TL;DR
- Sanctioned entities received at least $104 billion in crypto during 2025.
- Total illicit on-chain volume hit a record $154 billion last year.
- Russia, Iran, and North Korea drove the massive surge in sanctions evasion.
Sanctioned entities received at least $104 billion in cryptocurrency during 2025, an almost eightfold increase over the prior year, according to a new report from blockchain analytics firm Chainalysis. The figure pushed total illicit on-chain volume to a record $154 billion, marking the highest level ever documented and confirming that heavily sanctioned states now treat cryptocurrency as a core component of their national financial architecture.
The three primary actors driving the surge — Russia, Iran, and North Korea — each expanded their crypto operations through distinct but complementary methods. Together they demonstrate how state-level actors adapted digital asset infrastructure to replace traditional banking channels that international sanctions cut off.
At the center of Russia’s operation sits A7A5, a ruble-pegged stablecoin registered in Kyrgyzstan that processed $93.3 billion in transactions in less than a year. Chainalysis describes the token as a settlement rail that sanctioned Russian businesses use to conduct cross-border trade, effectively substituting for the correspondent banking relationships the country lost after 2022. The exchanges Grinex and Meer, both linked to A7A5, handled billions in transactions before the U.S. and European Union imposed sanctions on them directly.
The report also identifies an “A7A5 Instant Swapper” service that converts the ruble-pegged token into mainstream dollar-denominated stablecoins with minimal or no identity verification requirements. The service processed more than $2.2 billion, giving sanctioned entities a pathway into the broader crypto market without passing through compliance checkpoints. A7A5’s director for regulatory affairs, Oleg Ogienko, disputed the characterization, calling the Chainalysis findings politically motivated and stating the token operates in full compliance with Russian, Kyrgyz, and partner-country legislation.
Stablecoins Now Carry 84% of All Illicit Crypto Transaction Volume
The structural shift inside crypto crime deserves as much attention as the headline numbers. Stablecoins account for roughly 84% of illicit transaction volume — a concentration that reflects a deliberate choice by sanctioned actors rather than a coincidence. Dollar-pegged assets offer the liquidity, stability, and transferability that volatile cryptocurrencies cannot guarantee, making them the preferred instrument for moving large sums across borders without price risk complicating the operation.
Iran’s Islamic Revolutionary Guard Corps, designated a terrorist organization across multiple jurisdictions, accounted for more than 50% of value received by Iranian services by late 2025. The IRGC moved over $3 billion tied to regional proxy financing, oil trade, and procurement networks — a scale of operation that requires the kind of reliable, liquid instruments stablecoins provide.
North Korea maintained its position as the most aggressive state-linked cyber theft actor on record. The country’s operatives stole more than $2 billion in cryptocurrency during 2025, including $1.5 billion taken in a single attack on the Bybit exchange — the largest digital asset theft ever recorded. The Bybit hack alone exceeded the total cryptocurrency theft figures reported for entire years in previous periods, illustrating both the growing sophistication of North Korean cyber operations and the expanding pool of assets available to target.
The Chainalysis findings align closely with a February report from TRM Labs, which found illicit entities received $141 billion in stablecoins — the highest level in five years. TRM attributed 86% of those flows to sanctions-related activity, with approximately $72 billion linked to the A7A5 token specifically.
The record numbers raise a question the sanctions architecture has not yet answered: when sanctioned states integrate crypto deeply enough into their trade and financial systems, the traditional enforcement tools — freezing correspondent bank accounts, cutting off SWIFT access, pressuring intermediaries — lose their reach.
Stablecoins issued on public blockchains settle without correspondent banks, and conversion services with minimal identity checks bridge the gap between sanctioned networks and the broader market.
The 700% increase in sanctions evasion activity is not a temporary spike. It reflects an infrastructure build-out that took years and now operates at a scale that makes reversal considerably harder than prevention would have been.
