- Trending
- Comments
- Latest
Crypto crime reached a record $158 billion in illicit cryptocurrency inflows in 2025, up from $64.5 billion in 2024, according to blockchain intelligence firm TRM Labs.
Data published in a report by Trader Edge on October 12, 2026, drawing on research from TRM Labs, Chainalysis and INTERPOL, highlights the growing scale of cryptocurrency-related fraud, hacking, sanctions evasion and money laundering.
The increase came despite a decline in illicit activity as a proportion of the broader cryptocurrency market. Major sanctions-related flows, large-scale hacks and improvements in blockchain transaction attribution contributed to the higher dollar total.
The findings also point to changing criminal methods, including artificial intelligence-assisted scams, professionalized fraud networks and the use of stablecoins to move illicit funds across borders.
TRM Labs estimates that illicit cryptocurrency wallets received $158 billion in 2025, the highest annual total in five years. The figure marks a sharp reversal after illicit inflows declined from $85.9 billion in 2021 to $64.5 billion in 2024.
However, the increase does not necessarily mean criminal activity expanded at the same rate across the entire cryptocurrency market.
TRM Labs estimates that illicit transactions represented 1.2% of attributed on-chain volume in 2025, down from 1.3% in 2024 and 2.4% in 2023. The proportion of available cryptocurrency liquidity reaching illicit actors also declined, falling from 6% in 2023 to 2.7% in 2025.
The distinction matters because absolute transaction values can increase as the cryptocurrency market expands, even when the proportion associated with illicit activity falls.
TRM Labs also cautions that its estimates can change as investigators identify additional wallets connected to criminal activity. The firm previously revised its estimate for 2023 from $34.8 billion to more than $58 billion as new information became available.
Changes to its methodology also mean historical figures may differ from earlier reports.
Sanctions-related activity recorded the steepest increase among the categories examined, with inflows rising by more than 400% between 2024 and 2025. Inflows involving blocklisted entities increased by 32%, while hacked or stolen funds rose by 31%.
The figures suggest that cryptocurrency crime is becoming increasingly difficult to assess through transaction totals alone. Researchers must also account for the size of the market, changes in wallet attribution and the concentration of illicit activity in a relatively small number of large transactions.
Cryptocurrency scams remained a major source of illicit revenue in 2025, although estimates vary according to how researchers define and measure fraud.
Chainalysis estimates that cryptocurrency scams and fraud generated approximately $17 billion in losses during the year. TRM Labs recorded around $35 billion in inflows to fraud schemes, including $23 billion in verified fraud and $12 billion associated with community complaints.
The figures are not directly comparable because the firms use different methodologies and categories.
Chainalysis also found that the average payment to a cryptocurrency scam increased from $782 in 2024 to $2,764 in 2025, a rise of approximately 253%.
Investment scams accounted for 62% of fraud inflows tracked by TRM Labs. The firm also recorded $6.1 billion in inflows to pyramid and Ponzi schemes, representing a 49% increase.
Artificial intelligence is adding another dimension to the threat.
According to Chainalysis, scams with on-chain connections to AI service providers generated an average of $3.2 million per operation, compared with $719,000 for scams without identified AI links. That amounts to approximately 4.5 times more revenue per operation.
TRM Labs reported that AI-enabled scam activity increased by about 500% over the previous year. These findings suggest that AI tools may help criminals produce more convincing messages, impersonate legitimate organizations and scale fraudulent campaigns.
Impersonation scams also expanded sharply. Chainalysis reported an increase of more than 1,400% in these scams from 2024, while the average payment rose by more than 600%.
The criminal infrastructure supporting such operations is increasingly organized. Fraud campaigns can involve separate developers, data brokers, spammers, money launderers and administrators, allowing participants to specialize in different stages of the operation.
Ready-made phishing tools further lower the barrier to entry. Chainalysis found that scams using phishing kits were 688 times more effective in dollar terms than conventional scams.
The figures underline how cryptocurrency fraud increasingly relies on coordinated networks rather than isolated individuals. They also highlight the difficulty of protecting victims when criminals can rapidly adapt their methods and move funds between services.
Hackers stole approximately $2.87 billion across nearly 150 cryptocurrency incidents in 2025, according to TRM Labs. Losses were heavily concentrated in a handful of attacks, particularly the February breach of cryptocurrency exchange Bybit.
The Bybit incident accounted for approximately $1.46 billion, or 51% of the year’s reported hacking losses. Without that breach, total losses would have been around $1.4 billion.
Infrastructure attacks, which target private keys, wallets and access controls, accounted for approximately $2.2 billion in losses, representing 76% of the total. Code exploits caused about $350 million in losses, while protocol attacks accounted for another $277 million.
TRM Labs attributed $1.92 billion in cryptocurrency thefts during 2025 to North Korea-linked actors.
The concentration of losses highlights the importance of protecting wallet access, private keys and internal systems alongside auditing smart contracts. Security measures such as hardware-backed key storage, withdrawal limits and stronger controls over developer environments can help reduce exposure to infrastructure attacks.
Sanctions evasion was another major driver of illicit cryptocurrency flows.
TRM Labs estimates that $93 billion flowed to sanctioned entities and jurisdictions in 2025, with Russia-linked networks accounting for much of the activity. The ruble-pegged stablecoin A7A5 processed more than $72 billion, while a wallet cluster associated with the A7 network was linked to approximately $39 billion.
Nearly 95% of inflows to sanctioned entities involved stablecoins, according to the report.
The data also indicates that illicit actors are shifting how they move money. Flows through centralized exchanges fell by nearly 30% between 2024 and 2025, while flows through high-risk services and platforms that do not require customer identity verification rose by more than 200%.
These changes complicate efforts to identify and freeze illicit assets, particularly when funds move through multiple jurisdictions and services.
Authorities increased enforcement efforts in 2025 and 2026, targeting cryptocurrency theft, fraud networks and the services used to launder criminal proceeds.
In the United Kingdom, police recovered more than 61,000 bitcoin connected to a fraud operation run by Zhimin Qian, who was sentenced to 11 years and eight months in prison. The scheme affected more than 128,000 victims in China.
In the United States, proceedings against Prince Group chairman Chen Zhi included efforts to seize more than $15 billion linked to alleged scam activity. The U.S. Office of Foreign Assets Control and the United Kingdom also sanctioned 146 targets connected to the group.
Authorities have also pursued services used to move and conceal illicit funds. German and Swiss authorities seized the Cryptomixer service and approximately 12 terabytes of data, while Canadian authorities took down the TradeOgre exchange in what was described as the country’s largest cryptocurrency seizure.
INTERPOL’s 2026 threat assessment points to increased international cooperation. Fraud-related notices and diffusions rose by 54% from 2024, while the organization supported more than 1,500 cross-border fraud cases involving $1.1 billion in lost assets.
Investigators are also confronting the human cost of large-scale fraud. Chainalysis links much of the scam economy to compounds in Cambodia and Myanmar, where trafficking victims are forced to participate in fraudulent operations.
INTERPOL has warned that scam centers are no longer confined to one region, with operations found worldwide and hundreds of thousands of people involved, including trafficking victims.
Money laundering networks have also adapted to enforcement pressure. After action against Huione, activity shifted toward other services, demonstrating how shutting down one platform can disrupt criminal operations without necessarily eliminating the underlying networks.
The broader findings present a complicated picture. Cryptocurrency-related crime generated record illicit inflows in 2025, but illicit activity accounted for a smaller share of attributed market volume and available liquidity than in previous years.
Major hacks, sanctions-linked transactions and increasingly sophisticated scams contributed to the rise. Meanwhile, international investigations, wallet-level sanctions and asset seizures are making it more difficult for some criminal networks to cash out.
The challenge for authorities is to sustain that pressure as criminal groups move between platforms, adopt new technologies and exploit differences in national regulation.
Copyright © 2025 - The Bit Gazette.
