Chainalysis says illicit crypto will reach $154 billion by 2025, driven by sanctioned nation-states using stablecoins and ruble token A7A5, while hacks and scams continue to rise.
Summary
- Illegal addresses received at least $154 billion in 2025, a 162% increase from 2024, as sanctioned entities increasingly moved money onto the chain at scale.
- The Russian ruble-backed A7A5 token processed more than $93.3 billion, while stablecoins made up 84% of illicit volume, even as this activity remained below 1% of total crypto usage.
- PeckShield has recorded 26 major exploits in December and multi-million scams, highlighting persistent security risks despite crypto crime’s relatively small economic share.
Illegal cryptocurrency activity reached record levels in 2025 as sanctioned nation-states and entities increasingly used blockchain networks to circumvent financial restrictions, according to a report released Thursday by blockchain analytics firm Chainalysis.
Illegal crypto addresses received at least $154 billion during the year, up 162% from $59 billion in 2024. report declared. The increase was largely attributed to sanctioned entities moving money up and down the chain on a large scale.
Chainalysis characterized 2025 as a turning point, citing “unprecedented volumes associated with on-chain nation-state behavior” and describing it as the latest phase in the evolution of the illicit crypto ecosystem. The company noted that the scope and coordination of activities differed from previous years, reflecting increasing sophistication among the sanctioned actors.
Chainalysis identifies threat actors
Russia, which has faced extensive international sanctions since the invasion of Ukraine, appeared to be a major contributor to the increase. In February 2025, the country launched a ruble-backed token referred to as A7A5. According to the report, the token processed more than $93.3 billion in transactions in less than a year.
The expansion of sanctions worldwide has increased pressure on sanctioned parties to seek alternative payment systems. The Global Sanctions Inflation Index estimated in May that nearly 80,000 entities and individuals were under sanctions worldwide. Research from the Center for a New American Security found that the United States added 3,135 entities to the Specially Designated Nationals and Blocked Persons List in 2024, the highest annual total on record.
According to Chainalysis, stablecoins accounted for 84% of all illegal transaction volumes by 2025. The company attributed its prevalence to price stability, ease of cross-border transfers and widespread liquidity, noting that the same features that drive legitimate adoption have also attracted sanctioned users.
Despite the sharp increase in illicit volumes, criminal activity remains a small part of the overall crypto economy, Chainalysis reported. Illegal transactions still account for less than 1% of total activity in the chain, although their share has increased slightly year on year.
Blockchain security firm PeckShield documented 26 major exploits in December, with address poisoning scams and private key leaks causing significant losses. One victim lost $50 million after copying a fraudulent address that visually mimicked the intended destination, the company said. Another incident involved a leak of a private key linked to a multi-signature wallet, resulting in losses of approximately $27.3 million.
Brooklyn resident Ronald Spektor is accused of stealing $16 million from about 100 Coinbase users by posing as company employees, according to legal documents.
