The year 2025 closed with a historic high in illicit transaction volume. Blockchain intelligence firm TRM Labs recorded flows totaling $158 billion. This sharp spike was driven not by retail fraudsters, but by state actors navigating sanctions warfare. Despite the absolute growth in figures, the share of criminal activity within overall on-chain volume dropped to 1.2%.
State-Level Evasion
Russia and linked entities drove the vast majority of this shadow growth. Sanctions-related activity surged by over 400%, with the ruble-pegged A7A5 stablecoin acting as the primary engine, processing over $72 billion. The A7 wallet cluster channeled another $39 billion.
These figures signal a paradigm shift: previously, sanctions were evaded by fragmented actors; now we are observing centralized, state-coordinated infrastructure. Russia is utilizing stablecoins for cross-border settlements and procurement, effectively replacing SWIFT.
A similar trend is visible in Iran and Venezuela: Tehran is embedding crypto into its financial system to bypass blockades, while Caracas uses USDT for oil settlements.
Bybit Hack Rewrote Theft Statistics
Hackers drained $2.87 billion over the year. While the total sum is comparable to past periods, the composition of losses changed radically. The February breach of the Bybit exchange netted attackers $1.46 billion — accounting for 51% of all stolen funds for the year. North Korean groups orchestrated the attack.
The attack vector has shifted from exploiting smart contract vulnerabilities to compromising infrastructure. Criminals are hunting for private keys, breaching wallet management systems, and deploying social engineering. Post-theft, DPRK hackers are actively utilizing Chinese OTC brokers to launder the proceeds.
China has cemented its status as a global money laundering hub. Over $103 billion passed through networks of escrow services and underground banking. This infrastructure serves everyone from cybercriminals to sanctions intermediaries.
In the drug trade sector, Russian-language darknet platforms dominate, accounting for 90% of turnover, which reached $1.7 billion in 2025. Western marketplaces are stagnating, while the Russian-speaking segment is growing due to the “dead-drop” model, which the West has begun to adopt.
Scammers Embrace Stablecoins and AI
Fraud volume totaled $35 billion. Stablecoins have become the primary tool for fraudsters — 84% of all inflows to scam addresses are denominated in them.
Criminals are mass-adopting artificial intelligence. The use of deepfakes and voice cloning grew by 500%. These technologies allow for the scaling of “pig butchering” schemes and investment pyramids.
One of the largest uncovered networks was Prince Group. Its founder, Chen Zhi, is accused of creating a massive laundering operation where funds from fraudulent call centers were legalized through mining companies and the HuiOne Pay payment system.
New Risk Metric
TRM Labs introduced a new method for assessing risk — the share of illicit assets relative to available liquidity. In 2025, criminal entities absorbed 2.7% of all real deployable capital in the crypto economy. This indicator is trending downward: it stood at 2.9% in 2024 and 6.0% in 2023.
Researchers note that the market is maturing: crime is losing its share of total liquidity flow, despite the growth in nominal volumes. The primary threat now stems not from small-time dealers, but from systemic geopolitical players building a parallel financial reality.
This post is for informational purposes only and does not constitute advertising or investment advice. Please do your own research before making any decisions.