In 2025, the total value of illicit crypto activity hit a record $158bn, up 145% year on year, according to a report by analytics firm TRM Labs.
Despite the jump in nominal terms, the share of “dirty” funds in total on-chain flows edged down from 1.3% in 2024 to 1.2% in 2025.
Analysts also introduced a new metric that gauges risk relative to available liquidity rather than total transaction volume. By this measure, illicit actors captured 2.7% of the crypto ecosystem’s active capital.
Sanctions and policy
The main driver of growth was activity by sanctioned jurisdictions and persons — transaction volumes in this segment jumped by more than 400%.
A significant share of the activity fell to the A7 network and the ruble-pegged stablecoin A7A5, which processed more than $72bn. TRM Labs’ experts noted that such instruments are used less for the broader market than as a “coordinated infrastructure for sanctions evasion”.
For settlements, bad actors and sanctioned entities most often used stablecoins, notably USDT.
Hacks and infrastructure attacks
Over the year, attackers stole $2.87bn across nearly 150 incidents. While the overall number of attacks fell, average losses rose as larger targets were picked.
The Bybit exchange hack in February 2025 netted $1.46bn for the attackers, accounting for 51% of all funds stolen that year.
Criminals shifted focus from smart-contract exploits to compromising operational infrastructure, including theft of private keys and server access.
Fraud and ransomware
Funds sent to scam addresses totalled $35bn. Ponzi schemes and “romance” scams led the pack.
Scammers are actively deploying artificial intelligence to create deepfakes and automate victim outreach. Laundering has accelerated too: criminals try to move assets through cross-chain-swaps within 48 hours.
In 2025, 93 new ransomware variants appeared — 94% more than a year earlier. The proliferation of groups followed intensified law-enforcement action against large players such as LockBit: the ecosystem fragmented, and the barrier to entry fell thanks to the RaaS model.
TRM Labs’ analysts conclude that cryptocurrencies have ceased to be a niche tool and are now deeply integrated into the global financial system, attracting both legitimate businesses and criminals.
Over 2020–2025, the volume of money laundering via digital assets rose from $10bn to $82bn, Chainalysis noted.