In a newly released analysis, TRM Labs, a blockchain intelligence firm, estimates that wallets associated with illicit activity received a record $158 billion (₹13.11 lakh crore) in cryptocurrency in 2025, up sharply from about $64.5 billion (₹5.35 lakh crore) the year before. The figure marks the highest annual total observed in at least five years and comes as illicit activity is increasingly linked not only to traditional criminal enterprises but to sanctions-evading actors and state-aligned networks.
The sharp increase—145 percent year-on-year—reflects a convergence of geopolitical pressures and the growing role of crypto as a financial conduit for actors operating outside conventional banking systems. TRM Labs cautions that its new methodology makes direct historical comparisons difficult, but the trend underscores both the scale of on-chain illicit flows and the pace at which new data and attribution can shift the picture of global crypto crime.
Certified Cyber Crime Investigator Course Launched by Centre for Police Technology
Sanctions Evasion and Global Financial Networks
Large portions of the illicit volume in 2025 were tied to sanctions-related activity, particularly involving Russia-linked tokens and wallets. One ruble-pegged stablecoin and affiliated wallet clusters accounted for tens of billions of dollars in inflows, illustrating how actors constrained by traditional financial restrictions are increasingly turning to digital assets to move value.
Iran and Venezuela also featured in the broader narrative of state actors leveraging crypto as a workaround for sanctions-induced isolation. Although not detailed in TRM’s headline figures, related reporting has revealed that Iranian entities moved significant funds through British-registered exchanges, using stablecoins to obscure the origin and destination of transfers amid international restrictions.
Blockchain analysts say that the involvement of these sanctioned jurisdictions complicates enforcement and highlights how loosely regulated elements of the crypto ecosystem—such as stablecoins and offshore exchanges—can be repurposed to serve alternative financial infrastructures.
Hacks, Dark Markets and Crypto Crime’s Underbelly
Beyond sanctions evasion, a handful of high-profile hacks and blocklisted wallets contributed to the growth in illicit activity. Cybercriminal groups associated with major exchange breaches funnel stolen digital assets through labyrinthine chains of wallets and intermediaries to conceal origins and integrate them back into liquid markets.
Darknet markets and illicit goods and services also expanded modestly, with activity up by double-digit percentages in 2025. These platforms remain hubs for the trade of contraband—and increasingly for services that span ransomware payments, identity theft and money laundering.
The combination of these elements—state-linked networks, cyberattacks and underground markets—forms a sprawling ecosystem that defies easy categorization. Analysts note that as crypto becomes more integrated into global finance, the boundaries between different types of illicit use continue to blur.
Proportionate Risk and the Broader Crypto Economy
Despite the dramatic rise in absolute illicit inflows, illicit activity remains a relatively small share of overall blockchain transaction volumes. TRM’s analysis shows that just about 1.5 percent of all on-chain activity in 2025 was attributed to illicit wallets—a decline from previous years even as total dollar volumes climbed. Similarly, illicit actors accounted for roughly 2.7 percent of incoming flows through regulated service providers, down from higher proportions in 2023 and 2024.
This pattern echoes findings from other blockchain research firms, which also reported record totals for illicit crypto receipts in 2025 while noting that these figures remain small relative to the vast scale of legitimate crypto use.
Still, policymakers and law enforcement officials see the sheer scale of the numbers as a reminder that the growth of digital assets brings both financial innovation and complex regulatory challenges. The evolving nature of attribution methods, such as the Beacon Network used by investigators to tie wallets to known actors, suggests that reported figures may continue to rise as new intelligence is incorporated.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
