Illegal cryptocurrency activity surged to an all-time high in 2025, reaching an estimated $158 billion, according to a new report from TRM Labs.
This marks a sharp reversal after three consecutive years of decline, when illicit crypto flows dropped from $86 billion in 2021 to $64 billion in 2024. Despite the jump in total value, the share of illegal activity within overall on-chain transactions actually fell slightly, moving from 1.3 percent in 2024 to 1.2 percent in 2025.
TRM Labs attributes the sudden rise mainly to increased activity linked to sanctioned entities. Much of this growth came from networks associated with Russia, including groups tied to newly sanctioned operations and stablecoin usage. The report also highlights the growing role of cryptocurrency as a financial tool for certain governments and state-aligned actors. Countries such as Russia, Iran, and Venezuela are increasingly using crypto as part of their financial infrastructure, while China-linked underground banking and escrow networks have supported large settlement volumes.
Another major factor behind the increase is better tracking and attribution. TRM Labs says improved intelligence sharing and more advanced monitoring tools helped uncover illicit crypto flows that previously went undetected. This includes faster identification of activity related to sanctions violations, large-scale hacks, and addresses connected to blocklisted entities.
The report also details continued losses from cybercrime. In 2025, hackers stole a total of $2.87 billion across 150 separate incidents, with just ten attacks responsible for more than 80 percent of the stolen funds. The largest single case was the February 2025 breach of Bybit, which resulted in losses of about $1.46 billion and was attributed to hackers linked to North Korea.
Cryptocurrency scams remained widespread throughout the year, with an estimated $35 billion sent to fraudulent schemes. Investment-related scams dominated the space, making up nearly two-thirds of all scam-related inflows. These included romance scams, Ponzi-style operations, and fake task schemes. TRM Labs noted that many of these scams are becoming more organized and convincing, a trend it believes is partly driven by the use of AI tools.
Ransomware-related crypto payments stayed high in 2025, although they did not reach the record levels seen in earlier years. While the number of victims listed on extortion websites hit a new high, the data suggests that more organizations are refusing to pay ransoms.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
At the same time, the ransomware ecosystem became more fragmented, with a large number of new strains and variants emerging during the year.
