TL;DR
- TRM Labs recorded a rebound in crypto-related crime in 2025. A total of $158 billion was moved, although that amount accounted for just 1.2% of overall market volume.
- The report identified large flows linked to sanctions imposed on Russia.
- Hacks generated losses of nearly $3 billion.
TRM Labs reported a rebound in crypto-related crime in 2025 after several years of decline. According to the firm’s annual report, criminal actors moved $158 billion in digital assets during the year. Despite the increase in absolute terms, that activity represented only 1.2% of total crypto market volume.
The report notes that the expansion of the legitimate ecosystem largely explains the relative decline in illicit activity. In 2025, global stablecoin transaction volumes reached roughly $4 trillion, pushing overall onchain activity higher and diluting the percentage share of criminal use. Even so, TRM emphasized that the absolute value linked to various crimes increased again after several years of contraction.
The profile of the perpetrators also changed. The report describes a higher level of professionalization in illicit operations, involving complex, state-backed infrastructure, transnational laundering networks, and coordinated schemes designed to evade controls. TRM identified a sharp increase in activity tied to international sanctions, driven primarily by flows associated with Russia.
Russia, China, and North Korea
According to the data analyzed, around $72 billion flowed through the ruble-backed stablecoin A7A5. The wallet cluster known as A7 is believed to be connected to more than $39 billion in transactions aimed at evading sanctions imposed on Russia.
Meanwhile, hacks and exploits caused losses of nearly $3 billion in 2025. The total exceeded the previous year, although roughly half of the amount stemmed from a single attack in February targeting Bybit. About 150 incidents were recorded over the year, with damage concentrated in a small number of large-scale events.
Professionalization of Crypto Crime
TRM highlighted that the most sophisticated groups, particularly those linked to North Korea, have shifted their tactics. These operations no longer focus solely on exploiting code vulnerabilities, but instead target the operational infrastructure of crypto services and the systems around them. The report pointed to the use of laundering networks in China, where intermediaries fragment stolen funds and apply chain-hopping techniques to make tracking more difficult.
It is also worth noting that the criminal use of cryptocurrencies is being actively debated within the U.S. legislative branch. Market structure bills currently under discussion include ongoing debates around controls aimed at curbing illicit finance
