The crypto crime landscape has become increasingly professionalized over the last few years, with illicit organizations now operating large-scale on-chain infrastructure to help transnational criminal networks procure goods and services and launder their ill-gotten crypto.
Against that backdrop, Chainalysis has seen nation-states moving into this space, both by tapping into these same professionalized service providers and by standing up their own bespoke infrastructure to evade sanctions at scale.
As nation-states plug into the illicit crypto supply chains originally built for cybercriminals and organized crime groups, government agencies and compliance and security teams now face significantly higher stakes on both the consumer protection and national security fronts.
2025 marks a record year for crypto crime
According to the latest Chainalysis report, illicit crypto addresses received at least $154 billion in 2025, marking a 162 percent increase year-over-year, primarily driven by a dramatic 694 percent increase in the value received by sanctioned entities.
But even if the value received by sanctioned entities were flat, 2025 would still mark a record year for crypto crime, as activity increased across most illicit categories. This figure represents a lower-bound estimate based on illicit addresses the report has identified to date.
“These illicit volumes are still dwarfed by the broader crypto economy, which largely consists of legitimate transaction volumes. Our estimate for the illicit share of all attributed crypto transaction volume increased slightly from 2024 but remains below 1 percent,” added the report.
Chainalysis also reveals that in the past few years, stablecoins have come to dominate the landscape of illicit transactions and now account for 84 percent of all illicit transaction volume. This mirrors broader ecosystem trends where stablecoins occupy a sizable and growing percentage of all crypto activity due to their practical benefits: easy cross-border transferability, lower volatility and broader utility.
Russia’s A7A5 token facilitates large-scale sanctions evasion
Stolen funds remained a major threat to the crypto ecosystem in 2025, with DPRK‑linked hackers alone stealing $2 billion. Devastating mega-hacks drive that total, most notably the February Bybit exploit, the largest digital heist in crypto history, at nearly $1.5 billion.
Although North Korean hackers have long been a fixture of the threat landscape, the past year has been their most destructive yet, both in value stolen and in the sophistication of their intrusion and laundering tactics.
2025 also saw unprecedented volumes associated with nation-states’ on-chain behavior. While Russia introduced legislation in 2024 to facilitate sanctions evasion via crypto, these efforts came to fruition in February 2025, when the country launched its ruble-backed A7A5 token, transacting over $93.3 billion in less than one year.
Meanwhile, over the past several years, Iran‘s proxy networks have continued to facilitate money laundering, illicit oil sales and procurement of arms and commodities on-chain to the tune of $2+ billion through confirmed wallets identified in sanctions designations.
2025 has also seen the emergence of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These sophisticated operations have dramatically expanded the trend of crypto crime’s diversification and professionalization, offering a wide variety of specialized services, including laundering-as-a-service and other criminal infrastructure.
Read: Real-world asset tokenization faces $1.3 billion losses from blockchain inefficiencies
“Traditional” cybercrime persists
While nation‑state use of crypto is rising, more “traditional” cybercrime persists. Ransomware operators, CSAM platforms, malware distributors, scammers and illicit marketplaces still depend on a dense layer of enablers to stay effective.
Illicit actors and nation‑states alike are increasingly reliant on infrastructure providers that offer a full stack of services and are themselves visible on‑chain, including domain registrars, bulletproof hosting services and other technical infrastructure that can be leveraged for malicious cyber activity.
These infrastructure providers have evolved from niche hosting resellers into integrated infrastructure platforms designed to withstand takedowns, abuse complaints and sanctions enforcement. As these offerings continue to scale, they are likely to play a key role in supporting financially motivated criminals and state-aligned actors alike to amplify the reach of malicious cyber activity.
Looking ahead, cooperation among law enforcement, regulatory bodies and crypto businesses will be crucial in combating these evolving and converging threats. While the overall percentage of illicit activity remains small relative to legitimate crypto usage, the stakes have never been higher for maintaining the integrity and security of the cryptocurrency ecosystem.
