The Chainalysis 2026 Crypto Crime Report, whose final chapters were released on February 12–13, 2026, represents the most comprehensive forensic accounting of blockchain-enabled illicit finance ever published. Its central finding is staggering: illicit cryptocurrency addresses received at least $...
The Chainalysis 2026 Crypto Crime Report, whose final chapters were released on February 12–13, 2026, represents the most comprehensive forensic accounting of blockchain-enabled illicit finance ever published. Its central finding is staggering: illicit cryptocurrency addresses received at least $154–158 billion in 2025, a 145–162% increase year-over-year, reversing a multi-year decline that had dropped illicit inflows to $64.5 billion in 2024. This is not a story of scattered bad actors; it is an account of the industrialization of crypto crime at a scale that now rivals the GDP of mid-sized nation-states.
The report identifies three structural forces driving this explosion. First, Russia's A7A5 ruble-backed stablecoin processed $93.3 billion in less than one year, with $72 billion flowing directly to sanctioned entities — single-handedly accounting for the majority of the increase. Second, Chinese-language money laundering networks (CMLNs) processed $16.1 billion in illicit funds across 1,799+ active wallets, operating at $44 million per day and serving as the de facto financial plumbing for scam compounds, ransomware operators, and North Korean hackers. Third, AI-enabled scams generated 4.5 times more revenue per operation than traditional scams, pushing total scam losses to an estimated $17 billion and driving a 1,400% surge in impersonation fraud.
For an industry that generates approximately $13.7 billion in legitimate on-chain fee revenue annually, the fact that illicit flows exceeded $154 billion — more than 11 times the ecosystem's productive economic output — represents the most consequential data point in the economic sustainability debate. This is not a peripheral problem. It is a structural feature of how blockchain networks currently operate at scale.
The headline figure demands context. According to TRM Labs' parallel 2026 Crypto Crime Report, illicit crypto wallets received $158 billion in incoming value in 2025, while Chainalysis places the lower-bound estimate at $154 billion — both representing the highest levels observed in the past five years and a dramatic reversal from the downward trend between 2021 and 2024.[^1][^2]
Historical trajectory of illicit crypto inflows (TRM Labs estimates):
| Year | Illicit Inflows | Change YoY | |------|----------------|------------| | 2021 | $85.9B | — | | 2022 | $75.4B | -12.2% | | 2023 | $73.3B | -2.8% | | 2024 | $64.5B | -12.0% | | 2025 | $158.0B | +145.0% |
The proportional impact tells a more nuanced story. Despite the record dollar amounts, illicit entities captured 2.7% of available crypto liquidity in 2025, down from 2.9% in 2024 and 6.0% in 2023.[^3] In other words, the crypto economy grew faster than its criminal parasites — but the parasites grew far faster than most observers expected.
Critically, stablecoins now account for 84% of all illicit transaction volume, a structural shift away from Bitcoin and Ethereum toward assets that offer dollar-denominated stability, instant settlement, and the ability to operate on low-fee chains like Tron.[^4]
The single largest contributor to 2025's illicit volume explosion was not a hacker collective or a scam ring — it was a state-adjacent financial instrument. The A7A5 token, a ruble-backed stablecoin launched in February 2025 and traded on the Tron and Ethereum blockchains, processed more than $93.3 billion in transactions in under twelve months.[^5]
Of that total, $72 billion flowed directly to sanctioned entities, making A7A5 the most consequential sanctions-evasion vehicle in the history of cryptocurrency.[^6] The token was issued under Kyrgyzstan regulations but backed by ruble deposits held at Promsvyazbank (PSB), a Russian state-owned bank subject to U.S., EU, and UK sanctions.
The A7A5 ecosystem connects directly to Garantex, the previously sanctioned Russian crypto exchange, and its successor platform Grinex. On August 14, 2025, OFAC designated the network's key principals, while FinCEN issued a 311 designation labeling Huione Group a "primary money laundering concern."[^7] The European Commission followed with its 19th sanctions package against Russia in October 2025, imposing a transaction ban on A7A5 and affiliated Kyrgyz firms.[^8]
The implications for the broader crypto ecosystem are severe. A7A5 demonstrates that nation-state actors can construct purpose-built stablecoin infrastructure on public blockchains to circumvent the global financial sanctions regime at a scale ($93 billion annually) that dwarfs the legitimate fee revenue of most Layer-1 networks combined.
The second structural force identified by Chainalysis is the emergence of Chinese-language money laundering networks (CMLNs) as the dominant service layer for global crypto crime. These networks processed $16.1 billion in illicit crypto funds in 2025 — approximately $44 million per day across 1,799+ active wallets — and have handled an estimated 20% of all illicit digital funds over the past five years.[^9][^10]
CMLNs are not ad hoc criminal operations. They are professionalized, full-service enterprises offering laundering-as-a-service, operating primarily through Telegram-based "guarantee platforms" — centralized marketplaces modeled on the Huione Guarantee framework that provide escrow, dispute resolution, and trust mechanisms for criminal transactions.[^11]
The root cause is structural: China's capital controls create enormous demand from wealthy individuals seeking to move funds offshore. This capital flight provides the liquidity pool that criminal organizations exploit. As CNBC reported, the networks have become "an unforeseen consequence of the imposition of capital controls in China," with legitimate offshore capital demand and criminal laundering infrastructure becoming functionally inseparable.[^12]
The Huione Guarantee marketplace itself — tied to the Cambodian conglomerate Huione Group — processed more than $49 billion in cryptocurrency since 2021 before being shuttered following FinCEN's designation. But the model has proliferated: similar guarantee platforms have spawned across Southeast Asia, creating a resilient, distributed laundering infrastructure that no single enforcement action can dismantle.[^13]
The Chainalysis scams chapter, published in January 2026, documents how artificial intelligence has fundamentally transformed the economics of crypto fraud. Total scam losses reached an estimated $17 billion in 2025, with AI-enabled operations generating 4.5 times more revenue per operation than traditional scams — $3.2 million per operation versus $719,000 without AI tooling.[^14]
The most alarming metric is the 1,400% year-over-year growth in impersonation fraud, driven by AI-generated deepfakes, synthetic voice cloning, and automated social engineering at scale. The average scam payment rose to $2,764, up 253% from $782 in 2024.[^15]
The industrialization is evident in the supply chain. On the Huione marketplace, AI service providers were among the most successful vendors, with revenue growing 1,900% year-over-year in 2024 — a trend that accelerated through 2025. The "Darcula" phishing operation, attributed to a Chinese group known as the "Smishing Triad," sent as many as 330,000 fraudulent texts in a single day targeting U.S. residents with fake E-ZPass toll alerts, using phishing kits that cost less than $500.[^16]
This represents a paradigm shift: the marginal cost of running a sophisticated scam operation has collapsed to near zero, while the revenue per victim has nearly quadrupled. The economic equilibrium is moving decisively in favor of attackers.
North Korea-linked hackers stole at least $2.02 billion in cryptocurrency in 2025, accounting for 76% of all service compromises and bringing the cumulative DPRK crypto theft total to $6.75 billion.[^17] The operational tempo has accelerated to one attack every 20 days on average, suggesting a mature, institutionalized financial pipeline rather than sporadic theft.
The February 2025 Bybit exploit — the largest digital heist in history at $1.5 billion — accounted for nearly three-quarters of North Korea's annual haul. The attack, attributed to the TraderTraitor cluster within the Lazarus Group, compromised Safe{Wallet}'s multi-signature infrastructure by injecting malicious JavaScript through a developer's compromised machine.[^18] The FBI officially attributed the attack to North Korea on February 26, 2025.[^19]
What makes the DPRK threat unique is its end-to-end integration: state-sponsored hackers steal the assets, then launder them through cross-chain bridges, decentralized exchanges, and no-KYC swap services. By March 2025, Bybit CEO Ben Zhou reported that 86.29% of the stolen ETH had already been converted to BTC and dispersed across thousands of wallets.[^20]
For an ecosystem that positions itself as a secure alternative financial system, the reality that a single nation-state actor can extract $2 billion annually while converting and laundering the proceeds on public blockchains represents a fundamental failure of the security model.
The most disturbing chapter of the 2026 report, published on February 12–13, documents an 85% year-over-year increase in cryptocurrency flows to suspected human trafficking services. The intersection encompasses forced labor compounds in Southeast Asia — notably Cambodia's KK Park and similar operations in Myanmar — where kidnapped victims are coerced into operating pig butchering scams and romance fraud schemes.[^21]
Chainalysis identifies four trafficking categories using crypto: "international escort" services, "labor placement" agents facilitating kidnapping, prostitution networks, and the distribution of child sexual abuse material (CSAM). Telegram-based escort services show sophisticated integration with CMLNs, with nearly half of transactions exceeding $10,000.[^22]
The U.S. Department of Justice unsealed charges against Prince Group chairman Chen Zhi for allegedly overseeing Cambodian forced-labor scam compounds. Stablecoins — particularly Tether on Tron — have become the dominant payment method, while Bitcoin usage has waned.[^23]
This nexus — where scam infrastructure, money laundering networks, forced labor, and cryptocurrency converge — represents the darkest dimension of the blockchain economy. The on-chain transparency that makes this activity traceable is also the transparency that confirms its massive, documented scale.
When examined through webthreepedia's economic value framework, the Chainalysis data introduces a dimension that most crypto analysis deliberately ignores. The blockchain ecosystem generates approximately $13.7 billion in legitimate on-chain fee revenue annually. Illicit flows in 2025 exceeded $154 billion — more than 11 times the ecosystem's productive output.
This does not mean that most crypto activity is criminal. The 2.7% capture rate suggests that the vast majority of on-chain volume is legitimate. But it does mean that the absolute scale of illicit activity on blockchain rails is now larger than the annual revenue of all but a handful of Fortune 500 companies.
The stablecoin dimension is particularly significant. With 84% of illicit volume flowing through stablecoins, the GENIUS Act's stablecoin regulatory framework and the ongoing yield-versus-compliance debate take on new urgency. Every stablecoin issuer must now grapple with the fact that their tokens are the preferred medium of exchange for nation-state sanctions evasion, organized crime laundering, and human trafficking payments.
The economic sustainability question becomes: can an industry that generates $13.7 billion in legitimate revenue sustain the reputational, regulatory, and compliance costs of enabling $154 billion in illicit flows? The answer will likely be determined not by market forces, but by political ones.
$154–158 billion in illicit crypto inflows in 2025, a 145–162% increase YoY, reversing a multi-year decline and setting a new all-time record.
Russia's A7A5 stablecoin processed $93.3 billion in under one year, with $72 billion flowing to sanctioned entities — single-handedly driving the majority of the increase.
Chinese money laundering networks processed $16.1 billion ($44M/day) across 1,799+ wallets, serving as the financial plumbing for scam compounds, ransomware, and state-sponsored theft.
AI-enabled scams generated 4.5x more revenue per operation ($3.2M vs. $719K), pushing total scam losses to $17 billion with a 1,400% surge in impersonation fraud.
North Korea's Lazarus Group stole $2.02 billion (76% of all service compromises), including the $1.5 billion Bybit exploit — the largest digital heist in history.
Human trafficking crypto flows surged 85% YoY, with stablecoins becoming the dominant payment method for forced labor compounds and trafficking networks across Southeast Asia.
Stablecoins account for 84% of all illicit transaction volume, making stablecoin regulation the frontline of crypto crime enforcement.
Despite record absolute volumes, illicit entities captured 2.7% of available crypto liquidity — down from 6.0% in 2023 — indicating that legitimate usage is growing faster, but the criminal infrastructure is scaling in parallel.
The Chainalysis 2026 Crypto Crime Report demolishes the comfortable narrative that crypto crime is a diminishing, manageable side effect of financial innovation. The $154–158 billion in illicit flows documented for 2025 represents a step-function increase driven by the convergence of three forces that did not exist at this scale two years ago: purpose-built state sanctions-evasion infrastructure (A7A5), professionalized laundering-as-a-service networks (CMLNs), and AI-industrialized fraud operations.
The crypto industry's standard response — that illicit activity represents a small percentage of total volume — is technically accurate (2.7%) and strategically irrelevant. Regulators, legislators, and law enforcement do not think in percentages. They think in absolute dollar amounts, victim counts, and geopolitical consequences. When those numbers include $72 billion in sanctions evasion for a nuclear-armed adversary and an 85% increase in human trafficking payments, the political response will be proportionate to the scale, not the ratio.
The blockchain's transparency — the same property that enables Chainalysis to produce this report — remains both the industry's greatest forensic asset and its most uncomfortable mirror. Every transaction documented in this report is, by definition, traceable. The question is no longer whether the data exists, but whether the institutional will to act on it can match the velocity at which criminal infrastructure evolves. The evidence from 2025 suggests that it cannot — at least not yet.
[^1]: Chainalysis, "2026 Crypto Crime Report Introduction," January 2026. https://www.chainalysis.com/blog/2026-crypto-crime-report-introduction/ [^2]: TRM Labs, "2026 Crypto Crime Report — Key Insights: Record $158 Billion in Illicit Crypto Flows," February 2026. https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline [^3]: The Block, "Illicit actors capture nearly 3% of crypto liquidity in 2025: TRM," February 2026. https://www.theblock.co/post/387453/illicit-actors-capture-nearly-3-of-crypto-liquidity-in-2025-trm [^4]: The Block, "Crypto crime topped $150 billion in 2025 as state-backed actors scaled onchain," January 2026. https://www.theblock.co/post/384753/crypto-crime-150-billion-usd-2025-state-actors-scale-onchain-chainalysis [^5]: Chainalysis, "How A7A5 and Grinex Enable the Russian Shadow Crypto Economy," August 2025. https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/ [^6]: DL News, "How a Russian stablecoin drove a 400% surge in sanction-dodging crypto activity," 2025. https://www.dlnews.com/articles/regulation/how-ruble-stablecoin-a7a5-drove-a-surge-in-sanction-dodging/ [^7]: CoinDesk, "OFAC Sanctions Crypto Network Behind Ruble-Backed Stablecoin and Shuttered Exchange Garantex," August 2025. https://www.coindesk.com/policy/2025/08/14/ofac-sanctions-crypto-network-behind-ruble-backed-stablecoin-and-shuttered-exchange-garantex [^8]: Elliptic, "EU sanctions against A7A5 and Payeer come into effect," October 2025. https://www.elliptic.co/blog/eu-sanctions-against-a7a5-and-payeer-come-into-effect [^9]: Chainalysis (@chainalysis), Twitter/X, "Chinese-language money laundering networks processed $16.1 billion in illicit crypto funds in 2025," February 2026. https://x.com/chainalysis/status/2016131602158440499 [^10]: CNBC, "Chinese organized crime networks moved $16 billion in crypto in 2025, according to report," February 2, 2026. https://www.cnbc.com/2026/02/02/chinese-money-laundering-networks-crypto-telegram-2025-chainalysis-scam-southeast-asia-cambodia.html [^11]: Security Boulevard, "Fast-Growing Chinese Crime Networks Launder 20% of Illicit Crypto," February 2026. https://securityboulevard.com/2026/02/fast-growing-chinese-crime-networks-launder-20-of-illicit-crypto-chainalysis/ [^12]: Bloomberg, "Chinese Money Laundering Groups Drive Crypto Crime, Chainalysis Finds," January 27, 2026. https://www.bloomberg.com/news/articles/2026-01-27/chinese-language-money-laundering-networks-are-driving-crypto-crime-chainalysis [^13]: DL News, "Chainalysis reports on Southeast Asia's $49bn crypto crime marketplace," 2025. https://www.dlnews.com/articles/people-culture/chainalysis-says-platform-used-for-illicit-crypto-activities/ [^14]: Chainalysis, "2026 Crypto Crime Report: Scams," January 2026. https://www.chainalysis.com/blog/crypto-scams-2026/ [^15]: Decrypt, "AI, Impersonations Drove Crypto Scam Losses to Record $17 Billion in 2025: Chainalysis," January 2026. https://decrypt.co/354624/ai-impersonation-drove-crypto-scam-losses-record-17-billion-2025-chainalysis [^16]: CoinDesk, "Chainalysis Report Reveals Impersonation and AI Crypto Scams Surpass Cyberattacks," January 14, 2026. https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks [^17]: The Hacker News, "North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft," December 2025. https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html [^18]: NCC Group, "Bybit Hack: In-Depth Technical Analysis," 2025. https://www.nccgroup.com/research-blog/in-depth-technical-analysis-of-the-bybit-hack/ [^19]: FBI IC3, "North Korea Responsible for $1.5 Billion Bybit Hack," February 26, 2025. https://www.ic3.gov/psa/2025/psa250226 [^20]: Wilson Center, "The Bybit Heist: What Happened & What Now?" 2025. https://www.wilsoncenter.org/article/bybit-heist-what-happened-what-now [^21]: Chainalysis, "Crypto and Human Trafficking: 2026 Crypto Crime Report," February 12, 2026. https://www.chainalysis.com/blog/crypto-human-trafficking-2026/ [^22]: CryptoTimes, "Crypto's use in Suspected Human Trafficking Surge 85% YoY: Chainalysis," February 13, 2026. https://www.cryptotimes.io/2026/02/13/cryptos-use-in-suspected-human-trafficking-surge-85-yoy-chainalysis/ [^23]: BeInCrypto, "Is Crypto Becoming a Tool for Human Trafficking Networks?" February 2026. https://beincrypto.com/crypto-human-trafficking-flows-chainalysis-report/