Stablecoin Crime Wave? $141B In Illicit Activity Reported This Year

bitcoinistPublished on 2026-02-20Last updated on 2026-02-20

Abstract

In 2025, approximately $141 billion in stablecoins was reportedly acquired by illicit actors, largely due to their predictable value and fast transaction speeds. Sanctions-related networks accounted for about 86% of these illicit flows, with $72 billion tied to a Russian ruble-pegged token. These networks also showed connections to China, Iran, North Korea, and Venezuela. Stablecoins were heavily used in guarantee marketplaces and human trafficking operations, where payment certainty and liquidity were prioritized. While scams and ransomware often start in Bitcoin or Ether, funds are frequently converted to stablecoins during laundering. The stablecoin market capitalization exceeded $270 billion in early 2026, dominated by Tether’s USDT ($180B) and Circle’s USDC ($70B), which together control over 90% of the market.

In 2025, about $141 billion in stablecoins reportedly ended up in the hands of illicit actors. Much of this activity was funneled through a few networks that favored stablecoins for their predictable value and quick transfers.

Much of that movement is tied to a small number of networks that use stablecoins for their speed and price stability. That does not mean widespread criminal use across all stablecoins. It points to concentrated channels where these tokens meet a specific need: moving value reliably outside regular banking rails.

Sanctions Linked Networks Drive The Bulk Of Flows

According To TRM Labs, sanctions-related flows made up roughly 86% of detected illicit crypto transfers last year. Around $72 billion of the stablecoin total traced back to a ruble-pegged token linked to Russian networks.

These networks are not isolated. Reports note overlaps with entities tied to China, Iran, North Korea, and Venezuela, which shows how stablecoins can act as bridges between different sanctioned systems.

The mechanics are simple: price stability matters when you need predictable settlement and low volatility risk. Stablecoins offer that.

Guarantee Marketplaces And Human Trafficking Rely On Stablecoins

Volume on certain marketplaces surged, mostly in stablecoins. Some escrow and guarantee sites — which act like middlemen for high-value transfers — saw tens of billions of dollars flow through their systems.

Reports note these venues are almost totally stablecoin-denominated, which raises red flags about their role in moving funds tied to illicit trade. Chainalysis and others have also pointed to sharp increases in flows to networks connected to human trafficking and escort services, and those operations leaned heavily on stablecoins for payments.

In these cases, payment certainty and liquidity matter more to the buyers and sellers than the chance of gains.

Different Types Of Crime Use Different Paths

Scams, ransomware, and thefts often start in Bitcoin or Ether and then shift into stablecoins later in the laundering chain. That pattern is common because attackers want an asset that holds value while they move it through fewer hands.

BTCUSD now trading at $67,833. Chart: TradingView

Market Cap

Meanwhile, the global stablecoin market has grown into a multi‐hundred‐billion‐dollar sector, with total market capitalization topping roughly $270 billion in early 2026.

According to data tracking site Stablecoin.com, the combined value of all major stablecoins consistently sits above the mid‐hundreds of billions mark, with fiat‐backed coins accounting for most of that total.

Two issuers dominate the sector. Tether’s USDT leads by a wide margin, with a market cap often reported at around $180 billion or more, and representing more than two‐thirds of the total stablecoin market.

Source: Stablecoin.com

Circle’s USD Coin (USDC) sits in second place with a market cap often above $70 billion, jointly holding over 90% of stablecoin capitalization when combined with USDT.

Smaller stablecoins like Ethena USDe, DAI, and PayPal USD make up a much smaller portion of the market but signal ongoing diversification among providers, the data tracker said.

Featured image from Unsplash, chart from TradingView

Related Questions

QHow much in stablecoins reportedly ended up in the hands of illicit actors in 2025?

AAbout $141 billion in stablecoins reportedly ended up in the hands of illicit actors in 2025.

QWhat percentage of detected illicit crypto transfers last year were sanctions-related, according to TRM Labs?

ASanctions-related flows made up roughly 86% of detected illicit crypto transfers last year.

QWhich two stablecoin issuers dominate the market and what is their combined market share?

ATether's USDT and Circle's USD Coin (USDC) dominate the market, jointly holding over 90% of the stablecoin market capitalization.

QWhat is a key reason illicit actors use stablecoins for transactions, according to the article?

AIllicit actors use stablecoins for their predictable value, quick transfers, and price stability, which provides reliable settlement with low volatility risk.

QBesides sanctions evasion, what other types of illicit activities are increasingly using stablecoins for payments?

AStablecoins are also heavily used for payments in illicit activities such as operations on guarantee marketplaces, human trafficking, and escort services.

Related Reads

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

Coldcard Hardware Wallet Hacked: Losses Mount Due to Vulnerable Seed Generation A critical vulnerability in Coldcard hardware wallets has led to a continued wave of fund thefts. According to Galaxy Research, the total stolen has reached 1,367.05 BTC (approx. $88.6 million) from 4,585 addresses, a significant increase from the initial 594.5 BTC reported on July 30, 2026. Most of the stolen funds remain on the attackers' addresses. The issue is not with the current firmware, which Coinkite has updated, but with seed phrases generated on vulnerable devices between March 2021 and the release of fixed firmware versions. Due to a programmer error, devices switched from using a hardware random number generator to the software-based Yasmarang generator, which was initialized with publicly accessible data like the chip's serial number. This made the seed phrases predictable through offline brute-force attacks, meaning wallets remain at risk until funds are moved to a new wallet generated with the patched firmware. Affected devices include Mk2/Mk3 with firmware 4.0.1–4.1.9 (and up to 5.0.3), Mk4/Mk5 up to version 5.6.0, and Q models up to 1.5.0Q. The only exceptions are seeds created with a high-entropy method like at least 50 independent dice rolls or a strong unique BIP-39 passphrase. All other owners must generate a new seed on the fixed firmware and transfer their assets. A case highlighting the human impact involves a 39-year-old long-term investor who lost 2 BTC (approx. $130,000) in minutes. He had accumulated the Bitcoin over eight years through physical labor, viewing it as a financial lifeline and a retirement plan in a country suffering from hyperinflation. His story underscores that even conservative "buy and hold in cold storage" strategies can be compromised by such underlying technical flaws. From a technical perspective, this incident echoes historical failures where weak random number generators undermined cryptographic security, challenging the assumption that offline storage is automatically foolproof.

cryptonews.ru4h ago

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

cryptonews.ru4h ago

Trading

Spot
活动图片