Sanctions Evasion Fuels a $158bn Boom in Illicit Crypto Transactions

Illicit crypto flows surged 145% in 2025 to a record $158bn, TRM Labs says

In 2025, the total value of illicit crypto activity hit a record $158bn, up 145% year on year, according to a report by analytics firm TRM Labs.

Despite the jump in nominal terms, the share of “dirty” funds in total on-chain flows edged down from 1.3% in 2024 to 1.2% in 2025.

Analysts also introduced a new metric that gauges risk relative to available liquidity rather than total transaction volume. By this measure, illicit actors captured 2.7% of the crypto ecosystem’s active capital.

Sanctions and policy

The main driver of growth was activity by sanctioned jurisdictions and persons — transaction volumes in this segment jumped by more than 400%.

A significant share of the activity fell to the A7 network and the ruble-pegged stablecoin A7A5, which processed more than $72bn. TRM Labs’ experts noted that such instruments are used less for the broader market than as a “coordinated infrastructure for sanctions evasion”.

For settlements, bad actors and sanctioned entities most often used stablecoins, notably USDT.

Hacks and infrastructure attacks

Over the year, attackers stole $2.87bn across nearly 150 incidents. While the overall number of attacks fell, average losses rose as larger targets were picked.

The Bybit exchange hack in February 2025 netted $1.46bn for the attackers, accounting for 51% of all funds stolen that year.

Criminals shifted focus from smart-contract exploits to compromising operational infrastructure, including theft of private keys and server access.

Fraud and ransomware

Funds sent to scam addresses totalled $35bn. Ponzi schemes and “romance” scams led the pack.

Scammers are actively deploying artificial intelligence to create deepfakes and automate victim outreach. Laundering has accelerated too: criminals try to move assets through cross-chain-swaps within 48 hours.

In 2025, 93 new ransomware variants appeared — 94% more than a year earlier. The proliferation of groups followed intensified law-enforcement action against large players such as LockBit: the ecosystem fragmented, and the barrier to entry fell thanks to the RaaS model.

TRM Labs’ analysts conclude that cryptocurrencies have ceased to be a niche tool and are now deeply integrated into the global financial system, attracting both legitimate businesses and criminals.

Over 2020–2025, the volume of money laundering via digital assets rose from $10bn to $82bn, Chainalysis noted.