Illicit cryptocurrency wallets received a record $158 billion in 2025, reversing three consecutive years of decline as Russia-linked stablecoin infrastructure dominated sanctions evasion activity, according to TRM Labs' 2026 Crypto Crime Report.
The 145% increase from $64.5 billion in 2024 stemmed primarily from concentrated Russia-linked flows rather than broad-based criminal expansion.
The ruble-pegged A7A5 stablecoin processed $72 billion alone, while the A7 wallet cluster handled $39 billion in sanctions-evading transactions.
Despite the absolute dollar increase, illicit activity declined as a percentage of overall cryptocurrency volume from 1.3% to 1.2%. TRM Labs' revised methodology shows illicit entities captured 2.7% of available crypto liquidity in 2025, down from 2.9% in 2024.
What Happened
Stablecoins facilitated 95% of inflows to sanctioned entities and jurisdictions in 2025, with USDT and A7A5 accounting for most volume.
The shift toward ruble-pegged assets reflects Russia's deliberate strategy to reduce reliance on dollar-backed payment rails.
Flows to sanctioned entities decreased 30% on cryptocurrency exchanges with know-your-customer protocols but surged over 200% on decentralized services and platforms lacking compliance standards. This bifurcation demonstrates how enforcement pressure forces illicit actors toward riskier, less regulated channels.
The increase reflects three factors: intensified sanctions designations, expanded use of cryptocurrency by nation-state actors, and improved detection through TRM Labs' Beacon Network intelligence-sharing system. Sanctions-related activity grew over 400% year-over-year, dwarfing growth in darknet markets (20%) and illicit goods sales (12%).
Read also: WisdomTree Brings Tokenized Funds To Solana As RWA Market Crosses $1B
Why It Matters
The report reveals how sanctioned states are institutionalizing cryptocurrency as core financial infrastructure rather than using it as a temporary workaround. The A7 network functions as Kremlin-backed sanctions evasion architecture connecting Russia-linked actors with counterparties across China, Southeast Asia, and Iran.
TRM Labs identified approximately 34% of A7A5 trading volume as artificially inflated through wash trading designed to build confidence in the stablecoin. On-chain analysis indicates A7A5 was used primarily for settlement between A7, Garantex, and Kyrgyzstan-based entities within the same sanctions evasion network.
Chinese-language escrow services and underground banking networks processed over $103 billion in 2025, expanding from $123 million in 2020. These services provide settlement infrastructure for scam networks, cybercrime groups, and sanctions evasion intermediaries operating across the Asia-Pacific region.
The data shows enforcement actions are reshaping where illicit activity occurs rather than eliminating it entirely. While centralized exchanges have improved transaction monitoring, decentralized services absorb displaced volume as actors adapt to heightened detection risks.
Read next: Fidelity Launches Dollar-Backed Stablecoin In Bid For $310B Market