Illicit crypto flows hit a new all-time high of $158 billion in 2025, more than double what came in the year before ($64.5 billion), according to TRM Labs’ 2026 Crypto Crime Report.
“Prior to this rebound, total incoming value to illicit entities had declined steadily from USD 85.9 billion in 2021 to USD 75.4 billion in 2022 and USD 73.3 billion in 2023, before reaching a low point in 2024,” said TRM.
TRM said this jump is directly tied to tougher sanctions, more governments using crypto, and a tech platform called Beacon Network that lets investigators talk to each other and share wallet info fast, which means dirty wallets are getting flagged sooner.
Russia-linked wallets dominated 2025’s illicit crypto flows, says TRM
TRM’s report said only 1.5% of all known crypto traffic in 2025 was dirty, down from 1.7% in 2024 and way lower than 3.5% in 2023.
Same thing happened with incoming money, where only 2.7% of new flows went to bad wallets, down from 2.9% the year before and 6.0% in 2023.
So there’s more crime in dollar terms, but less compared to how much clean money is flying around.
One Russia-linked token called A757 got $72 billion in dirty money, and another $39 billion was sent straight to the A7 wallet group, which means over 80% of all sanctions-linked volume was connected to Russian players.
TRM named Garantex, Grinex, and A7 as key players. A wallet is one thing, but TRM also flagged a token called A7A5, a ruble-backed stablecoin tied to Russia’s larger game plan: cut out the US dollar and build their own rails. The A7 wallets are mostly for sanctions dodging, but A7A5 was used in all kinds of official flows.
TRM alleged that 95% of all cash going to these sanctioned wallets came in through stablecoins. That tells you the tools have changed. These people know how to hide, and they’re using stablecoins to stay under the radar. Sanctions are stricter now. So they’ve shifted to smaller, riskier platforms that don’t play by the rules.
In Venezuela, the government allegedly used crypto to keep the lights on since banks are frozen there. So they turned to tokens for state payments, remittances, and whatever else they could sneak through.
TRM also pointed at Chinese-language escrow services and underground banks being used by scammers, hackers, and sanctions dodgers.
In 2020, that activity was around $123 million, but now it’s over $103 billion. These services move huge amounts of stablecoins into legit systems, through over-the-counter brokers, money mules, and casinos in Asia, according to TRM.
Enforcement speeds up and dirty wallets get caught faster
TRM broke the numbers down by crime type. Sanctions violations grew more than 400%. Blocklisted wallets went up 32%. Hacked or stolen money rose 31%. Darknet markets added 20%. Sales of illegal goods and services rose 12%.
This wasn’t because criminals got better. TRM said the difference was faster enforcement. Beacon Network made it easier for investigators to connect the dots across countries. It didn’t change what’s defined as “illicit,” but it sped up how fast dirty wallets got tagged.
Stablecoin companies joined in too. TRM said Tether in particular started going after bad wallets linked to terrorism, scams, and hacks. That helped explain why so many of the flagged transactions involved stablecoins. Enforcement is getting smarter and faster.
TRM also updated how it counts crime. They used to compare illicit crypto activity to total blockchain traffic. That made crime look smaller because bots, trading firms, and exchanges inflate volume with fake trades and rapid moves.
Now, TRM compares illicit money to cash actually leaving VASPs, real providers like exchanges. That shows what part of real usable money is going to bad actors. If $100 comes in and $20 ends up in criminal wallets, that’s a real 20% risk. Doesn’t matter how many times the same $100 got bounced around.
TRM also removed fake volume from the math; stuff like wash trading, peel chains, and internal movements. These things don’t add capital. They just move it in circles to boost stats. That junk is gone from the new model.
They said the numbers are conservative. They don’t include fiat crimes that later turned crypto, or unaudited wallets. They also skipped laundering chains. They only tracked income, not what happened after the money was moved around.
TRM said these totals are going to go up later. New wallets always get found after the fact. Investigations take time. Sanctions get updated. Court records get unsealed. So what’s $158 billion today might be more tomorrow.
If you're reading this, you’re already ahead. Stay there with our newsletter.
