The global crypto crime landscape changed sharply in 2025, according to data presented in the opening chapter of the 2026 Crypto Crime Report by Chainalysis. Illicit crypto addresses received at least $154 billion during the year, marking the highest level ever recorded.
The figure represents a steep 162% increase compared to the previous year and signals a new phase where state-backed activity plays a central role in on-chain crime.
Source: Chainalysis
As seen in the previous decades, where the aspect of scamming and individual hackers dominated, the year 2025 has demonstrated how the nature of crypto crimes has evolved to the level of being organized and even systematic.
There are professional service providers who maintain large-scale platforms on the blockchain, which aid the perpetrators to launder money, purchase physical items, and even make payments.
Nations are also leveraging technology or developing their platforms to move funds past the conventional financial channels. Although it represents a huge increase, it is still a small fraction of the entire crypto market.
According to Chainalysis, illicit transactions as a percentage of total crypto transaction volume remained below 1% in 2025, slightly up from 2024. The amount of money involved in high-risk is also growing rapidly, just like the legal use.
Source: Chainalysis
Also Read: Florida Man Loses $317,000 After Falling for a Crypto Scam
Nation-State Activity Reshapes Crypto Crime
The key reason behind the rise in 2025 was related to sanctions. The sanctioned groups experienced an increase in earnings of 694% from the previous year.
The groups associated with North Korea also contributed about $2 billion to the stolen digital currency, assisted by massive hacks. In February, the Bybit hack was the largest digital hack ever, with losses close to $1.5 billion.
Russia also played an important part in this. After launching the legal foundations in 2024, it created its ruble-supported A7A5 token in early 2025.
This token completed more than $93.3 billion in transactions in less than a year alone, proving that semi-governmental instruments could be applied on a huge scale to bypass financial barriers. Iran-related entities continued to employ digital currency platforms to carry out payments exceeding $2 billion in confirmed wallets.
Resilient Infrastructure Fuels Ongoing Cybercrime Operations
Another important trend observed is the emergence of Chinese money laundering groups. These groups have established full-service crypto crime operations that involve money laundering facilities as well as the basic infrastructure required for supporting fraud and scamming. This indicates the modular aspect of crypto crime.
However, more conventional types of cybercrime continue to operate. There is a rise in the use of robust infrastructure providers for ransomware groups and malware operators, as well as for dark markets.
Also Read: U.S. Justice Department Seizes Crypto Scam Domain Linked to Southeast Asia
