Sanctioned entities moved roughly $104 billion through cryptocurrency in 2025, accounting for the majority of illicit on-chain activity during the year, according to a new report from Chainalysis.
The findings come from the 2026 Crypto Crime Report, which estimates that illicit crypto addresses received at least $154 billion in total during 2025. The report attributes much of the increase to a sharp rise in activity linked to sanctioned entities.
The report notes that sanctions-related crypto activity surged 694% year-over-year, highlighting the growing role of digital assets in geopolitical financial flows.
Sanctions activity drives illicit crypto surge
While illicit crypto activity has long been associated with hacks and scams, the report suggests that sanctions evasion now accounts for the largest share of illicit transaction volume.
Of the $154 billion in total illicit crypto flows recorded in 2025, about two-thirds were linked to sanctioned entities, according to the analysis.
Sanctioned entities include governments, financial institutions, and organizations restricted from accessing traditional financial systems under international sanctions regimes.
The report points to several geopolitical drivers behind the trend, including networks tied to Russia, Iran, and North Korea, which have increasingly turned to digital assets to move funds across borders.
North Korea-linked actors alone were responsible for around $2 billion in crypto theft during 2025, according to the report.
Stablecoins dominate illicit transaction flows
The report also highlights a shift in the types of digital assets used in illicit activity.
Stablecoins accounted for 84% of illicit transaction volume, reflecting their growing role in global crypto payments and transfers.
The increasing use of dollar-pegged tokens suggests that actors engaged in sanctions evasion and cross-border financial activity may prefer stable-value assets over more volatile cryptocurrencies.
Illicit activity remains a small share of crypto economy
Despite the record figures, the report notes that illicit transactions still represent less than 1% of total cryptocurrency activity globally.
Blockchain analytics firms say the transparency of public ledgers continues to aid investigations and enforcement actions against illicit actors.
However, the report warns that criminal networks are becoming more sophisticated, increasingly relying on laundering services and cross-chain infrastructure to obscure the origin of funds.
Criminal infrastructure becoming more organized
The report also points to the rise of organized crypto laundering networks that provide financial infrastructure for illicit actors.
These networks often combine services such as cross-chain swaps, over-the-counter brokers, and decentralized finance protocols to move and obfuscate funds.
Analysts say the trend reflects a broader shift toward professionalized cybercrime ecosystems, where specialized services handle different stages of illicit financial activity.
Final Summary
- Sanctioned entities accounted for roughly $104 billion of the $154 billion in illicit crypto activity recorded in 2025, according to the report.
- Despite record figures, illicit transactions still account for less than 1% of global cryptocurrency activity.