Illegal cryptocurrency addresses received at least $154 billion in 2025. This represents a 162 percent increase compared to the previous year, according to the new Chainalysis Crypto Crime Report. The main driver: a 694 percent surge in transactions with sanctioned entities.
Yet even without this category, 2025 would have set a record. Activity rose across nearly all categories. Still, the share of illegal transactions in total crypto volume remains below one percent. Stablecoins dominate with 84 percent of all illegal transactions, a shift that mirrors the broader trend in the legitimate ecosystem.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
North Korea dominates crypto theft
North Korean hackers stole approximately $2 billion in cryptocurrency in 2025. This accounts for 59 percent of all stolen crypto assets worldwide. The largest single incident: the Bybit hack in February 2025, where attackers stole nearly $1.5 billion in Ethereum. The FBI confirmed that North Korea's Lazarus Group was responsible for the attack.
Bybit's hack ranks as the largest digital theft in crypto industry history. If Bybit were a bank, this would qualify as the largest bank heist of all time. The attackers compromised a developer at multi-signature service provider Safe{Wallet} through social engineering. They then replaced legitimate JavaScript code with malicious software.
Total crypto theft reached $3.4 billion in 2025. North Korea was responsible for 76 percent of all service compromises. The regime increasingly relies on social engineering attacks rather than technical vulnerabilities. This indicates that humans have become the greatest security weakness.
Russia evades sanctions with A7A5 token
The ruble-backed A7A5 token processed transactions worth over $93 billion within one year. The stablecoin launched in Kyrgyzstan in February 2025 and is backed by ruble deposits at the sanctioned Russian Promsvyazbank. By September 2025, the currency became the largest non-dollar stablecoin worldwide.
The connection to sanctioned actors is direct. Ilan Shor, a sanctioned Moldovan oligarch, told President Putin in September 2025 that his A7 platform had processed cross-border transactions worth 7.5 trillion rubles (approximately $89 billion) for Russian companies over ten months.
The US sanctioned the token in August 2025. The EU followed in October with its 19th sanctions package. Since November 2025, all transactions with the stablecoin are banned in the EU. This marks the first time the EU has prohibited a specific cryptocurrency.
AI-powered scams multiply losses
Crypto fraud reached estimated losses of $17 billion in 2025. Chainalysis recorded at least $14 billion in on-chain inflows, a 34 percent increase compared to 2024. The average fraud payment rose from $782 to $2,764, an increase of 253 percent.
AI-powered fraud operations proved 4.5 times more profitable than traditional schemes. Operations with on-chain connections to AI service providers generated an average of $3.2 million per operation. This compares to $719,000 for conventional scams. Daily revenues reached $4,838 versus $518 for traditional operations.
Impersonation scams showed particularly strong growth. Fraudsters posing as government officials while using deepfake technology recorded a 1,400 percent increase compared to the previous year. Chainalysis also identified strong links to criminal syndicates in Southeast Asia. There, human trafficking victims in Cambodia and Myanmar are forced to conduct scams.
Professionalization of criminal infrastructure
The Chainalysis Crypto Crime Report documents increasing professionalization of criminal networks. Chinese money laundering networks now offer "laundering-as-a-service": fully integrated platforms that support ransomware, malware distribution, and fraud operations.
Iranian proxy networks moved over $2 billion through confirmed wallets. Organizations including Hezbollah, Hamas, and the Houthis deployed cryptocurrency at unprecedented scale. The convergence between on-chain activity and physical crime is increasing. This includes connections to human trafficking and physical attacks on crypto holders.
The $154 billion estimate will likely rise. Chainalysis notes that the 2024 figure was revised upward from an initial $40.9 billion to $57.2 billion. The analytics firm identified additional illegal addresses. Still, authorities achieved notable successes. These include the seizure of 61,000 Bitcoin in the UK and a $15 billion confiscation linked to the criminal Prince Group.
