North Korea, Russia, and Stablecoins Fuel $154B Illegal Crypto Surge: Chainalysis

Chainalysis reported that illegal crypto will increase by 162% by 2025, led by sanctioned organizations, North Korean hacks, Russian tokens, and defamation networks.

Illegal cryptocurrency activity rose to record levels in 2025, as addresses linked to crime received at least $154 billion a year.

According to blockchain analytics firm Chainalysis, this is a 162% increase compared to 2024 and shows sharp growth in almost all major categories of crypto-related crime.

Avoidance of Penalties is Faster

In the report shared no CryptoPotatoChainalysis revealed that the increase was mainly driven by the 694% year-on-year jump in the amount received by sanctioned organizations, although it admitted that even without this factor, 2025 will still be the biggest year in the history of illegal crypto activity as the expansion of scams, hacking, money laundering, and other ongoing crimes.

Despite the sharp rise in absolute terms, illegal transactions continued to represent a small portion of overall crypto activity. The average illegal share of the transaction volume is still less than 1%, only slightly higher than last year and still being reduced by the legal use of on-chain.

Meanwhile, stablecoins now account for 84% of all illegal transaction volume, thanks to ease of transfer, low volatility, and practical cross-border payment services.

Among the most important developments in 2025 was the increased role of state actors, particularly North Korea. Hackers linked to the DPRK stole nearly $2 billion in cryptocurrency during the year, thanks to a series of major breaches, including the February Bybit exploit, which Chainalysis identified as the largest crypto theft on record at nearly $1.5 billion.

The firm said that North Korea’s cybersecurity operations have reached new levels of difficulty in both infiltration and fraud techniques, making 2025 the worst year since DPRK-linked operations.

You may also like:

Nation-state on-chain behavior also increased with Russia’s launch of the ruble-backed A7A5 token in February 2025, following a law passed last year to facilitate evasion of crypto-based sanctions. The token processed more than 93.3 billion dollars in sales during its first year of operation.

At the same time, Iranian proxy networks moved more than $2 billion through authorized wallets to support activities including money laundering, illegal oil sales, and the purchase of weapons and supplies. Additionally, terrorist groups aligned with Iran such as Hezbollah, Hamas, and the Houthis are using cryptocurrency in unprecedented amounts.

Fraud Networks, Illegal Infrastructure, Violence

In addition to state-linked actors, Chainalysis identified China’s money laundering networks as a growing force. The company describes them as sophisticated, sophisticated operations that provide smuggling as a service and full criminal support to scammers, fraud rings, North Korean criminals, sanctions evaders, and terrorist financiers.

Another trend that has defined crypto-crime in the past year is the increasing importance of “full-stack” illegal infrastructure providers, allowing ransomware groups, malware distributors, illegal markets, and state-aligned actors to operate at scale. This includes bulletproof hosting services, domain registrars, and technical platforms designed to withstand deprecation.

The report also documented the growing connection between crypto activity and violent crime. This is due to the increase in the use of crypto through human trafficking activities and the increase in extortion attacks where victims are violently forced to transfer digital assets, usually during periods of high crypto prices.