Illegal cryptocurrency flows reached a record $158 billion in 2025, reversing a three-year trend of declining amounts from $86B in 2021 to $64B in 2024.

This sharp 145% increase is being reported by blockchain intelligence experts at TRM Labs, who noted that it comes despite the illicit activity share of the total on-chain volume actually falling slightly from 1.3% in 2024 to 1.2% in 2025.

According to TRM Labs, the spike in volumes can be attributed to:

• A surge in sanctions-linked crypto activity, overwhelmingly driven by Russia-associated networks such as A7 and the A7A5 stablecoin, following new sanctions designations and improved attribution of already-sanctioned actors.
• Expanded use of cryptocurrency by nation-states and state-aligned actors, with Russia, Iran, and Venezuela using crypto as core financial infrastructure, alongside large-scale settlement activity through China-linked escrow and underground banking networks.
• Improved attribution and faster intelligence sharing, including TRM’s own tools, which surfaced previously unattributed illicit flows and accelerated the identification of sanctions-related activity, major hacks, and blocklisted entities.

Hacks, scams, and ransomware

TRM Labs has recorded a total of $2.87 billion in losses from 150 hacking incidents in 2025, with the top 10 accounting for 81% of all stolen value.

The most prolific was the February 2025 Bybit breach, attributed to North Korean hackers, which resulted in approximately $1.46 billion in losses.

Scam activity remained very high in 2025, with approximately $35 billion in cryptocurrency sent to fraud schemes throughout the year.

The sector was dominated by investment scams, which accounted for 62% of total inflows, including romance baiting, Ponzi schemes, and fake task scams.

TRM Labs observed a rise in the organization, professionalism, quality, and outreach of these scams, believed to be a result of using AI tools.

Finally, ransomware-linked cryptocurrency inflows remained elevated over the past year, although they did not reach the levels seen in previous years.

Although 2025 was a record year for victims listed on extortion portals, it appears that more and more victims are now resisting paying ransom to cybercriminals.

TRM Labs also observed unprecedented ecosystem fragmentation, with 161 active strains and 93 variants added in 2025 alone.

Ransom laundering operations continued to evolve last year, with mixer usage falling by 37%, while bridge usage and cross-chain routing increased by 66%.