The simultaneous publication of Chainalysis's and TRM Labs' 2026 Crypto Crime Reports has produced the most comprehensive picture yet of cryptocurrency's role in global illicit finance. The headline figure is staggering: illicit cryptocurrency addresses received at least ,...
"The illicit share of crypto transaction volume remains below 1%. But when that fraction translates to $154 billion — more than the GDP of Hungary — the percentage becomes irrelevant. The absolute numbers now demand a geopolitical response."
The simultaneous publication of Chainalysis's and TRM Labs' 2026 Crypto Crime Reports has produced the most comprehensive picture yet of cryptocurrency's role in global illicit finance. The headline figure is staggering: illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase driven almost entirely by nation-state sanctions evasion and the professionalization of AI-enabled fraud networks.
This is no longer a story about teenage hackers or rug-pulled memecoins. The data reveals a structural transformation in how state actors, organized crime syndicates, and increasingly sophisticated fraud rings exploit blockchain infrastructure at industrial scale. Russia's ruble-backed A7A5 stablecoin alone processed over $100 billion in under a year. North Korean operatives stole $1.92 billion across fewer but larger operations. Chinese-language money laundering networks moved $16.1 billion through nearly 1,800 wallets — approximately $44 million per day. And AI-generated deepfake scams proved 4.5 times more profitable than traditional fraud schemes.
For an industry that generates approximately $13.7 billion in legitimate on-chain fee revenue annually, the uncomfortable arithmetic is clear: the crypto economy's illicit value flows now exceed its organic revenue by a factor of eleven. This report examines the economic anatomy of crypto crime in 2025, the structural vulnerabilities it exploits, and the regulatory response now crystallizing across the EU, US, and Asia.
Chainalysis's revised methodology reveals the full dimensions of crypto's illicit economy in 2025[^1]:
| Category | 2024 (Revised) | 2025 | YoY Change | |---|---|---|---| | Total illicit inflows | $57.2B | $154B | +162% | | Sanctions-related flows | $11.6B | $93B | +694% | | Stolen funds (hacks) | $2.2B | $2.87B | +30% | | Scam & fraud revenue | $12B | $14–17B | +17–42% | | Money laundering volume | ~$60B | $82B | +37% |
Three structural shifts define the 2025 landscape:
Sanctions evasion has become the dominant category. The 694% surge in sanctioned-entity inflows — from $11.6 billion to $93 billion — rewrites the composition of crypto crime. This is no longer primarily a fraud or hacking story. It is a geopolitical story in which sovereign states are systematically exploiting blockchain rails to circumvent international financial isolation.
Stablecoins now dominate illicit transactions. Eighty-four percent of all illicit transaction volume in 2025 occurred in stablecoins, reflecting their role as the preferred settlement layer for sanctions evasion, money laundering, and organized fraud[^2]. This is a direct consequence of stablecoins' fungibility, speed, and — critically — their lack of mandatory real-time compliance screening at the protocol level.
The illicit share remains below 1%, but the absolute number has crossed a policy threshold. At $154 billion, illicit crypto flows now exceed the annual GDP of over 130 countries. The "it's less than 1%" defense — while technically accurate — has lost its political utility.
In February 2025, Russia launched A7A5, a ruble-backed stablecoin issued by the Kyrgyzstani company Old Vector but backed by ruble deposits at PSB — a Russian bank sanctioned across multiple jurisdictions[^3]. Within ten months, A7A5 processed over $100 billion in aggregate transaction volume, making it one of the fastest-growing stablecoins in history by throughput, though not by market capitalization.
A7A5 accounted for $72 billion of the $93 billion in total sanctioned-entity inflows in 2025[^4]. It operated as the primary settlement mechanism for a network of successor platforms to the OFAC-sanctioned Garantex exchange, including Grinex, which continued to facilitate Russian cross-border trade in commodities, military procurement, and energy sales.
On August 14, 2025, OFAC designated A7A5, its issuers, and the Grinex platform[^5]. The EU subsequently blacklisted A7A5 in its 19th sanctions package. But the token's architecture — decentralized issuance via a Kyrgyz entity, ruble reserves in a sanctioned bank, and peer-to-peer distribution — demonstrated how stablecoin infrastructure can be purpose-built for sanctions evasion at scale.
TRM Labs attributes $1.92 billion in cryptocurrency theft to DPRK-linked actors in 2025, representing between 64% and 80% of all crypto stolen globally[^6]. The defining event was the $1.46 billion Bybit breach in February 2025, in which Lazarus Group operatives compromised a developer machine at Safe Wallet — the third-party multisig provider used by Bybit — and injected malicious JavaScript into the transaction signing pipeline[^7].
The Bybit attack revealed a fundamental strategic shift. North Korean operatives are no longer primarily hunting for smart contract vulnerabilities. Instead, they target operational infrastructure: key management systems, wallet orchestration layers, and human signers. The attack surface has migrated from code to people.
Post-theft laundering was equally sophisticated. At least $160 million was laundered within 48 hours through mixers, chain-hopping, and fragmented transfers to subcontracted Chinese-language laundering networks[^8]. North Korea's all-time cryptocurrency theft total now stands at $6.75 billion, achieved with 74% fewer known attacks in 2025 than the prior year — suggesting each operation is now more carefully planned and higher-yield.
Chainalysis estimates that crypto fraud generated at least $14 billion in on-chain revenue in 2025, with revised figures potentially reaching $17 billion[^9]. The most significant development was the role of artificial intelligence in amplifying fraud efficiency:
The convergence of pig butchering schemes with AI tooling is particularly alarming. Where traditional romance and investment scams required months of manual relationship building, AI-generated personas can now run multiple concurrent targets with consistent, adaptive communication patterns. The result: higher conversion rates, larger average extractions, and shorter operational cycles.
Separately, a $17 billion figure for total crypto scam and fraud losses in 2025 was cited by CoinDesk, with impersonation and social engineering tactics increasingly augmented by artificial intelligence tools[^11].
Total crypto money laundering reached an estimated $82 billion in 2025[^12]. The dominant force was Chinese-language money laundering networks (CMLNs), which processed $16.1 billion through approximately 1,799 active wallets — roughly $44 million per day[^13].
Chainalysis identified six distinct service types within the CMLN ecosystem:
| Service Type | Function | |---|---| | "Black U" services | Fragment large transactions into small amounts to evade detection thresholds | | OTC desks | Consolidate small transaction fragments into large amounts for fiat off-ramping | | Gambling services | Provide additional layering through gaming platform deposits and withdrawals | | Guarantee platforms | Aggregation points (e.g., Huione, Xinbi) that connect vendors with clients | | Instant exchanges | No-KYC swap services for converting between crypto assets | | Escrow services | Hold funds during multi-party illicit transactions |
The growth trajectory is extraordinary: CMLN activity has expanded 7,325 times faster than illicit inflows to centralized exchanges since 2020. Huione Group — designated by FinCEN as a "primary money laundering concern" — and its guarantee platform Xinbi served as the primary coordination layer, even after Telegram removed some of their channels[^14].
This infrastructure represents a professional, scalable money-laundering-as-a-service economy that operates with the efficiency of a legitimate fintech business.
A CNBC report on February 16, 2026, based on Chainalysis data, revealed that cryptocurrency flows to suspected human trafficking services increased 85% year-over-year in 2025[^15]. The activity spans three categories:
About half of CSAM-related crypto transactions were below $100, reflecting subscription-based payment models in encrypted messaging channels. In July 2025, Chainalysis helped identify one of the largest CSAM dark web operations, which utilized over 5,800 cryptocurrency addresses[^16].
The intersection of human trafficking and crypto crime is now a policy priority. The Southeast Asian scam compound ecosystem — where victims are trafficked, held against their will, and forced to operate fraud schemes — represents perhaps the most morally urgent dimension of crypto's crime economy.
The scale of 2025's illicit flows has triggered the most aggressive regulatory response in crypto's history:
European Union: On February 6, 2026, EU Commission President Ursula von der Leyen proposed a complete ban on all cryptocurrency transactions with Russian entities as part of the bloc's 20th sanctions package, scheduled for adoption on February 24[^17]. This represents a fundamental escalation — from entity-specific blacklisting to a blanket jurisdictional prohibition. The proposal also bans transactions involving Russia's planned digital ruble CBDC. Adoption requires unanimous approval from all 27 member states, with at least three countries having raised concerns[^18].
United States: OFAC sanctioned the A7A5 network in August 2025. FinCEN designated Huione Group as a primary money laundering concern and issued advisories on Chinese-language laundering networks. The FBI formally attributed the Bybit hack to North Korea's TraderTraitor operation[^19].
Cross-border coordination: The emerging pattern is one of regulatory convergence. The EU's MiCA framework, combined with blanket transaction bans, creates a compliance architecture that will force every crypto service provider operating in Europe to implement real-time screening of Russian-linked counterparties — a technical challenge that most exchanges have not yet solved at scale.
The 2026 Chainalysis and TRM Labs crime reports force an uncomfortable reckoning with the economic identity of the blockchain industry. An ecosystem that generates approximately $13.7 billion in legitimate on-chain fee revenue annually now hosts illicit value flows exceeding $154 billion — a ratio that would be considered a systemic risk indicator in any regulated financial system.
The structural problem is not that criminals use crypto. Criminals use every financial system. The problem is the asymmetry between the sophistication of illicit actors and the compliance infrastructure available to counter them. Russia engineered a purpose-built sanctions-evasion stablecoin that processed $100 billion before regulators could act. North Korean operatives compromised a third-party signing infrastructure to steal $1.46 billion in a single transaction. Chinese laundering networks built a $44-million-per-day service economy that grows thousands of times faster than enforcement can respond.
The EU's proposed blanket ban on Russian crypto transactions, if adopted, will mark a watershed moment — the first time a major jurisdiction has attempted to sever an entire nation's cryptocurrency access at the protocol level. Whether this approach succeeds or merely pushes activity into more opaque channels will define the next phase of the crypto-crime regulatory arms race.
For participants in the legitimate crypto economy, the message is clear: the industry's ability to self-regulate its way out of this crisis has been exhausted. The numbers are too large, the state actors too sophisticated, and the human costs too severe for the response to remain voluntary.
[^1]: Chainalysis, "2026 Crypto Crime Report Introduction," January 2026. https://www.chainalysis.com/blog/2026-crypto-crime-report-introduction/
[^2]: Chainalysis, "2026 Crypto Crime Report," January 2026. https://www.chainalysis.com/reports/crypto-crime-2026/
[^3]: TRM Labs, "Garantex, Grinex, and the A7A5 Token: A Deep Dive into Sanctions Evasion Networks," 2025. https://www.trmlabs.com/resources/blog/garantex-grinex-and-the-a7a5-token-a-deep-dive-into-sanctions-evasion-networks
[^4]: Chainalysis, "How A7A5 and Grinex Enable the Russian Shadow Crypto Economy," August 2025. https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/
[^5]: U.S. Department of the Treasury, "Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion," August 2025. https://home.treasury.gov/news/press-releases/sb0225
[^6]: TRM Labs, "2026 Crypto Crime Report," January 2026. https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report
[^7]: NCC Group, "Bybit Hack: In-Depth Technical Analysis," 2025. https://www.nccgroup.com/research-blog/in-depth-technical-analysis-of-the-bybit-hack/
[^8]: TRM Labs, "The Bybit Hack: Following North Korea's Largest Exploit," 2025. https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit
[^9]: Chainalysis, "2026 Crypto Crime Report: Scams," January 2026. https://www.chainalysis.com/blog/crypto-scams-2026/
[^10]: PYMNTS, "Chainalysis Says AI Scams Drove Crypto Fraud up 17% in 2025," January 2026. https://www.pymnts.com/fraud-attack/2026/chainalysis-says-ai-tools-helped-drive-crypto-scam-losses-to-14-billion-in-2025/
[^11]: CoinDesk, "Chainalysis Report Reveals Impersonation and AI Crypto Scams Surpass Cyberattacks," January 2026. https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks
[^12]: Yahoo Finance, "Chainalysis: Crypto Money Laundering Surged to $82 Billion in 2025," January 2026. https://finance.yahoo.com/news/chainalysis-crypto-money-laundering-surged-203126166.html
[^13]: Chainalysis, "The Chinese-language Underground Crypto Money Laundering Ecosystem," January 2026. https://www.chainalysis.com/blog/2026-crypto-money-laundering/
[^14]: Bloomberg, "Chinese Money Laundering Groups Drive Crypto Crime," January 2026. https://www.bloomberg.com/news/articles/2026-01-27/chinese-language-money-laundering-networks-are-driving-crypto-crime-chainalysis
[^15]: CNBC, "Crypto Is Playing a Growing Role in Human Trafficking Networks," February 16, 2026. https://www.cnbc.com/2026/02/16/crypto-payments-stablecoin-growing-role-human-trafficking-csam-networks-chainalysis.html
[^16]: Chainalysis, "Crypto and Human Trafficking: 2026 Crypto Crime Report," February 2026. https://www.chainalysis.com/blog/crypto-human-trafficking-2026/
[^17]: The Block, "European Union Considering Ban on Crypto Transactions with Russia," February 2026. https://www.theblock.co/post/389236/european-union-considering-ban-crypto-transactions-russia-tighten-sanctions-evasion-ft
[^18]: AML Intelligence, "EU Moves to Ban All Russia Crypto Transactions," February 2026. https://www.amlintelligence.com/2026/02/latest-eu-moves-to-ban-all-russia-crypto-transactions/
[^19]: FBI IC3, "North Korea Responsible for $1.5 Billion Bybit Hack," February 2025. https://www.ic3.gov/psa/2025/psa250226