The 2026 Crypto Crime Report reveals that illicit activity in the cryptocurrency ecosystem hit unprecedented levels in 2025, driven largely by nation-state actors and the increasing professionalization of on-chain crime networks. While cryptocurrency remains overwhelmingly legitimate in its use, the scale and sophistication of illicit transactions are growing rapidly, presenting new challenges for law enforcement, compliance teams, and national security authorities worldwide.
Record Growth in Illicit Crypto Transactions
In 2025, cryptocurrency addresses linked to illicit activity received at least $154 billion, a 162% year-over-year increase. This dramatic rise was fueled chiefly by a 694% surge in value received by sanctioned entities, highlighting how on-chain assets are being used to bypass international sanctions regimes. Even excluding sanctioned entities, 2025 would have still marked a record year for crypto crime.
Despite this surge, the overall share of illicit transactions remains below 1% of all transactional volume in the broader cryptocurrency economy — underscoring that most crypto activity remains lawful.
Shifts in Asset Types Used for Crime
A notable trend in 2025 was the dominance of stablecoins in illicit transactions. These assets, prized for their low volatility and ease of transfer across borders, accounted for 84% of all illicit crypto transaction volume — reflecting broader shifts within the crypto economy toward these tokens.
Nation-State Actors at the Forefront
One of the most striking developments uncovered in the report is the extent to which nation-state actors have become deeply involved in crypto crime:
- North Korean-linked hackers stole more than $2 billion in cryptocurrency in 2025, including via the largest crypto heist in history — an exploit of the Bybit exchange worth nearly $1.5 billion.
- Russia accelerated its use of crypto for sanctions evasion, with its new ruble-backed A7A5 token facilitating over $93.3 billion in on-chain transfers in under a year.†
- Iran-aligned networks continued to move illicit funds on-chain, supporting activities including oil sales, arms procurement, and terrorism financing at scales previously unseen. Hezbollah, Hamas, and the Houthis are among the groups involved.
These developments suggest that governments are not only exploiting existing illicit crypto infrastructure but also building bespoke systems to facilitate large-scale sanctions evasion and other criminal financial activity.
Emerging Crime Networks and Services
Crypto crime is no longer primarily about lone hackers or isolated scams. The report highlights the rise of Chinese money laundering networks (CMLNs) and other organized groups that provide “full-service” criminal infrastructure — from laundering stolen funds to enabling cybercrime and sanctions violations. These highly structured groups represent a new frontier in the professionalization of illicit on-chain activity.
Traditional Cybercrime Still Thrives
While nation-state behavior grabbed headlines, more “traditional” crypto-related crimes continued to flourish:
- Ransomware operations
- Malware and scam distribution
- Darknet marketplaces
- Specialized infrastructure providers that resist takedown and enforcement efforts
These actors remain active and, in many cases, have integrated themselves into the evolving illicit ecosystem supported by advanced technical infrastructure available on-chain.
Intersection With Violent and Human Crime
The report also points to an expansion of crypto crime’s reach beyond the digital world. There is a troubling rise in violent crime and human trafficking operations using cryptocurrency for payments and coercion, including instances of criminals forcing victims to transfer digital assets during physical attacks.
Looking Forward
As the illicit crypto landscape evolves — entwined with nation-states, organized networks, and sophisticated cybercriminals — the need for cross-sector cooperation grows. Law enforcement, regulators, and crypto businesses must work together to address threats that blur the lines between digital finance, national security, and public safety. While illicit activity is still a small fraction of total crypto transactions, its impact and reach are expanding rapidly, with serious implications for the health and security of the global financial system.
