing financial controls.

At the same time, the increase reinforces how deeply cryptocurrencies are now embedded in global finance, sometimes used as infrastructure for legitimate trade and settlement and other times exploited by bad actors with vast resources. Lawmakers and regulators are pushing new rules in many countries to tighten safeguards and require stronger compliance from crypto firms, but the landscape remains dynamic and complex.

Despite the rise in absolute illicit totals, the fact that criminal activity still represents a small proportion of overall crypto activity shows the broader industry’s growth and adoption.

In the end, the record numbers are a warning and a call to action for governments, businesses and everyday users to stay informed about how digital assets are evolving and what risks still linger under the surface.

What do you think about this surge in illicit crypto flows and its impact on global finance? Let us know your views and share this story with others.