Written by: Chainalysis
Compiled by: Chopper, Foresight News
Original Title: National-Level Players Enter the Scene, Deciphering the Loss of Control and Transformation of Cryptocurrency Crime in 2025
In 2025, we observed a significant increase in cryptocurrency-related activities at the national level, marking a new mature phase in the development of the illegal on-chain ecosystem. Over the past few years, the professionalization within the cryptocurrency crime sphere has deepened; illegal organizations have now established large-scale on-chain infrastructure to support transnational criminal networks in procuring goods and services and laundering proceeds from crypto crimes. Against this backdrop, national governments have also begun to venture into this domain. On one hand, they leverage these mature professional service providers, and on the other, they are building customized, exclusive infrastructure to evade sanctions on a large scale. As governments tap into this illicit cryptocurrency supply chain originally created for cybercriminals and organized crime groups, government agencies, compliance, and security teams now face severe challenges in terms of consumer rights protection and national security.
What are the specific on-chain manifestations of these developments and other industry changes? Next, we will analyze them by combining data with macro trends.
According to our monitoring data, the scale of funds flowing into illegal cryptocurrency addresses in 2025 reached at least $154 billion, a sharp increase of 162% year-on-year. This growth was primarily driven by a surge in fund inflows to sanctioned entities, which skyrocketed by 694% year-on-year. However, even after excluding the growth from sanctioned entities, 2025 still stands as a record year for cryptocurrency crime, as the scale of most illegal activity categories saw growth.
Nevertheless, the scale of these illegal transactions still pales in comparison to the overall cryptocurrency economy, where the main body of transactions remains legitimate. We estimate that although the proportion of illegal transactions in the total traceable cryptocurrency transaction volume in 2025 increased slightly compared to 2024, it remains below 1%.
As shown in the figure below, we also observed a continuous shift in the types of assets involved in cryptocurrency crimes.
Over the past few years, stablecoins have gradually become the dominant asset in illegal transactions, currently accounting for 84% of the total illegal transaction volume. This trend aligns with the overall development characteristics of the cryptocurrency ecosystem: with advantages such as convenience for cross-border transfers, low volatility, and wide application scenarios, the share of stablecoins in the entire cryptocurrency transaction volume continues to expand.
The following sections will delve into the core trends that defined the 2025 cryptocurrency crime landscape, trends that will remain important to focus on in the future.
National-Level Threats Drive Transaction Volume: North Korean Thefts Hit Record High, Russia's A7A5 Token Facilitates Large-Scale Sanction Evasion
In 2025, stolen funds remained a major threat to the cryptocurrency ecosystem, with hacking groups linked to North Korea alone stealing $2 billion. This figure was primarily driven by several highly destructive large-scale hacking incidents, the most notable being the attack on the Bybit exchange in February. This incident involved nearly $1.5 billion, making it the largest digital asset theft in the history of cryptocurrency. Although North Korean hackers have long been a major force threatening the cryptocurrency ecosystem, the past year saw record highs both in the amount stolen and in the sophistication of their intrusion and money laundering methods.
Particularly noteworthy is that the scale of on-chain activities reached unprecedented levels in 2025. Russia introduced relevant legislation in 2024 to use cryptocurrency to evade sanctions, and this measure was formally implemented in February 2025. The country launched the ruble-backed token A7A5, which saw its transaction volume exceed $93.3 billion in less than a year since its launch.
Meanwhile, over the past few years, Iran's proxy networks have conducted money laundering, illegal oil trading, and bulk commodity procurement for weapons on-chain through verifiable wallet addresses that have been placed on sanctions lists, with a cumulative transaction volume exceeding $2 billion. Despite suffering multiple military strikes, terrorist groups supported by Iran, such as Hezbollah, Hamas, and the Houthis, continue to use cryptocurrency on an unprecedented scale.
In 2025, Chinese money laundering networks emerged as a dominant force in the illegal on-chain ecosystem. These organizations operate with sophisticated models, greatly promoting the diversification and professionalization of cryptocurrency crime, offering various specialized criminal services including "money laundering services." Building upon early illegal operation models like "Huiyin Guarantee," these networks have established full-service criminal enterprises, covering businesses in multiple areas such as fraud, scams, laundering proceeds from North Korean hacker thefts, sanction evasion, and terrorism financing.
Full-Stack Illegal Infrastructure Providers Fuel Malicious Cyber Activities
While governments increase their use of cryptocurrency, traditional cybercrime activities remain rampant: ransomware operators, child sexual abuse and cybercrime platforms, malware distributors, scammers, and illegal marketplaces still rely on vast support networks to maintain operations. Illicit actors and national governments are increasingly dependent on on-chain infrastructure providers that offer full-stack services, including domain registrars, secure and reliable hosting services, and other technical infrastructure that can be used to carry out malicious cyber activities.
These infrastructure providers have evolved into comprehensive infrastructure platforms capable of resisting platform takedowns, abuse complaints, and sanction enforcement. As the scale of these services continues to expand, they may become a key force driving economic crime and state-supported entities to expand the scope of malicious cyber activities.
Growing Correlation Between Cryptocurrency and Violent Crime
In the perception of many, cryptocurrency crime is still confined to the virtual world. The masterminds are merely anonymous figures hiding behind keyboards, not posing a threat in the real world. But in fact, the connection between on-chain activities and violent crime is deepening. Human trafficking gangs are using cryptocurrency for transactions more and more; at the same time, disturbingly, the number of violent coercion attack cases has risen significantly, where criminals use violent means to force victims to transfer crypto assets, and such assaults often occur during peak cryptocurrency price periods.
Looking ahead, collaboration between law enforcement agencies, regulatory bodies, and cryptocurrency companies will be key to addressing these complex, evolving, and interconnected threats. Although the proportion of illegal transactions in the legitimate cryptocurrency transaction volume remains limited, maintaining the integrity and security of the cryptocurrency ecosystem has never been more important.
Twitter:https://twitter.com/BitpushNewsCN
Bitpush TG Discussion Group:https://t.me/BitPushCommunity
Bitpush TG Subscription: https://t.me/bitpush
