Key Insights
- Illicit flows reached $154 billion in 2025, up 162%.
- North Korea stole $2 billion with the Bybit hack, totaling $1.5 billion.
- Russia’s A7A5 token processed $93.3 billion in under one year.
Crypto news from Chainalysis revealed illicit cryptocurrency addresses received at least $154 billion in 2025. This was a 162% increase year-over-year.
The surge was driven by a 694% increase in value received by sanctioned entities. Nation-state activity rose as governments tapped into professionalized service providers.
Crypto News Shows Illicit Flows Reach $154B in 2025
Crypto news reports that Chainalysis tracked rising nation-state activity. The data shows notable increases in such involvement. Illicit organizations now operate large-scale on-chain infrastructure. This helps transnational criminal networks procure goods and services and launder ill-gotten crypto.
Nation-states plugged into illicit crypto supply chains originally built for cybercriminals and organized crime groups.
The $154 billion figure is a lower-bound estimate based on illicit addresses identified to date. The total will increase as more illicit addresses are identified and historical activity is incorporated.
When Chainalysis published last year’s report, 2024 totals stood at $40.9 billion. One year later, the updated estimate for 2024 reached $57.2 billion.
Even if the value received by sanctioned entities were flat year-over-year, 2025 would still mark a record year for crypto crime. Activity increased across most illicit categories.
Stablecoins now account for 84% of all illicit transaction volume. Practical benefits include easy cross-border transferability, lower volatility, and overall utility.
Crypto News: North Korea Steals $2B as Nation-State Threats Escalate
Crypto news reported that North Korean hackers stole $2 billion in 2025. This marked their most destructive year to date. Devastating mega-hacks drove the total, most notably the February Bybit exploit.
The Bybit hack reached nearly $1.5 billion and was the largest digital heist in crypto history. Stolen funds remained a major threat to the ecosystem throughout 2025. DPRK-linked hackers have long been a fixture of the threat.
Iran’s proxy networks continued aiding money laundering, illicit oil sales, and procurement of arms and commodities on-chain. Confirmed wallets identified in sanctions designations showed $2+ billion in activity over several years.
Iran-aligned terrorist organizations, including Lebanese Hezbollah, Hamas, and the Houthis, used cryptocurrency at scales never before observed.
The terrorist organization’s usage happened despite various military setbacks. The groups adapted to using decentralized infrastructure for fundraising and value transfer.
Russia’s A7A5 Token Transacts $93.3B in Sanctions Evasion
Russia introduced laws in 2024 to aid sanctions evasion through cryptocurrency. These efforts paid off in February 2025, when the country issued its ruble-backed A7A5 token.
The token transacted over $93.3 billion in less than one year. The A7A5 token allowed Russia to circumvent traditional financial sanctions by operating outside the SWIFT system.
The ruble-backed token provided an alternative payment rail for international transactions. Crypto news coverage of the A7A5 token highlighted tensions between financial sovereignty and international sanctions enforcement.
Traditional cybercrime remained active with ransomware operators, CSAM platforms, malware distributors, scammers, and illicit marketplaces.
These actors depend on enablers, including domain registrars, bulletproof hosting services, and technical infrastructure.
Chinese Money Laundering Networks Dominate Ecosystem
Crypto news identified Chinese money laundering networks as a dominant force in the illicit on-chain ecosystem in 2025.
These operations expanded crypto crime’s diversification and professionalization. The networks offer specialized services, including laundering-as-a-service and other criminal infrastructure.
Growing connections surfaced between on-chain activity and violent crime. Human trafficking operations increasingly leveraged cryptocurrency for payments and coordination.
Physical coercion attacks rose, where criminals use violence to force victims to transfer assets. These assaults often coincide with cryptocurrency price peaks when victim holdings reach maximum value.
Vignesh Karunanidhi is a seasoned crypto journalist and content editor with 7 years of experience in the crypto and Web3 space. Throughout his career, he has worked with leading platforms such as Watcher.Guru, Milk Road, BeInCrypto, Captain Altcoin, and Coin Edition, producing over 10,000 news articles, blogs, and guides on cryptocurrency.
