National-level players enter the arena, 2025 Crypto Crime Out of Control Apocalypse

Original Author: Chainalysis

Original Compilation: Chopper, Foresight News

In 2025, we observed a significant increase in cryptocurrency-related activities at the national level, marking a new stage of maturity in the development of the illegal on-chain ecosystem. Over the past few years, the specialization in the field of crypto crime has deepened; illegal organizations have now built large-scale on-chain infrastructure to support the procurement of goods and services for transnational criminal networks and to launder proceeds from crypto crimes. Against this backdrop, governments around the world have also begun to engage in this area, leveraging these mature professional service providers while also working to build customized infrastructure to evade sanctions on a large scale. As governments connect to this illegal cryptocurrency supply chain initially designed for cybercriminals and organized crime groups, government agencies, compliance, and security teams now face severe challenges in consumer protection and national security.

What specific manifestations do these trends and other industry changes have on-chain? Next, we will analyze this in conjunction with data and macro trends.

According to our monitoring data, the inflow of funds into illegal cryptocurrency addresses in 2025 reached at least $154 billion, a staggering increase of 162% year-on-year. This growth was primarily driven by a surge in the inflow of funds from sanctioned entities, which skyrocketed by 694% year-on-year. However, even excluding the growth factor from sanctioned entities, 2025 still stands out as a record year for crypto crime, as the scale of most categories of illegal activities has increased.

Nevertheless, the scale of these illegal transactions remains insignificant compared to the overall cryptocurrency economy, where legitimate trading still dominates. Our estimates indicate that while the proportion of illegal transactions in the total traceable cryptocurrency transactions slightly increased in 2025 compared to 2024, it still remains below 1%.

As shown in the figure below, we also observed a continuous shift in the types of assets involved in crypto crime.

Over the past few years, stablecoins have gradually become the dominant asset in illegal transactions, currently accounting for 84% of the total volume of illegal trades. This trend aligns with the overall development characteristics of the cryptocurrency ecosystem: with advantages such as convenient cross-border transfers, low volatility, and wide application scenarios, the share of stablecoins in the entire cryptocurrency trading landscape continues to expand.

The following will delve into several core trends that define the landscape of crypto crime in 2025, which will remain important to monitor in the future.

National Threats Drive Up Transaction Volumes: North Korea's Theft Reaches New Heights, Russia's A7A5 Token Aids Large-Scale Sanction Evasion

In 2025, stolen funds remained a major threat to the cryptocurrency ecosystem, with North Korean hacker groups stealing $2 billion. This figure was primarily driven by several highly destructive large-scale hacking incidents, the most notable being the Bybit exchange attack in February, which involved nearly $1.5 billion, marking the largest digital asset theft in cryptocurrency history. Although North Korean hackers have long been a significant threat to the cryptocurrency ecosystem, the past year has seen record highs in both the amount stolen and the complexity of their intrusion and laundering methods.

Notably, the scale of on-chain activities by governments around the world reached unprecedented levels in 2025. Russia introduced relevant legislation in 2024 to promote the use of cryptocurrency to evade sanctions, which officially took effect in February 2025. The country launched the A7A5 token backed by the ruble, which surpassed $93.3 billion in trading volume in less than a year.

Meanwhile, over the past few years, Iran's proxy networks have engaged in money laundering, illegal oil trading, and bulk procurement of weapons through confirmed wallet addresses that are on the sanctions list, with a cumulative transaction volume exceeding $2 billion. Despite facing multiple military strikes, Iran-supported terrorist organizations such as Hezbollah, Hamas, and the Houthis continue to use cryptocurrency on an unprecedented scale.

In 2025, China's money laundering networks emerged as a dominant force in the illegal on-chain ecosystem. These organizations operate with precision, greatly advancing the diversification and specialization of crypto crime, offering various specialized criminal services, including "money laundering services." These networks have built comprehensive service crime enterprises based on early illegal operational models such as "currency exchange guarantees," covering areas such as fraud, scams, laundering proceeds from North Korean hacker thefts, evading sanctions, and funding terrorism.

Full-Stack Illegal Infrastructure Providers Fuel Malicious Online Activities

As governments around the world increase their use of cryptocurrency, traditional cybercrime activities remain rampant: ransomware operators, child sexual abuse and cybercrime platforms, malware distributors, scammers, and illegal trading markets still rely on a vast support network to maintain operations. Criminals and governments are increasingly dependent on on-chain infrastructure providers that can offer full-stack services, including domain registrars, secure hosting services, and other technological infrastructures that can be used for malicious online activities.

These infrastructure providers have evolved into comprehensive platforms capable of withstanding platform crackdowns, abuse complaints, and sanction enforcement. As the scale of these services continues to expand, they may become key drivers of economic crime and state-supported forces that broaden the scope of malicious online activities.

The Connection Between Cryptocurrency and Violent Crime is Increasing

In many people's perceptions, crypto crime remains confined to the virtual world. The masterminds are merely anonymous individuals hiding behind keyboards, posing no real-world threat. However, the connection between on-chain activities and violent crime is deepening. Human trafficking gangs are increasingly using cryptocurrency for transactions; meanwhile, alarmingly, the number of violent coercion attacks has significantly risen, with criminals using violence to force victims to transfer crypto assets, often targeting these attacks during peaks in cryptocurrency prices.

Looking ahead, collaboration among law enforcement agencies, regulatory bodies, and cryptocurrency companies will be key to addressing these complex, evolving, and intertwined threats. Although illegal transactions still represent a limited share of the total legal cryptocurrency trading volume, maintaining the integrity and security of the cryptocurrency ecosystem has never been more important than it is now.