- Trending
- Comments
- Latest
Illicit cryptocurrency transactions reached $158 billion in 2025, a 145% increase from the prior year, though they represented a smaller share of the rapidly expanding crypto market, according to blockchain intelligence firm TRM Labs.
The analysis, released in January 2026, shows that while the absolute value of illicit activity surged by 145% year-on-year, its share of total blockchain transactions fell to just 1.2%, down from 1.3% in 2024, underscoring how rapidly legitimate adoption is outpacing misuse.
TRM Labs’ findings point to a widening gap between headline figures and proportional risk. Illicit crypto transactions climbed from $64.5 billion in 2024 to $158 billion in 2025, a jump largely driven by sanctions-related activity, large-scale thefts, and the growing use of stablecoins in underground markets. Yet, in relative terms, these flows made up a smaller slice of the expanding crypto ecosystem.
As stated in the report, “Illicit cryptocurrency transactions reached $158 billion in 2025, according to TRM Labs analysis,” — TRM Labs, Blockchain Intelligence Firm. The firm noted that the declining percentage share reflects the scale at which lawful blockchain activity is growing globally, rather than a sudden disappearance of criminal use.
To add context beyond raw transaction volume, TRM introduced a new metric focused on liquidity. Criminal enterprises were estimated to account for 2.7% of available crypto liquidity in 2025, reframing risk in terms of deployable capital rather than transaction count alone. This approach, the firm said, offers a clearer view of how much capital illicit actors can realistically mobilize at any given time, even as overall markets deepen.
A major contributor to the increase in illicit crypto transactions was sanctions-related activity, which rose more than 400% year-over-year. The growth was dominated by Russia-linked networks, particularly those associated with a ruble-pegged stablecoin known as A7A5.
According to the analysis, “The A7A5 ruble-pegged stablecoin processed more than $72 billion in total volume during 2025,” — TRM Labs, Blockchain Intelligence Firm. Wallet clusters tied to the Russian sanctions evasion network A7 handled at least $39 billion, indicating a high concentration of flows within a relatively narrow set of addresses linked to state-aligned financial infrastructure.
By contrast, Iranian-linked cryptocurrency activity declined slightly, totaling around $10 billion in 2025 compared with $11.4 billion the previous year. Meanwhile, Chinese-language escrow services and underground banking networks processed more than $100 billion, functioning as decentralized hubs for global illicit markets rather than direct extensions of state policy.
TRM Labs attributed part of the increase in detected activity to improved monitoring. The firm highlighted advances in attribution and intelligence sharing through its Beacon Network, a real-time system that allows law enforcement agencies to flag and track addresses connected to financial crime more efficiently than in previous years.
Beyond sanctions evasion, theft and darknet commerce remained central pillars of illicit crypto transactions in 2025. Criminal actors stole an estimated $2.87 billion across nearly 150 hacking incidents during the year. While the number of hacks fell compared to 2024, total losses increased, largely due to a single high-impact breach.
“The Bybit breach alone accounted for $1.46 billion, representing 51% of annual theft totals,” — TRM Labs, Blockchain Intelligence Firm.
This event skewed annual figures and highlighted the growing impact of targeted, high-value attacks.
Attack methods also evolved. Rather than exploiting flaws in smart contracts, sophisticated groups particularly those linked to North Korea increasingly targeted operational infrastructure, including private keys, wallets, and internal control systems.
These infrastructure-focused attacks generated $2.2 billion in losses across 45 incidents, with an average loss of roughly $48.5 million per event.
Darknet marketplaces generated $1.7 billion in incoming volume in 2025, a 20% increase from the previous year. Russian-language platforms accounted for more than 90% of this activity, while stablecoins emerged as the preferred medium due to their liquidity and broad acceptance across exchanges.
Taken together, the data paints a nuanced picture of illicit crypto transactions risk. Absolute volumes are rising, driven by sanctions evasion, concentrated thefts, and professionalized underground networks.
At the same time, the falling percentage share of illicit activity suggests that mainstream adoption, institutional participation, and regulated use cases are expanding even faster.
TRM Labs’ 2025 analysis suggests that future risk assessments will increasingly depend on understanding concentration, liquidity, and network structure rather than headline dollar figures alone.
As monitoring tools improve and global crypto usage grows, the challenge for regulators and law enforcement will be to keep pace with highly adaptive actors operating within an ever-larger digital financial system.
Disclaimer: The information presented in this article is for informational and educational purposes only and does not constitute financial advice. Readers are advised to exercise caution and conduct independent research before taking action related to cryptocurrencies.
