Sanctions Fuel Record-Breaking Illicit Crypto Activity in 2025

Sanctions aren't stopping bad actors—they're just pushing them into crypto. A new report reveals that 2025 saw illicit cryptocurrency transactions hit an all-time high, driven by sophisticated actors using digital assets to bypass traditional financial blockades.

The New Playbook for Evasion

Forget the dark web drug markets of yesteryear. Today's illicit crypto flow is dominated by state-sponsored actors and sanctioned entities moving capital at scale. They're leveraging privacy tools, cross-chain bridges, and decentralized exchanges that leave compliance officers chasing ghosts across a hundred different ledgers.

Regulators Playing Whack-a-Mole

Every new compliance rule seems to birth three new evasion techniques. Targeted sanctions create immediate demand for censorship-resistant rails—a demand the crypto ecosystem, in its relentless pursuit of permissionless innovation, is all too happy to supply. It's a cat-and-mouse game where the mouse has infinite tunnels.

The Transparency Paradox

Here's the ironic twist: the very transparency of blockchains—the feature touted as crypto's ultimate compliance weapon—is being weaponized. Analysts can trace the funds, watching them hop from chain to chain, but identifying the human behind the address remains the billion-dollar question. The ledger remembers everything, but explains nothing.

A cynical take? Traditional finance spends decades building a regulatory moat, only for crypto to sell the invaders the ladders—and charge them a gas fee for the privilege. The numbers don't lie: when you build a wall, you create a market for the best climbers. And in 2025, business was booming.

Chainalysis Flags 2025 as a Turning Point for Illicit State-Linked Crypto Activity

Chainalysis described 2025 as a turning point, citing “unprecedented volumes associated with nation-states’ on-chain behavior” and calling it the latest phase in the evolution of the illicit crypto ecosystem.

Analysts said the scale and coordination of activity stood apart from prior years, reflecting growing sophistication among sanctioned actors.

A major contributor was Russia, which has faced sweeping international sanctions since its invasion of Ukraine.

In February 2025, the country launched a ruble-backed token known as A7A5. In less than a year, the token processed more than $93.3 billion in transactions, highlighting how state-linked crypto initiatives are increasingly used to route value outside traditional financial rails.

The expansion of sanctions worldwide has also intensified pressure on sanctioned parties to seek alternative payment systems.

The Global Sanctions Inflation Index estimated in May that nearly 80,000 entities and individuals were under sanctions globally.

Meanwhile, research from the Center for a New American Security found that the United States alone added 3,135 entities to its Specially Designated Nationals and Blocked Persons List in 2024, the highest annual total on record.

In the introductory chapter to our 2026 Crypto Crime Report, we reveal that illicit cryptocurrency transactions received at least $154 billion in 2025 (a 162% YoY increase). Nation-state activity and sanctions evasion drove the surge, marking a new phase in crypto crime. Read… pic.twitter.com/gedfxuDgUs

Stablecoins have emerged as the primary tool in illicit crypto flows, mirroring trends across the broader market.

Chainalysis reported that stablecoins accounted for 84% of all illicit transaction volume in 2025, driven by their price stability, ease of cross-border transfer, and widespread liquidity.

The firm noted that the same features fueling legitimate adoption have also made stablecoins attractive to sanctioned users.

Despite the sharp rise in illicit volumes, Chainalysis stressed that criminal activity remains a small fraction of the overall crypto economy.

Illicit transactions still account for less than 1% of total on-chain activity, even as their share edged slightly higher year over year.

PeckShield Reports Spike in Address-Poisoning and Key-Leak Exploits

Blockchain security firm PeckShield documented 26 major exploits in December, with address-poisoning scams and private-key leaks accounting for substantial losses.

One victim lost $50 million after mistakenly copying a fraudulent address that visually mimicked their intended destination.

Another major incident involved a private key leak tied to a multi-signature wallet, resulting in losses of approximately $27.3 million.

The industry’s vulnerability extends beyond technical exploits to social engineering schemes, with Brooklyn resident Ronald Spektor facing charges for allegedly stealing $16 million from roughly 100 Coinbase users by impersonating company employees.