Russia-linked crypto activities drove illicit wallet inflows to a five-year high in 2025: TRM Labs

Russia-linked crypto activity soared even as illicit transactions dropped to just 1.2% of total on-chain volume by 2025.

Illegal cryptocurrency activity rebounded sharply in 2025, mainly due to Russia-linked sanctions and improved allocation. A new report from TRM Labs estimates that fraudulent wallets received approximately $158 billion in inbound value during the year, which is the highest level recorded in the past five years.

The increase is a dramatic reversal from 2024, when illicit inflows fell to $64.5 billion, after a steady decline over several years from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023.

Sanctions, stablecoins and state strategy

TRM laboratories attributed The 2025 wave has led not only to intensified enforcement actions, but also to greater use of cryptocurrency by national actors and to technological advances that enabled the identification of previously unattributed illicit volumes. The most significant shift occurred in sanctions-related activities largely related to Russia, while volumes associated with sanctioned entities and jurisdictions increased sharply.

The A7A5 token alone accounted for an estimated $72 billion in inbound value, followed by $39 billion tied to the A7 wallet cluster, with the majority of this activity tied to Russia-linked actors including Garantex, Grinex, and A7.

The blockchain intelligence agency stated that the increase does not solely reflect the growth of sanctions evasion, but rather the combination of new sanctions targeting large entities and improved attribution of cryptocurrency addresses to actors who had already been sanctioned.

Of these, A7 emerged as a central hub, functioning as a centrally coordinated sanctions avoidance architecture linked to Russian state interests. On-chain activity analyzed by TRM indicates that A7 is operating as a hub connecting Russia-linked actors with counterparties in China, Southeast Asia and Iran-linked networks, in a major pivot towards a crypto-based, state-aligned financial infrastructure.

While the A7 wallet cluster is closely tied to sanctions evasion, the A7A5 token supports a broader push to reduce dependence on USD-based financial systems through the expansion of a ruble-pegged stablecoin. As a result, the high transaction volumes associated with A7A5 do not solely represent sanctions avoidance, but sanctioned activities more broadly, including state-linked economic flows.

You might also like:

Fraudulent crypto is growing

Zooming in on sanctions-related activities, the company also revealed that overall illicit cryptocurrency inflows rose to a record high in 2025, even though such activities represented a smaller portion of the crypto ecosystem. Measured as a percentage of the total volume attributed to the chain, illegal activity decreased slightly from 1.3% in 2024 to 1.2% in 2025, remaining well below the peak of 2.4% recorded in 2023.

A similar pattern was observed when illicit activities were assessed relative to incoming liquidity, as illicit entities received 2.7% of incoming VASP flows in 2025, compared to 2.9% in 2024 and 6.0% in 2023. TRM Labs said these figures indicate that while certain illicit categories increased significantly in absolute terms, illicit actors absorbed a smaller share of the new capital entering the crypto ecosystem.