The numbers are hard to spin. According to the Chainalysis 2026 Crypto Crime Report, illicit cryptocurrency transactions reached at least $154 billion in 2025 - a 162% jump from the revised 2024 figure of $57.2 billion.
Key Takeaways
Illicit crypto transactions hit a record $154 billion in 2025, up 162% from the year before
Sanctions evasion drove most of that growth – funds sent to sanctioned entities surged 694%
Stablecoins now make up 84% of all illicit transaction volume; Bitcoin has dropped to just 7%
North Korean hackers stole $2 billion in 2025, including a $1.5B Bybit breach – the largest crypto heist ever recorded
And Chainalysis is clear: that’s a floor, not a ceiling. As more illicit wallet addresses are identified, the total is expected to climb.
The headline figure masks what’s actually driving the surge. Sanctions evasion accounted for the bulk of growth, with funds flowing to sanctioned entities rising 694% to roughly $104 billion. That’s not a market anomaly – it’s a structural shift. Nation-states, primarily Russia, Iran, and North Korea, are no longer just tolerating crypto use within their borders. They’re building financial infrastructure around it.
Russia’s move was particularly brazen. The country launched the A7A5 stablecoin, pegged to the ruble, which processed over $93 billion in transactions before the U.S. and EU moved to sanction it. That’s not a fringe workaround – it’s state-backed financial engineering designed to route around Western pressure.
The Professionalization Problem
What’s changed in recent years isn’t just the scale – it’s the sophistication. Chainalysis describes the current criminal ecosystem as “industrialized,” and the evidence backs that up. Chinese Money Laundering Networks now offer what amount to full-service criminal platforms, providing laundering-as-a-service to bad actors who need to clean funds at scale.
On the fraud side, AI has entered the picture in a meaningful way. Phishing-as-a-service operations now use AI tools to generate highly convincing, personalized impersonation scams. That category grew over 1,400% year-over-year. The barrier to running a sophisticated fraud operation has dropped considerably.
DPRK-linked hackers had their most productive year yet, stealing $2 billion across various operations. The standout was the Bybit breach in February 2025 — $1.5 billion taken in a single incident, making it the largest crypto theft in history. North Korea’s hacking operations have long been understood as a revenue stream for the regime, but the scale now demands a different kind of attention from exchanges and custodians.
What’s Changing on the Ground
Not everything in the report points toward deterioration. DeFi hack losses remained relatively contained compared to the sector’s total value locked, suggesting security practices within protocols have genuinely improved. But that appears to have shifted criminal targeting rather than eliminated it – personal wallets are increasingly in the crosshairs instead.
Physical attacks are also on the rise. So-called “wrench attacks” – where criminals use physical coercion or violence to force victims to hand over wallet access – nearly doubled compared to the prior year. It’s a reminder that the threat landscape isn’t purely digital.
The Window Is Closing
One of the more pressing concerns raised in the report involves timing. Criminals are moving funds faster than ever – often within 48 hours of a scam being executed. That compresses the window for law enforcement and compliance teams to identify suspicious activity, freeze assets, or trace flows before funds disappear into mixers or cross-chain bridges.
The implication is straightforward: manual, reactive compliance processes aren’t built for this environment. The report signals that regulators are likely to take a harder look at custody practices and incident response capabilities, treating them as standard supervisory expectations rather than optional best practices.
Stablecoins, now representing 84% of all illicit transaction volume, will also face increasing regulatory attention. Their dollar-denominated stability makes them the default tool for moving large sums – legitimate or otherwise.
Despite all of this, illicit activity still represents less than 1% of total crypto transaction volume. That statistic has long served as a talking point for the industry. What the 2025 data suggests is that the absolute numbers have grown large enough that the percentage may no longer be the most useful frame.
