State Linked Actors Drive Rise in Illicit Crypto Activity: Report

A new report from blockchain intelligence firm Chainalysis revealed that illicit activity on public crypto and blockchains reached a new peak in 2025. This comes as sanctioned states increasingly use cryptocurrency to bypass global financial restrictions. 

The data shows that state-linked networks, rather than individual criminals, now account for much of the growth in illegal onchain activity.

Illicit Crypto Use Rises in 2025 With a Twist

According to Chainalysis’ latest report, illicit crypto addresses received about $154 billion in 2025. This represents a 162% increase compared with the revised total from the previous year. 

The rise was mainly driven by activity connected to sanctioned entities and state-led efforts to avoid financial restrictions. Chainalysis explained that this number is a lower estimate. 

As more illicit addresses are discovered and past transactions are reviewed, the total amount linked to illegal activity is likely to increase. Similar revisions happened in earlier years as investigations improved and more data became available. 

Even with the sharp increase in value, illicit transactions made up less than 1% of all crypto transaction volume in 2025. This shows that most blockchain activity remains legal and transparent. 

Chainalysis also noted that its analysis focuses on crimes that take place directly on blockchain networks. Crimes where digital assets are used only as a payment method, such as traditional drug trading, are usually excluded from analysis. 

This is because blockchain data alone cannot clearly distinguish these transactions from legitimate ones.

Government-Linked Networks Lead Illicit Activity

Reportedly, a limited number of government-connected groups were responsible for a large share of illicit onchain activity in 2025. These included networks linked to North Korea, Russia, Iran, aligned groups, and Chinese money laundering organizations.

North Korea-linked hackers stole about $2 billion worth of digital coins during the year. Experts say 2025 was these notorious groups’ most damaging year so far, both in terms of value and technical ability. 

Most of the stolen funds came from the February attack on the Bybit exchange, which led to nearly $1.5 billion in losses and became one of the largest digital thefts in the history of cryptocurrency.

Russia Used Stablecoins to Bypass Sanctions

Russia played a major role in illicit onchain activity through the use of the ruble-backed A7A5 stablecoin. Chainalysis found that the token processed more than $93 billion in transactions in its first year after launching in February 2025. This happened despite increased global enforcement efforts.

Regulators stated that the stablecoin was created to help Russian users move money across borders while avoiding sanctions. The United States imposed sanctions on the network behind A7A5 in August 2025. 

The European Union followed with its own sanctions in October 2025, describing the token as an important tool for financing activities linked to the war.