- Chainalysis recorded $154 billion in illicit inflows, primarily by sanctioned companies.
- Russia’s ruble-backed A7A5 token has processed more than $93.3 billion in transactions in less than a year.
- Despite rapid growth, illicit transactions remain less than 1% of total on-chain activity.
Illegal cryptocurrency activity expanded rapidly in 2025. This was not due to a sudden surge in everyday cryptocurrency crime, but rather a structural change in the way sanctioned countries and entities move funds.
As global financial restrictions expand, blockchain networks have increasingly become an alternative channel for cross-border transfers that are difficult to block or monitor through traditional systems.
A new report from Chainalytic shows that these changes are changing the shape, size, and participants of the illicit cryptocurrency ecosystem.
Illegal cryptocurrency addresses received at least $154 billion in 2025, a 162% increase from $59 billion in 2024.
Chainalysis attributed much of this growth to large-scale on-chain movement of funds by sanctioned actors.
Illegal activity still accounts for less than 1% of all cryptocurrency transactions, but its rapid expansion highlights how sanctions policies are impacting blockchain use in ways never seen before.
On-chain activity push due to sanctions
Chainalysis describes 2025 as a turning point of unprecedented scale regarding nation-state behavior.
Unlike the initial phase, which was dominated by hacking, fraud, and darknet markets, recent activity has shown a greater level of coordination and technological sophistication.
This reflects the growing familiarity with blockchain tools among sanctioned entities with limited access to global banking systems.
The scale of sanctions has increased dramatically around the world.
In May, the Global Sanctions Inflation Index estimated that approximately 80,000 individuals and entities were currently subject to sanctions.
A separate study by the Center for a New American Security found that the United States added 3,135 entities to the list of Specially Designated Nationals and Blocked Persons in 2024, the highest annual total on record.
This expanding sanctions environment has increased incentives to seek alternative resolution systems.
Russia’s growing role
One of the most prominent contributors to the rise in illicit cryptocurrency flows has been Russia, which has been subject to extensive international sanctions since its invasion of Ukraine.
In February 2025, Russia launched a ruble-based digital token known as A7A5.
According to Chainalytic, the token has processed more than $93.3 billion in transactions in less than a year.
The use of state-linked tokens shows how sanctioned governments are experimenting with blockchain-based tools to maintain trade and financial links.
This approach differs from previous patterns of cryptocurrency usage, where states were indirect beneficiaries of illicit networks rather than active participants in token-based systems.
Stablecoins Take Center Stage
Stablecoins played a dominant role in overall illicit cryptocurrency activity in 2025, accounting for 84% of total illicit trading volume.
Chainalytic linked this to price stability, high liquidity, and ease of cross-border transfers.
These same characteristics that enable legitimate payments and transfers make stablecoins attractive to sanctioned users seeking predictable payments.
Increasing reliance on stablecoins means moving away from highly volatile assets for illicit transfers.
The focus shifted to efficiency, reliability, and scale rather than speculative trading. This is especially true for large transactions involving sanctioned entities.
Crime is still a small percentage
Despite record illicit trading volumes, Chainalysis emphasized that criminal activity still represents a small part of the broader cryptocurrency economy.
Overall, on-chain activity expanded significantly during the year, keeping illicit transactions below 1% of total volume, even as the absolute value of illicit transactions soared.
Other forms of cryptocurrency-related crime have continued along with the sanctions-induced flow.
Blockchain security company PeckShield documented more than 20 major attacks last December, including address poisoning scams and private key leaks that resulted in tens of millions of dollars in losses.