What happens on-chain is starting to resemble geopolitics more than cybercrime. According to a new assessment from Chainalysis, illicit crypto activity in 2025 crossed into a different category altogether - one defined less by rogue hackers and more by coordinated state involvement.
The firm estimates that wallets tied to illegal activity absorbed at least $154 billion over the year. That figure alone would be notable, but the composition of the activity is what signals a deeper shift. Crypto crime is no longer just opportunistic. It is strategic.
Key Takeaways
Crypto crime in 2025 was increasingly driven by state-backed actors
Stablecoins have overtaken Bitcoin as the dominant asset for illicit activity
Physical violence linked to crypto theft is rising alongside on-chain crime
The quiet takeover of stablecoins
One of the clearest signs of this transformation is the type of assets being used. Stablecoins have effectively replaced Bitcoin as the primary vehicle for illicit transactions, accounting for the vast majority of criminal on-chain flows.
This marks a complete reversal from earlier cycles, when Bitcoin dominated illegal usage. The change is practical rather than ideological: stablecoins move faster, fluctuate less, and plug seamlessly into global liquidity pools. For actors trying to move large sums discreetly and efficiently, they are simply better tools.
Dollar-linked tokens such as USDT and USDC sit at the center of this shift, but non-dollar alternatives have also gained traction as geopolitical instruments.
When governments start using crypto rails
Chainalysis characterizes 2025 as the beginning of a third phase in crypto crime evolution. Earlier periods were shaped first by small, technically skilled hackers, then by organized criminal networks offering infrastructure and services. The current phase escalates further.
Nation-states have entered the ecosystem directly.
Sanctioned entities and state-aligned actors drove a massive year-over-year expansion in illicit activity, with growth rates that would have been unthinkable just a few years ago. Even stripping out sanctioned flows entirely, overall crypto crime would still have reached a record, driven by broad-based expansion across fraud, laundering, and theft.
North Korea sets a grim benchmark
No actor illustrates this shift more clearly than North Korea. In 2025, groups linked to the regime carried out their most destructive campaign to date, siphoning roughly $2 billion in digital assets.
One incident alone rewrote the record books: a massive exploit targeting Bybit accounted for the majority of those losses, becoming the largest crypto theft ever documented. These operations focused heavily on liquid stablecoins, enabling rapid laundering and redeployment of funds across jurisdictions.
Russia, China, and Iran widen the playbook
North Korea was not alone. Russia’s footprint expanded indirectly through the use of a ruble-linked stablecoin that processed enormous transaction volumes in a short period, highlighting how alternative-pegged tokens can function as financial bypasses.
Meanwhile, Chinese-based money laundering networks have evolved into full-service platforms. These groups no longer simply clean funds; they provide infrastructure, escrow services, and coordination for scams, sanctions evasion, and even state-sponsored hacking proceeds.
Iran followed a similar path. Entities tied to its military and proxy networks increasingly relied on crypto for oil sales, arms procurement, and funding aligned groups, signaling a normalization of on-chain finance within sanctioned ecosystems.
Digital crime turns physical
Perhaps the most unsettling development outlined in the report is the growing overlap between crypto crime and real-world violence. As digital assets become more valuable, criminals are increasingly willing to use physical force to obtain them.
Home invasions, kidnappings, and armed threats tied directly to crypto holdings surged, often coinciding with market rallies. Hundreds of such incidents have now been tracked globally, and analysts believe many more go unreported due to fear or reputational concerns.
A different risk profile for the next cycle
The picture that emerges is stark. Crypto crime is no longer a fringe activity happening on the margins of finance. It is increasingly intertwined with state strategy, organized infrastructure, and physical coercion.
As stablecoins, state actors, and global liquidity converge on the same rails, the next phase of crypto adoption will unfold under far heavier scrutiny – not just from regulators, but from national security institutions worldwide.
