TLDR
Blockchain analytics firms say that in 2025, addresses linked to illicit activity received around $154 billion in crypto, mostly tied to sanctions evasion using stablecoins.
- Chainalysis estimates illicit addresses received at least $154 billion in 2025, a 162% year over year increase, with sanctioned entities driving most of the surge.
- Stablecoins made up roughly 84% of this illicit volume, and sanctions related activity accounted for the majority of flows, especially involving Russia, Iran, and North Korea.
- Illicit flows are large in dollars but still under 1% of total crypto volume, and regulators are responding with tighter stablecoin and anti money laundering rules that affect regular users too.
Deep Dive
1. How Big Is $154 Billion And What Is Illicit?
Chainalysis 2026 Crypto Crime Report estimates that addresses it labels as illicit received at least $154 billion in crypto in 2025, up about 162% from 2024, a record high on chain. Reports summarized by outlets like Decrypt and CoinDesk attribute roughly $104 billion of that to sanctioned entities, including state linked networks in Russia, Iran, and North Korea.
Illicit addresses here means wallets associated with things like sanctions evasion, darknet markets, major scams, ransomware, and known hacking groups, based on blockchain forensics. Analysts stress this is a lower bound, because they only count addresses they can confidently tag as illicit, not everything bad that happened off chain.
The $154 billion figure is a conservative estimate of traceable bad activity, not a measure of all crime or a claim that 154 billion dollars in new money disappeared.
2. Stablecoins And Sanctions Evasion
Multiple analyses say stablecoins now dominate illicit flows. Chainalysis data cited by Cointelegraph and others finds stablecoins accounted for about 84% of illicit transaction volume within that $154 billion.
A big driver is sanctions evasion. Chainalysis and TRM Labs highlight a ruble pegged stablecoin, A7A5, which alone processed tens of billions of dollars for Russian linked networks, while Irans Islamic Revolutionary Guard Corps and North Korean hackers increasingly route funds through liquid dollar linked stablecoins. Sanctions related activity reportedly made up over 80% of total illicit flows in 2025.
Dollar like tokens are attractive to sanctioned actors because they hold value and move quickly, so regulators are focusing on stablecoin compliance and on closing gaps around peer to peer transfers.
3. How Big Is This Versus All Crypto And Why It Matters
Despite the headline number, Chainalysis estimates that illicit activity still represents less than 1% of total on chain crypto volume, according to summaries from the FATF and major crypto media. Legitimate trading, payments, and DeFi activity remain the overwhelming majority.
However, the mix of crime is shifting. Ransomware payments and some scam categories have flattened or even declined, while industrialized fraud networks, money laundering as a service, and state level sanctions evasion have grown. That combination is pushing regulators toward stricter know your customer rules, wallet screening, and possible freezing tools for certain stablecoin ecosystems.
For everyday users, the main impacts are more scrutiny on stablecoin flows, tougher compliance on exchanges, and an even stronger need to avoid interacting with unknown addresses, high yield schemes, or lightly regulated venues.
Conclusion
Addresses linked to crime and sanctions received roughly $154 billion in crypto in 2025, heavily concentrated in stablecoins and state aligned networks. Although this is a small slice of total crypto activity, the size and geopolitical nature of these flows are driving a regulatory pivot toward stablecoin oversight and stricter anti money laundering controls that will shape how people and institutions use crypto going forward.
CoinsKid.Com