Key Notes
- Russia-linked sanctions evasion grew over 400% year-over-year, with A7 wallets and A7A5 stablecoin processing $110 billion combined.
- Stablecoins became the primary channel for illicit transactions, routed through non-custodial services and OTC brokers to avoid seizure.
- Chinese underground banking operations expanded dramatically to $103 billion, supporting scam ecosystems and cybercriminal networks across Asia-Pacific.
The cryptocurrency transactions related to criminal activities reached a record $158 billion in 2025, reversing a multi-year decline and marking the highest level in at least five years, according to the 2026 Crypto Crime Report from blockchain intelligence firm TRM Labs.
The surge represents a roughly 145% increase from 2024 and underscores how state-linked actors and professionalized financial networks are reshaping on-chain crime. TRM Labs notes that Russia-connected structures were the primary driver of the jump, as increasingly sophisticated systems emerged to help sanctioned entities and their partners move value outside the traditional banking system.
At the same time, the share of unlawful activity in total crypto volume edged down to about 1.2% from 1.3%, reflecting faster growth in legitimate use, according to their announcement.
Annual Value Received by Illicit Wallets | Source: TRM Labs report
Russia Dominates Sanctions Evasion Growth
Russia-focused sanctions evasion activity expanded more than 400% year-over-year, anchored by what TRM describes as a centrally coordinated ecosystem built around the A7 wallet cluster and the ruble-linked stablecoin A7A5.
According to the firm, A7A5 processed over $72 billion in 2025, while A7 wallets handled at least $38 billion, supporting transactions for platforms including sanctioned exchange Garantex and related venues such as Grinex.
“The vast majority of sanctions-linked volume was connected to Russia-linked entities, including Garantex, Grinex and A7,” the report states, highlighting how geopolitical actors now dominate this segment of crypto crime.
Worth mentioning that at the end of 2025, the government of Russia also moved to open crypto buying and selling to the retail masses, as EU sanctions keep increasing.
Stablecoins Become the Preferred Criminal Rail
TRM Labs reports that stablecoins have become the preferred rail for unlawful flows, especially for embargoed or restricted entities that require liquid, dollar-linked instruments to settle cross-border trades.
Instead of relying on large, centralized exchanges, many of these networks now route funds through higher-risk non-custodial services, OTC brokers, and bespoke settlement layers designed to be more resistant to seizure or compliance controls.
It is essential to note that in 2025 their use increased significantly, pushing their market cap to more than $300 billion, and they have benefited from favorable regulations in places like the US, such as the Genius Act.
Chinese Networks and Broader Crime Trends
The report also highlights the rapid expansion of Chinese-language escrow services and underground banking operations, which processed more than $103 billion in 2025, up from around $123 million in 2020. Chainalysis recently reported a more conservative number, $82 billion in 2025, for money laundering specifically.
According to TRM Labs’ report, these channels support scam ecosystems, cybercriminals, and intermediaries in Asia-Pacific, often settling in stablecoins through OTC desks and money mule networks before payouts are converted into local currencies.
Other segments of crypto crime grew at a slower pace: darknet markets expanded about 20%, illicit goods and services around 12%, and hacked or stolen funds roughly 31%.
Increase in crypto-related crimes by type in 2025 | Source: TRM Labs report
TRM Labs says its figures are likely conservative and may be revised higher as new wallets are attributed and ongoing investigations uncover additional activity, a pattern it has observed in prior years.
The firm’s findings suggest regulators and enforcement agencies will face mounting pressure in 2026 to respond to increasingly complex, state-linked crypto infrastructures rather than only the opportunistic retail-focused scams of the past.
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
José Rafael Peña Gholam is a cryptocurrency journalist and editor with 9 years of experience in the industry. He wrote at top outlets like CriptoNoticias, BeInCrypto, and CoinDesk. Specializing in Bitcoin, blockchain, and Web3, he creates news, analysis, and educational content for global audiences in both Spanish and English.
