Crypto Crime Hits $154B as State Actors Weaponize Stablecoins

Illicit crypto volume didn’t just rise in 2025; it mutated. The Chainalysis 2026 Crypto Crime Report reveals illicit addresses received $154 billion last year, a 162% spike from 2024. But the headline number hides the real story: retail scams are being eclipsed by industrial-scale sanctions evasion and state-sponsored theft.

The Sanctions Evasion Machine

The days of mixing services being the primary vector are over. The report identifies Russia’s A7A5 token as the year’s most significant compliance failure. Launched in February 2025 specifically to circumvent financial blockades, this ruble-backed stablecoin processed $93.3 billion in under 11 months.

This represents a 694% increase in value received by sanctioned entities year-over-year.

This isn’t a shadowy darknet currency. It is state-level infrastructure operating in plain sight, forcing Western regulators to confront a parallel financial system that no longer relies on the SWIFT network.

North Korea’s $2 Billion Year

DPRK-linked operatives successfully stole $2 billion in 2025, with a single event dominating the statistics: the February exploit of Bybit, which drained nearly $1.5 billion. This single breach accounts for the majority of the year’s theft volume, signaling a shift in tactics from high-frequency, low-value hacks to “big game hunting” of centralized exchanges.

The Infrastructure Layer

Volume is moving to stablecoins, which now constitute 84% of all illicit transaction volume. The report notes that Chinese money laundering networks (CMLNs) have solidified their role as the “dominant force” in this ecosystem, providing the off-ramps necessary to convert billions in stolen stablecoins into fiat currency.

For compliance desks at major venues like Coinbase and Binance, the directive is clear: the adversary is no longer just a hacker in a basement, but a sovereign state.