SKN | Criminal Use of Crypto Jumps in 2025 Even as Share of Activity Keeps Falling, TRM Says

Key Points:

•  Illicit crypto activity rose sharply in dollar terms in 2025, reaching $158 billion after several years of decline.
•  Despite the increase, criminal use still accounted for just 1.2% of total digital-asset volume as lawful adoption expanded faster.
•  TRM Labs says the threat is becoming more sophisticated, driven by state-backed networks, sanctions evasion and highly organized laundering operations.

Illicit Crypto Activity Rises in Absolute Terms

Criminal actors pulled in roughly $158 billion in digital assets in 2025, marking a notable rebound in illicit crypto activity after years of steady decline, according to a new report from TRM Labs.

The increase reflects higher-value flows rather than broader participation, with TRM emphasizing that illicit activity remains a shrinking share of the overall crypto economy. Even with the spike, criminal transactions represented just 1.2% of total digital-asset volume last year, underscoring how quickly legitimate use cases are growing.

Lawful Growth Outpaces Criminal Use

TRM highlighted that stablecoin usage alone reached roughly $4 trillion in transaction volume in 2025, illustrating how fast the compliant side of the market is expanding.

Ari Redbord, TRM’s global head of policy, said the declining share of illicit activity is encouraging, but the nature of that activity makes it increasingly dangerous. He pointed to ransomware attacks, large-scale fraud and state-linked operations using crypto to bypass sanctions and fund geopolitical objectives.

Sanctions Evasion and State-Backed Networks

The report found that sanctions-related crypto activity surged in 2025, driven largely by Russia-linked flows. TRM estimated that $72 billion moved through the ruble-backed stablecoin A7A5, with wallet clusters tied to Russian sanctions evasion handling tens of billions of dollars.

Beyond Russia, TRM noted a broader institutionalization of crypto infrastructure by other sanctioned actors, including networks connected to Venezuela and China. These groups are no longer experimenting with crypto, but embedding it deeply into parallel financial systems designed to operate outside traditional banking rails.

Hacks Concentrated in Fewer, Larger Attacks

Crypto hacks and exploits totaled nearly $3 billion in losses during 2025, a higher dollar figure than the previous year. However, TRM said the damage was heavily concentrated, with a single February breach at Bybit accounting for roughly half of the total.

Rather than simple smart-contract exploits, many of the largest losses stemmed from infrastructure and operational attacks targeting exchanges, custodians and service providers.

North Korea and Professionalized Laundering

According to the report, hacking groups linked to North Korea have evolved beyond technical exploits into highly organized operations. These groups rely on so-called “Chinese laundromats,” subcontracted laundering networks that use chain-hopping, fragmentation and layered intermediaries to obscure transaction trails.

TRM warned that this professionalization significantly narrows the window for law enforcement intervention, making recovery of stolen assets increasingly difficult once funds begin moving.

Regulatory Debate Intensifies

The findings arrive as U.S. lawmakers debate crypto market structure legislation, with illicit finance protections emerging as a key sticking point. Democrats have pushed for stronger safeguards against criminal use, while industry groups argue existing tools and transparency already outperform traditional finance in many areas.

As Congress continues negotiations, TRM’s report reinforces a central tension: crypto-related crime is becoming more concentrated and more sophisticated, even as it represents a shrinking slice of a rapidly growing global digital-asset economy.