Building on late-2025 reports of record $2.7 billion in cryptocurrency heists, illicit addresses received at least $154 billion in 2025—a 162% year-over-year increase—according to the introduction to Chainalysis's 2026 Crypto Crime Report, published January 8, 2026. The surge was driven by a 694% rise in funds to sanctioned entities, with growth across most illicit categories even excluding that factor. The report emphasizes the professionalization of crypto crime, including nation-state involvement and specialized laundering services.
The Chainalysis report details how the crypto crime landscape matured in 2025, with illicit organizations building large-scale on-chain infrastructure for transnational criminals to procure goods, services, and launder funds. Nation-states increasingly tapped into these networks, heightening risks for consumer protection and national security.
Key drivers included nation-state activities. As covered in prior reports on 2025 heists, North Korean hackers stole $2 billion—their tactics showing unprecedented sophistication in intrusions and laundering. Russia advanced sanctions evasion via its ruble-backed A7A5 token, launched in February 2025, which processed over $93.3 billion in transactions within a year. Iran's proxy networks, including Lebanese Hezbollah, Hamas, and the Houthis, laundered more than $2 billion for illicit oil sales, arms procurement, and other activities through sanctioned wallets, achieving unprecedented scales despite military challenges.
Chinese money laundering networks emerged as a dominant force, offering laundering-as-a-service for fraud, scams, North Korean proceeds, sanctions evasion, and terrorist financing. These evolved from prior operations like Huione Guarantee into full-service criminal enterprises.
Traditional cybercrimes persisted, supported by full-stack infrastructure providers for domain registration, bulletproof hosting, and evasion of takedowns. These enablers backed ransomware, child sexual abuse material platforms, malware, and illicit marketplaces.
The report also notes growing links to violent crimes, including human trafficking via crypto and physical coercion attacks aligned with cryptocurrency price peaks.
Despite the increases, illicit volumes remained below 1% of total attributed crypto transactions, dwarfed by legitimate activity. Stablecoins comprised 84% of illicit volumes, reflecting their dominance in the ecosystem for cross-border ease and stability. Chainalysis stresses the need for cooperation among law enforcement, regulators, and crypto firms to counter these threats.
