Catenaa, Monday, January 12, 2026-Illicit activity on blockchain networks reached $154 billion in 2025, a 162% increase from the previous year, as state-linked actors and organized criminal networks scaled operations onchain, according to a Chainalysis report.
The blockchain intelligence firm said the total represents a lower-bound estimate, noting ongoing identification of illicit addresses could raise the figure further.
While the nominal value set a record, the share of illicit activity remains under 1% of all cryptocurrency transaction volume.
State-affiliated actors accounted for a significant portion of the growth. North Korean hackers stole roughly $2 billion, including $1.5 billion from the February Bybit exploit.
Russian networks leveraged the ruble-backed A7A5 stablecoin for more than $93 billion in transactions, despite sanctions from the US and EU targeting its use for evading restrictions tied to military aggression. Iranian proxies and Chinese money laundering networks also contributed billions to illicit onchain activity.
Stablecoins dominated the illicit market, representing 84% of all criminal transaction volume, according to Chainalysis.
The report highlighted that criminals increasingly rely on full-service infrastructure providers offering exchange access, laundering services, and hosting designed to resist enforcement efforts. Ransomware operators, scam networks, and state-aligned actors commonly utilize these providers.
Chainalysis also noted a growing link between onchain crime and physical violence, including coercive attacks and human trafficking aimed at forcing victims to transfer cryptocurrency, often coinciding with heightened market activity.
The report emphasizes the professionalization of illicit crypto operations and the rising role of sovereign states in circumventing global financial restrictions, signaling an evolving threat landscape for regulators and law enforcement agencies worldwide.
