National-level players enter the scene, interpreting the out-of-control and changing landscape of crypto crimes in 2025

Written by: Chainalysis

Compiled by: Chopper, Foresight News

In 2025, we observed a significant increase in country-level cryptocurrency-related activities, marking a new stage of maturity in the development of illegal on-chain ecosystems. Over the past few years, the professionalism within the crypto crime sector has continued to deepen; illegal organizations have established large-scale on-chain infrastructure to support cross-border criminal networks in procuring goods and services, as well as laundering illicit crypto proceeds. Against this backdrop, governments worldwide have also begun to engage in this field, leveraging these mature professional service providers on one hand, and building customized infrastructure on the other to evade sanctions at scale. As governments integrate into this illegal crypto supply chain originally designed for cybercriminals and organized crime groups, agencies, compliance, and security teams now face severe challenges in consumer rights protection and national security.

What specific manifestations do these trends and other industry changes have on the blockchain? Next, we will analyze these developments in conjunction with data and macro trends.

According to our monitoring data, the inflow of funds into illegal crypto addresses in 2025 reached at least $154 billion, a 162% year-over-year surge. This growth was mainly driven by a sharp increase in funds flowing into sanctioned entities, which saw a 694% YoY rise. Even excluding the growth from sanctioned entities, 2025 remains a record year for crypto crime, as most categories of illegal activities experienced growth.

Nevertheless, these illegal transaction volumes remain small compared to the overall crypto economy, with legitimate transactions still dominating the market. We estimate that in 2025, illegal transactions accounted for slightly more than 1% of the total traceable crypto transaction volume, a slight increase from 2024.

As shown in the chart below, we also observe a continuous shift in the types of assets involved in crypto crime.

Over the past few years, stablecoins have gradually become the dominant assets in illegal transactions, now accounting for 84% of total illegal transaction volume. This trend aligns with the overall development characteristics of the crypto ecosystem: with advantages such as ease of cross-border transfers, low volatility, and broad application scenarios, stablecoins continue to expand their share in the entire crypto trading landscape.

The following will delve into several core trends that define the crypto crime landscape in 2025, which remain important to monitor in the future.

National-level threats drive up transaction volumes: North Korea’s thefts hit new highs, Russia’s A7A5 tokens aid large-scale sanctions evasion

In 2025, stolen funds remain a major threat to the crypto ecosystem, with North Korea-related hacking groups alone stealing $2 billion. This figure is mainly driven by several highly destructive large-scale hacking incidents, most notably the attack on the Bybit exchange in February. The incident involved nearly $1.5 billion, making it the largest digital asset theft in crypto history. Although North Korean hackers have long been a primary threat to the crypto ecosystem, in the past year, both the amount stolen and the sophistication of intrusion and money laundering methods have set new records.

Of particular concern is that in 2025, the scale of on-chain activities by governments reached unprecedented levels. Russia enacted relevant legislation in 2024 to promote the use of cryptocurrencies to evade sanctions, and this move was officially implemented in February 2025. The country launched a ruble-backed token, A7A5, which, less than a year after its launch, surpassed $93.3 billion in trading volume.

Meanwhile, over the past few years, Iran’s proxy networks have engaged in money laundering, illegal oil trading, and bulk weapons procurement on-chain through wallets listed on sanctions lists, with total transactions exceeding $2 billion. Despite multiple military strikes, Iran-backed terrorist organizations such as Hezbollah, Hamas, and Houthi forces continue to use cryptocurrencies on an unprecedented scale.

In 2025, China’s money laundering networks emerged as dominant players in the illegal on-chain ecosystem. These organizations operate with sophisticated models, greatly advancing the diversification and professionalization of crypto crime, providing various specialized criminal services including “money laundering.” Based on early illegal operational models like “correspondent banking guarantees,” they have built comprehensive criminal enterprises offering a full range of services, covering fraud, scams, laundering stolen funds from North Korean hackers, evading sanctions, and funding terrorism.

Full-stack illegal infrastructure providers fuel malicious cyber activities

As governments intensify their use of cryptocurrencies, traditional cybercrime activities remain rampant: ransomware operators, child sexual abuse and cybercrime platforms, malware distributors, scammers, and illegal trading markets still rely on extensive support networks to sustain operations. Criminal actors and governments are increasingly dependent on on-chain infrastructure providers capable of offering full-stack services, including domain registrars, secure hosting services, and other technical infrastructure for malicious cyber activities.

These infrastructure providers have evolved into comprehensive platforms capable of resisting platform takedowns, abuse complaints, and law enforcement sanctions. As these services continue to expand, they may become key drivers in the growth of economic crimes and the expansion of malicious activities by state-supported forces.

The link between cryptocurrencies and violent crime is strengthening

Many still perceive crypto crime as confined to the virtual world. The masterminds behind these crimes are seen as anonymous keyboard warriors unlikely to pose real-world threats. However, the connection between on-chain activities and violent crime is deepening. Human trafficking groups increasingly use cryptocurrencies for transactions; alarmingly, cases of violent extortion attacks are rising sharply, with criminals forcing victims to transfer crypto assets through violence, often during crypto price peaks.

Looking ahead, cooperation between law enforcement, regulators, and crypto companies will be crucial in addressing these complex, intertwined threats. Although illegal transactions still represent a small proportion of total legitimate crypto trading volume, maintaining the integrity and security of the crypto ecosystem has never been more important.