- Chainalysis recorded $154 billion in illicit inflows in 2025, driven largely by sanctioned entities.
- Russia’s ruble-backed A7A5 token handled over $93.3 billion in transactions within a year.
- Illicit transactions remained under 1% of total on-chain activity despite rapid growth.
Illicit cryptocurrency activity surged in 2025 not because ordinary crypto crime suddenly spiked, but due to a structural shift in how sanctioned states and entities route funds. As global financial restrictions expanded, blockchains became an alternative channel for cross-border transfers that are harder to block or monitor compared with traditional systems.
A new report from Chainalysis shows this shift is reshaping the scale, participants, and mechanics of the illicit crypto ecosystem. Chainalysis estimates illicit crypto addresses received at least $154 billion during 2025, up 162% from $59 billion in 2024. Much of that growth is attributed to sanctioned actors moving funds on-chain at scale.
Although illicit activity still represents less than 1% of overall crypto transactions, its rapid expansion highlights how sanctions policy is driving new patterns of blockchain use that differ from past years.
Sanctions push activity on-chain
Chainalysis characterizes 2025 as a turning point, driven by unprecedented volumes tied to nation-state behavior. Where earlier phases of crypto crime were dominated by hacks, scams, and darknet marketplaces, recent flows display greater coordination and technical sophistication. This reflects growing familiarity with blockchain tools among sanctioned actors who face restricted access to the global banking system.
The scope of sanctions has widened significantly. The Global Sanctions Inflation Index estimated in May that nearly 80,000 individuals and entities are currently subject to sanctions. Additional research found that the United States added a record number of entities to its Specially Designated Nationals and Blocked Persons List in 2024, increasing incentives to seek alternative settlement systems.
Russia’s growing role
Russia emerged as a prominent contributor to the rise in illicit crypto flows after extensive international sanctions following its invasion of Ukraine. In February 2025, Russia introduced a ruble-backed digital token known as A7A5. Chainalysis reports the token processed more than $93.3 billion in transactions in under a year.
The emergence of a state-linked token shows how sanctioned governments are experimenting with blockchain-based instruments to preserve trade and financial connections. This activity differs from prior patterns where states were typically indirect beneficiaries of illicit networks; now some sanctioned actors are directly participating in token-based systems.
Stablecoins take centre stage
Stablecoins dominated illicit crypto activity in 2025, accounting for 84% of total illicit transaction volume. Chainalysis links this dominance to stablecoins’ price stability, high liquidity, and ease of cross-border transfer. Those same properties that make stablecoins useful for legitimate payments and remittances also make them attractive to sanctioned users seeking predictable, fast settlement.
The shift toward stablecoins marks a move away from volatile assets for illicit transfers. Instead of speculative trading, the emphasis is on efficiency, reliability, and scale—particularly for large-value transactions involving sanctioned entities.
Crime remains a smaller share
Despite record illicit volumes, Chainalysis emphasizes that criminal activity still represents a small portion of the overall crypto economy. On-chain activity grew substantially in 2025, keeping illicit transactions below 1% of total volume even as their absolute value rose sharply.
Traditional forms of crypto-related crime continued alongside sanctions-driven flows. Blockchain security firm PeckShield documented more than 20 significant exploits in December, including address-poisoning scams and private-key leaks that resulted in losses totaling tens of millions of dollars.