North Korea, Russia and Stablecoins Create $154 Billion in Illegal Crypto Surge: Chainalysis

Chainalysis reported that illicit crypto will increase by 162% in 2025, led by sanctioned entities, North Korean hacks, Russian tokens and money laundering networks.

Illegal cryptocurrency activity rose to record levels in 2025 as criminal-linked addresses received at least $154 billion during the year.

According to blockchain analytics firm Chainalysis, this is a 162% increase from 2024 and reflects sharp growth in almost all major categories of crypto-related crime.

Sanction evasion is accelerating

In a report shared with CryptoPotatoChainalysis revealed that the increase was mainly driven by a 694% year-on-year increase in the value received by sanctioned entities, although it acknowledged that even without this factor, 2025 would still have been the biggest year on record for illicit crypto activity as the expansion of scams, hacking, money laundering and other violations continues.

Despite the sharp increase in absolute terms, illegal transactions continued to represent a small portion of total crypto activity. The estimated illegal share of attributed transaction volume remained below 1%, only slightly higher than the previous year and continues to be overshadowed by legitimate on-chain use.

Meanwhile, stablecoins now account for 84% of all illegal transaction volumes, thanks to their ease of transfer, lower volatility and practicality for cross-border payments.

One of the most important developments in 2025 was the growing role of national actors, especially North Korea. DPRK-affiliated hackers stole nearly $2 billion in cryptocurrency over the year as a result of a series of large-scale breaches, including February’s Bybit exploit, which was identified by Chainalysis as the largest crypto theft ever at nearly $1.5 billion.

The company said North Korean cyber operations have reached a new level of sophistication in both intrusion techniques and money laundering strategies, making 2025 the most damaging year yet for North Korean activities.

You might also like:

Nation-state behavior on the chain also expanded with Russia’s launch of the ruble-backed A7A5 token in February 2025, after legislation was passed last year to facilitate crypto-based sanctions evasion. The token processed over $93.3 billion in transactions in its first year of existence.

At the same time, Iranian proxy networks moved more than $2 billion through sanctioned wallets to support activities such as money laundering, illicit oil sales, and the procurement of weapons and raw materials. Additionally, Iranian-affiliated terrorist groups such as Hezbollah, Hamas and the Houthis used cryptocurrency in volumes never seen before.

Money laundering networks, illegal infrastructure, violence

In addition to state-linked actors, Chainalysis identified Chinese money laundering networks as an increasingly dominant force. The company described them as sophisticated, professionalized operations that provide money laundering-as-a-service and full criminal support to scammers, fraud rings, North Korean hackers, sanctions evaders and terrorism financiers.

Another trend that defined crypto crime last year is the growing importance of “full-stack” illicit infrastructure providers, which enable ransomware groups, malware distributors, illicit marketplaces and state-linked actors to operate at scale. This includes bulletproof hosting services, domain registrars, and tech platforms designed to prevent takedowns.

The report also documented an increasing intersection between crypto activity and violent crime. This has been attributed to the increased use of crypto by human trafficking operations and an increase in physical coercive attacks in which victims are forcibly forced to transfer digital assets, often during periods of high crypto prices.