Crypto Crime Hits Record Levels as Nation-States Dodge Sanctions

An estimated $154 billion flowed to illicit addresses, the highest total on record and a 160% jump in illicit volumes according to data cited by Eric Jardine, head of research at Chainalysis.

But treating that number as evidence of runaway criminal adoption may miss the more consequential story. What changed in 2025 was not merely volume, but the identity of the actors, the scale at which they operated, and the implications this has for banks, regulators, and the future architecture of financial blockchain compliance.

The real inflection came from “a shift in who’s doing what,” Jardine explained, noting that in 2025, nation states, most notably Russia, began participating “in earnest in the crypto ecosystem,” primarily through sanctions evasion.

Unlike earlier state-linked activity, such as North Korea’s hacking campaigns, this was not marginal behavior at the edges of the system. It was industrial-scale financial activity conducted in plain sight.

“Sanction evasion by a nation state at scale can hit tremendously large volumes,” Jardine explained, adding blockchain finance did not suddenly become more criminal but rather more geopolitically relevant.

And while the temptation may be to treat 2025 as an outlier, a year skewed by exceptional geopolitical circumstances, Jardine stressed the opposite. The entry of nation states marks a new baseline for crypto risk, he explained, one defined less by shadowy criminals and more by macroeconomic strategy.

From Peripheral Abuse to Systemic Use

For much of the past decade, illicit crypto activity followed a predictable pattern where the underlying logic remained entrepreneurial, and profit driven. Even North Korea’s cyber operations, while significant relative to the size of its economy, remained a small fraction of global crypto flows.

Sanctions evasions have changed the math. When a sovereign actor seeks to move value at scale, the volumes involved dwarf those of traditional cybercrime. Jardine pointed to the emergence of a ruble-backed stablecoin known as the A7A5 token, which was later sanctioned by the European Union, as the clearest example.

“Once that happened at scale,” he said, “you were starting to see about $2 billion a week being processed via that token.”

“With nation state actors,” Jardine added, “the resources that support their efforts are significantly higher than you’d find with most run-of-the-mill illicit actors.”

This shows up clearly in laundering patterns. In a December analysis of North Korean operations, Chainalysis found that DPRK-linked groups move funds on a different cadence, use different services, and exhibit a level of strategic patience rarely seen elsewhere.

The Russian-linked stablecoin activity followed a similar logic. Once deployed, the system could operate continuously, processing billions in value without reliance on traditional correspondent banking networks. The result was a dramatic concentration of illicit volume in a single instrument, something rarely seen elsewhere across the fragmented world of cybercrime.

Stablecoins and the Illicit Infrastructure Dilemma

The Chainalysis report’s headline numbers inevitably raise questions about stablecoins, which now account for roughly 60% of illicit crypto activity, a share that jumped further in 2025 due to the Russian-linked A7A5. For banks and issuers, the optics are uncomfortable.

But Jardine cautioned against mistaking correlation for causation.

“It is, typically speaking, the thing that most people are using,” he said, noting that stablecoins dominate legitimate crypto transactions as well, precisely because they function as a reliable medium of exchange.

If anything, the dominance of stablecoins reflects a convergence between legitimate and illicit use cases. Criminals and sanctioned entities choose them for the same reasons businesses do: price stability, liquidity and ease of transfer.

These preferences tie into another defining feature of the current landscape, which is the maturation of illicit services. Crypto crime has entered what Jardine calls a “professionalized phase,” marked by specialized providers offering laundering, hosting and operational support to both financially motivated criminals and state-aligned actors.

From an enforcement perspective, this concentration cuts both ways. On one hand, it creates leverage. Large services require liquidity, and liquidity attracts more users, producing what Jardine described as a “magnet effect.” Disrupting a single hub can generate “disproportionately large ripples.”

On the other hand, sophistication brings resilience. These services invest heavily in operational security and often operate from jurisdictions that are “unable or unwilling to act,” he said, noting that where jurisdictional alignment is absent, even highly visible but illicit services can persist.

It also means that the governance challenge has shifted. Enforcement tools designed for small, fast-moving actors may be ill-suited to sovereign-scale behavior.

Transparency as a Strategic Compliance Advantage

For traditional financial institutions, the scale of illicit crypto activity can feel like a warning sign. But the unique technical composition of the blockchain’s reliance on distributed ledger technology means that it should be read differently.

“The transparency of the blockchain actually provides a tremendous advantage when it comes to things like AML compliance or fraud prevention,” Jardine explained. “We’re able to view every transaction in perpetuity from the start of time through the end of time.”

That level of visibility into sanctioned mechanisms has no direct analogue in traditional finance, where closed order books and siloed data can limit oversight.  On the blockchain, once an asset is sanctioned, detection becomes binary.

“You can’t receive this token without it being, per se, a sanctions violation,” Jardine said.

The same logic applies to fraud prevention. If an address is associated with a known scam, transactions can be halted before funds leave a customer’s account.

As Jardine put it, the scale of crypto crime “might at first seem large,” but it is inseparable from the visibility that produced it.