- Chainalysis recorded $154 billion in illicit inflows largely driven by sanctioned entities.
- Russia’s ruble-backed A7A5 token processed more than $93.3 billion in transactions within a year.
- Despite rapid growth, illicit activity remained under 1% of on-chain volume.
Illicit cryptocurrency activity expanded sharply in 2025, not primarily because everyday crypto crimes surged, but because structural shifts—particularly sanctioned states and organizations moving funds on-chain—changed how value is transferred.
As global financial regulation has intensified, blockchain networks have increasingly served as alternative channels for cross-border transfers that are harder for traditional systems to block or monitor.
According to a new Chainalysis report, this shift is reshaping the shape, scale, and participants of the illicit crypto ecosystem.
Illicit crypto addresses received at least $154 billion in 2025, a 162% increase from $59 billion in 2024.
Chainalysis attributes much of this growth to sanctioned actors moving large volumes of funds on-chain.
Although illicit activity still accounted for less than 1% of total crypto transactions, its rapid expansion shows sanctions policy is driving new patterns of blockchain use on an unprecedented scale.
Sanctions are pushing activity on-chain
Chainalysis described 2025 as a turning point marked by an unprecedented volume of state-linked activity.
Where earlier phases of crypto crime were dominated by hacks, scams, and darknet markets, recent activity shows greater coordination and technical sophistication.
That reflects growing familiarity with blockchain tools among sanctioned institutions that face restricted access to the global banking system.
The global scope of sanctions has grown sharply.
An estimated global sanctions inflation index in May put the number of sanctioned individuals and entities at roughly 80,000.
Another study from the US-based Center for Security reported that in 2024 the United States added 3,135 entities to its Specially Designated Nationals and Blocked Persons list, the largest annual total on record.
This expanding sanctions environment increases incentives to seek alternative settlement systems.
Russia’s expanding role
One of the most notable drivers of the rise in illicit crypto inflows was Russia, which has faced extensive international sanctions since the invasion of Ukraine.
In February 2025 Russia introduced a ruble-backed digital token called A7A5.
Chainalysis says that token processed more than $93.3 billion in transactions in under a year.
The use of a state-linked token demonstrates how sanctioned governments are using blockchain-based tools to sustain trade and financial connections.
This approach differs from earlier patterns of crypto use in which states indirectly benefited from illicit networks: here, token-based systems are being used in ways that more directly support sanctioned actors’ objectives.
Stablecoins play a central role
Stablecoins dominated illicit crypto activity throughout 2025, accounting for 84% of illicit transaction volume.
Chainalysis links this dominance to stablecoins’ price stability, high liquidity, and ease of cross-border transfer.
Those same characteristics that make stablecoins useful for legitimate payments and remittances—predictable settlement, fungibility, and speed—also make them attractive to sanctioned or otherwise restricted users.
The growing reliance on stablecoins indicates a shift away from volatile assets toward instruments optimized for predictable transfers.
Rather than speculative trading, the focus in many large transfers—especially those involving sanctioned or authorized entities—shifted to efficiency, reliability, and scale.
Criminal share remains small
Despite record illicit volumes, Chainalysis emphasized that criminal activity still represents a small share of the overall crypto economy.
Overall on-chain activity expanded substantially year over year, and illicit transactions remained below 1% of total on-chain volume even as their absolute value climbed sharply.
Alongside sanction-driven inflows, other forms of crypto-related crime persisted.
Blockchain security firm PeckShield recorded more than 20 major exploits in December, including address-poisoning scams and private key leaks that caused losses in the tens of millions of dollars.