Illicit Crypto Inflows Explode to $158 Billion in 2025, Surging 145% from Previous Year’s $64.5 Billion

Crypto's shadow economy just got a whole lot bigger.

The Dirty Money Floodgates Are Open

Forget whispers in darknet forums—this is a tidal wave. The latest figures paint a stark picture of a parallel financial system growing at a breakneck pace, one that traditional oversight mechanisms are struggling to contain. The scale of the shift isn't incremental; it's exponential.

Following the (Digital) Money

While the raw numbers are staggering—a jump from tens of billions to well over a hundred billion—they tell a deeper story about adoption, liquidity, and, yes, vulnerability. Sophisticated obfuscation techniques, cross-chain bridges, and privacy tools are being leveraged at an industrial scale. It's a high-stakes game of cat and mouse where the mice are building faster tunnels every day.

Regulation Plays Catch-Up

Law enforcement and regulators are scrambling. New tracing tools hit the market, compliance mandates tighten for exchanges, and international task forces form—yet the volume climbs. It's the ultimate stress test for the 'regulated crypto' narrative, exposing the gap between policy announcements and on-chain reality. Some traditional finance veterans might smugly call it growing pains—right before their own AML systems get a costly upgrade notice.

The narrative is no longer about if crypto is used for illicit activity, but about how the ecosystem responds to its own explosive success. Transparency advocates see a call to arms for better analytics. Critics see confirmation of every worst fear. One thing's clear: the stakes for the entire digital asset class just got a lot higher.

Russia-linked wallets dominated 2025’s illicit crypto flows, says TRM

TRM’s report said only 1.5% of all known crypto traffic in 2025 was dirty, down from 1.7% in 2024 and way lower than 3.5% in 2023.

Same thing happened with incoming money, where only 2.7% of new flows went to bad wallets, down from 2.9% the year before and 6.0% in 2023.

So there’s more crime in dollar terms, but less compared to how much clean money is flying around.

One Russia-linked token called A757 got $72 billion in dirty money, and another $39 billion was sent straight to the A7 wallet group, which means over 80% of all sanctions-linked volume was connected to Russian players.

TRM named Garantex, Grinex, and A7 as key players. A wallet is one thing, but TRM also flagged a token called A7A5, a ruble-backed stablecoin tied to Russia’s larger game plan: cut out the US dollar and build their own rails. The A7 wallets are mostly for sanctions dodging, but A7A5 was used in all kinds of official flows.

TRM alleged that 95% of all cash going to these sanctioned wallets came in through stablecoins. That tells you the tools have changed. These people know how to hide, and they’re using stablecoins to stay under the radar. Sanctions are stricter now. So they’ve shifted to smaller, riskier platforms that don’t play by the rules.

In Venezuela, the government allegedly used crypto to keep the lights on since banks are frozen there. So they turned to tokens for state payments, remittances, and whatever else they could sneak through.

TRM also pointed at Chinese-language escrow services and underground banks being used by scammers, hackers, and sanctions dodgers.

In 2020, that activity was around $123 million, but now it’s over $103 billion. These services MOVE huge amounts of stablecoins into legit systems, through over-the-counter brokers, money mules, and casinos in Asia, according to TRM.

Enforcement speeds up and dirty wallets get caught faster

TRM broke the numbers down by crime type. Sanctions violations grew more than 400%. Blocklisted wallets went up 32%. Hacked or stolen money ROSE 31%. Darknet markets added 20%. Sales of illegal goods and services rose 12%.

This wasn’t because criminals got better. TRM said the difference was faster enforcement. Beacon Network made it easier for investigators to connect the dots across countries. It didn’t change what’s defined as “illicit,” but it sped up how fast dirty wallets got tagged.

Stablecoin companies joined in too. TRM said Tether in particular started going after bad wallets linked to terrorism, scams, and hacks. That helped explain why so many of the flagged transactions involved stablecoins. Enforcement is getting smarter and faster.

TRM also updated how it counts crime. They used to compare illicit crypto activity to total blockchain traffic. That made crime look smaller because bots, trading firms, and exchanges inflate volume with fake trades and rapid moves.

Now, TRM compares illicit money to cash actually leaving VASPs, real providers like exchanges. That shows what part of real usable money is going to bad actors. If $100 comes in and $20 ends up in criminal wallets, that’s a real 20% risk. Doesn’t matter how many times the same $100 got bounced around.

TRM also removed fake volume from the math; stuff like wash trading, peel chains, and internal movements. These things don’t add capital. They just move it in circles to boost stats. That junk is gone from the new model.

They said the numbers are conservative. They don’t include fiat crimes that later turned crypto, or unaudited wallets. They also skipped laundering chains. They only tracked income, not what happened after the money was moved around.

TRM said these totals are going to go up later. New wallets always get found after the fact. Investigations take time. Sanctions get updated. Court records get unsealed. So what’s $158 billion today might be more tomorrow.

If you're reading this, you’re already ahead. Stay there with our newsletter.