Russia-Linked Crypto Activity Drives Illicit Fund Flows to 5-Year High by 2025: TRM Labs

Russia-aligned crypto activity has grown as illegal transactions have dropped to just 1.2% of total on-chain volume by 2025.

Illegal cryptocurrency activity also intensified in 2025, driven primarily by the disclosure of Russia-linked sanctions and enhanced attribution. A new report by TRM Labs estimates that counterfeit wallets generated nearly $158 billion in inflows during the year, the highest level recorded in the past five years.

This increase is a dramatic change from 2024, when illegal inflows fell to $64.5 billion, following a multi-year decline from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023.

Sanctions, Stablecoins, and State Strategy

TRM Labs pointed out that the increase in 2025 was not only due to strengthened enforcement actions but also to the increased use of cryptocurrency by national actors and technological advances that allowed the identification of illegal volumes that had not yet been reported. The most significant change was the focus on sanctions-related work related to Russia, as volumes associated with sanctioned organizations and authorities increased significantly.

The A7A5 token alone accounts for $72 billion in inflows, followed by $39 billion linked to the A7 fund pool, most of which is linked to Russian-linked players, including Garantex, Grinex, and A7.

The blockchain intelligence firm said the increase does not reflect the growth of sanctions evasion alone, but rather a combination of new sanctions targeting large companies and the enhanced provision of cryptocurrency addresses to already sanctioned players.

Among these, A7 emerged as a center and served as a coordinated central point of sanctions avoidance aligned with the interests of the Russian state. The on-chain activity analyzed by TRM shows that A7 acts as a hub connecting Russian-affiliated players and partners across networks connected to China, Southeast Asia, and Iran, in a major pivot towards a crypto-enabled, state-aligned financial infrastructure.

While the A7 wallet collection is closely associated with sanctions evasion activity, the A7A5 token supports a broader push to reduce reliance on USD-based financial systems through the expansion of a ruble-denominated stablecoin. As a result, the high volume of transactions linked to A7A5 represent not only evasion of sanctions, but a widely sanctioned activity, including economic flows associated with the regime.

You may also like:

Fake Crypto is on the Rise

Stepping back from disciplinary-related activities, the company also revealed that the total illegal crypto income rose to a record high by 2025, as such activity accounted for a small portion of the crypto ecosystem. Measured as a share of total on-chain volume, illegal activities fell slightly to 1.2% in 2025 from 1.3% in 2024, and remained well below the peak of 2.4% recorded in 2023.

A similar pattern was observed when informal activity was examined in relation to income, as informal businesses accounted for 2.7% of VASP income flows in 2025, compared to 2.9% in 2024 and 6.0% in 2023. a small fraction of the new money entering the crypto ecosystem.