Cryptocurrency wallets linked to criminal activity received a record $158 billion in illicit funds in 2025, reversing three consecutive years of decline, according to a new report by blockchain intelligence firm TRM Labs.
The figure marks a 145% increase from 2024, when illicit crypto flows stood at roughly $64 billion. Before this surge, illegal activity tied to crypto had steadily fallen from $86 billion in 2021 to its lowest point in 2024.
Despite the dramatic rise in absolute numbers, TRM Labs found that illicit transactions made up a slightly smaller share of overall crypto activity, accounting for 1.2% of overall on-chain volume in 2025, down from 1.3% the previous year. Analysts suggest that legitimate crypto use is growing even faster, rather than a collapse in enforcement.
Sanctions And Geopolitics Drive The Surge
The largest contributor to the surge was sanctions-related crypto activity, which grew by more than 400% year on year. Much of this was linked to Russia-associated crypto networks, largely due to the rapid growth of the ruble-pegged stablecoin A7A5, which alone processed over $72 billion in transactions last year.
TRM Labs said the activity points to a broader shift, with nation-states and state-aligned actors increasingly using cryptocurrency as state-aligned financial infrastructure, particularly by countries facing international sanctions such as Russia, Iran, and Venezuela.
Scams, Hacks, And Ransomware Remain Widespread
Fraud continued to be a major problem, with around $35 billion sent to scam-related crypto addresses, and investment scams accounting for 62% of total scam inflows, including romance scams, Ponzi schemes, and fake task offers. Researchers observed that many of these operations have become more polished and aggressive, likely due to the use of AI tools to automate outreach and create convincing fake identities.
Crypto thefts also remained elevated, with $2.87 billion stolen across nearly 150 hacking incidents, with the top 10 accounting for 81% of all stolen value. Although the number of attacks declined, losses were driven largely by a single breach. The $1.46 hack of crypto exchange Bybit alone accounted for more than half of all stolen funds in 2025.
Meanwhile, ransomware activity showed signs of fragmentation, with 93 new variants emerging during the year. While more victims were listed on extortion portals, TRM Labs noted that a growing number of organizations are refusing to pay ransoms.
“Ransomware actors evolved their post-payment laundering behaviors in 2024 and 2025, likely in response to enforcement and heightened monitoring of high-risk services,” TRM Labs wrote in their report. Over this period, bridge-related activity grew by 66%, while mixer-related activity was down by 37%.
Crypto Crime In A Maturing Market
TRM Labs emphasized that the surge does not mean crypto crime is spiralling out of control relative to the market. Using a new metric that measures risk against deployable liquidity, the firm found that illegal actors captured 2.7% of new crypto capital in 2025, down from nearly 6% in 2023.
As cryptocurrencies become more deeply embedded in everyday finance, they are increasingly being adopted by governments, businesses, and criminals alike. Regulators now increasingly face the challenge of large-scale, coordinated, and often state-linked crypto networks that operate across borders, rather than isolated criminal schemes.
