A new report released Wednesday by blockchain intelligence firm TRM Labs shows that 2025 marked a record year for illicit activity flowing into the cryptocurrency ecosystem, with volumes rising sharply compared to the previous year.
According to the findings, inflows from illicit entities into crypto surged by roughly 145% year over year, underscoring a dramatic rebound after several years of decline.
Crypto Crime Volume Jumps To $158 Billion
TRM Labs estimates that illicit cryptocurrency wallets received approximately $158 billion in incoming funds in 2025, up from $64.5 billion in 2024. This represents the highest level recorded over the past five years.
The surge followed a prolonged downturn in illicit inflows, which had steadily fallen from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023, before hitting a low point last year.
Despite the sharp rise in absolute dollar terms, the report notes that illicit activity continued to account for a smaller share of the overall crypto market.
As a percentage of total attributed on‐chain transaction volume, illicit activity declined slightly to 1.2% in 2025, down from 1.3% in 2024 and well below the peak of 2.4% recorded in 2023. Illicit entities received 2.7% of all incoming flows to virtual asset service providers in 2025, compared with 2.9% the year before and 6.0% in 2023.
The report highlights sanctions‐related activity as a major driver behind the 2025 increase. Volumes linked to sanctioned entities and jurisdictions rose sharply, led by roughly $72 billion in inflows associated with the A7A5 token. An additional $39 billion was tied to the A7 wallet cluster.
TRM Labs noted that this activity was highly concentrated, with the vast majority of sanctions‐linked volume connected to Russia‐linked actors, including platforms and entities such as Garantex, Grinex, and A7.
Illicit Activity Reshaped By State Actors
Geopolitical developments played a central role in reshaping illicit crypto activity during the year. According to TRM Labs, state and state‐aligned actors increasingly turned to crypto as a core component of their financial infrastructure rather than using it only as a last‐resort tool.
While Russia‐linked networks were the primary contributors to sanctions‐related flows, the report emphasized a broader and more consequential shift: the growing institutionalization of crypto rails by other sanctioned actors around the world.
China continues to occupy a leading position in the illicit crypto landscape, particularly as a hub for illicit financial services infrastructure. TRM’s analysis shows that activity linked to Chinese‐language escrow services and underground banking networks has expanded dramatically.
Adjusted crypto volumes associated with these networks grew from roughly $123 million in 2020 to more than $103 billion in 2025, reflecting their increasing scale and influence.
Featured image from DALL-E, chart from TradingView.com
