A new report from blockchain analytics firm Chainalysis reveals a significant escalation in state-level cryptocurrency activity during 2025, marking a mature phase in the evolution of the illicit on-chain ecosystem. The professionalization of crypto crime has deepened, with illicit organizations now operating large-scale infrastructure to procure goods and launder proceeds for transnational criminal networks. Governments are increasingly leveraging these established service providers and building custom infrastructure to evade sanctions at scale, posing severe challenges to consumer protection and national security. According to the data, illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase. This surge was primarily driven by a 694% spike in inflows to sanctioned entities. Even excluding these state-linked flows, 2025 was a record year for crypto crime, with most illicit categories showing growth. However, illicit activity remains a small fraction of the overall crypto economy, accounting for less than 1% of all traceable transaction volume. A key trend is the dominance of stablecoins in illicit finance, now comprising 84% of all illicit transaction volume. This mirrors broader ecosystem adoption, where stablecoins are favored for cross-border transfers, low volatility, and wide usability. The report highlights several defining trends for 2025: 1. **Nation-State Threats Amplify Volumes:** North Korea-linked hackers stole a record $2 billion, including the nearly $1.5 billion attack on Bybit in February – the largest digital asset theft in history. Russia’s implementation of its 2024 crypto-for-sanctions law, marked by the launch of the ruble-backed A7A5 token, generated over $93.3 billion in transaction volume within a year. Iranian proxy networks have laundered over $2 billion for oil sales and weapons procurement. Meanwhile, sophisticated Chinese money laundering networks have become dominant players, offering specialized ‘crime-as-a-service’ for fraud, sanctions evasion, and terrorism financing. 2. **Full-Stack Illicit Infrastructure Providers:** Both criminals and state actors increasingly rely on comprehensive infrastructure providers offering domain registration, bulletproof hosting, and other technical services that enable malicious cyber activity. These resilient platforms are becoming key enablers for expanding the scope of economic crime and state-sponsored operations. 3. **Growing Nexus with Physical Crime:** The link between on-chain activity and real-world violence is strengthening. Cryptocurrency is increasingly used by human trafficking rings, and there has been a notable rise in violent ‘crypto-jacking’ attacks, where victims are physically coerced into transferring assets, often during periods of high crypto prices. The report concludes that collaboration between law enforcement, regulators, and crypto businesses is critical to counter these evolving, interconnected threats. While illicit activity remains a small percentage of total volume, maintaining the integrity and security of the cryptocurrency ecosystem is more crucial than ever.
