After three consecutive years of decline, illicit crypto activity rebounded sharply in 2025. Covered in the newly released 2026 Crypto Crime Report, TRM’s analysis identified USD 158 billion in incoming value to illicit entities — an all-time high — driven by a mix of sanctions designations, nation-state adoption of crypto rails, and improved attribution that surfaced previously unattributed activity. Even as absolute illicit volume rose, illicit activity as a share of total attributed on-chain volume fell from 1.3% (2024) to 1.2% (2025), reinforcing a key reality: crypto is bigger and more integrated than ever, and illicit activity remains a minority of total activity. But “percent of total volume” can obscure the real risk picture.
That’s why this year, TRM is introducing a new lens: illicit activity relative to incoming liquidity. This frames risk against deployable capital, rather than raw transaction volume. In 2025, illicit entities captured 2.7% of incoming VASP liquidity (down from 2.9% in 2024 and 6.0% in 2023). It’s a clearer way to answer the question institutions actually care about: how much usable capital is flowing to illicit actors?
Sanctions activity surged — and was overwhelmingly Russia-linked. Sanctions-related crypto activity in 2025 was dominated by Russia-linked flows, largely due to the growth of the ruble-pegged stablecoin A7A5 (over USD 72B in total volume). TRM also linked the A7 wallet cluster to at least USD 39 billion in 2025 — highly concentrated activity consistent with coordinated sanctions evasion and state-aligned financial infrastructure, not broad market usage. Geopolitics moved on-chain.
2025 marked a shift from crypto as an “option” to crypto as durable infrastructure for sanctioned economies and intermediaries. Iran and Venezuela relied on crypto rails for sanctions-constrained payments and services at scale, while Chinese-language escrow and money laundering networks processed over USD 100 billion, operating as critical settlement infrastructure for global illicit markets. Hacks hit USD 2.87 billion — and operational compromise dominated. Illicit actors stole USD 2.87 billion across nearly 150 hacks in 2025.
The year was defined by one catastrophic event: the Bybit breach accounted for USD 1.46 billion (51%) of total losses. More broadly, adversaries “moved up the stack”: infrastructure attacks (keys, wallets, access control planes) drove the majority of losses, outpacing smart contract exploits. Scams stayed massive — and got more scalable. TRM observed roughly USD 35 billion sent to fraud schemes in 2025.
The fraud landscape continued to professionalize, with scam networks operating like businesses and AI tools accelerating impersonation and outreach, contributing to a sharp rise in AI-enabled scam activity. Stablecoins remained the primary rail, making up 84% of verified fraud inflows. The laundering economy matured into high-throughput settlement infrastructure. In 2025, over USD 60 billion left illicit wallets and flowed into services.
A key theme: laundering is increasingly visible as a downstream ecosystem — brokers, escrow services, and repeatable settlement hubs — rather than a single “cash-out” event. Enforcement actions and platform disruption reshaped flows, but the underlying escrow model proved resilient through migration and rebranding. This report includes two major methodological updates designed to make risk more interpretable in mature markets. Together, these changes help contextualize how illicit actors participate in crypto markets — not just how much they transact, but how much usable capital they absorb.
Leave a Reply