How global sanctions are reshaping illicit crypto activity

• Chainalysis recorded $154 billion in illicit inflows, driven largely by sanctioned entities.
• Russia’s ruble-backed A7A5 token processed over $93.3 billion in transactions within a year.
• Illicit transactions remain under 1% of total on-chain activity despite rapid growth.

Illicit cryptocurrency activity expanded rapidly in 2025, not because of a sudden spike in everyday crypto crime, but due to a structural shift in how sanctioned states and entities are moving money.

As global financial restrictions widened, blockchain networks increasingly became an alternative channel for cross-border transfers that are harder to block or monitor through traditional systems.

A new report from Chainalysis shows that this change is altering the shape, scale, and participants of the illicit crypto ecosystem.

Illicit crypto addresses received at least $154 billion during 2025, a 162% jump from $59 billion in 2024.

Chainalysis attributed much of this growth to sanctioned actors moving funds on-chain at scale.

While illicit activity still represents less than 1% of total crypto transactions, its rapid expansion highlights how sanctions policy is influencing blockchain usage in ways not seen in previous years.

Sanctions push activity on-chain

Chainalysis described 2025 as a turning point, marked by unprecedented volumes linked to nation-state behaviour.

Unlike earlier phases dominated by hacks, scams, and darknet markets, recent activity has shown higher levels of coordination and technical sophistication.

This reflects growing familiarity with blockchain tools among sanctioned entities facing restricted access to the global banking system.

The scale of sanctions worldwide has risen sharply.

The Global Sanctions Inflation Index estimated in May that nearly 80,000 individuals and entities are currently under sanctions.

Separate research from the Center for a New American Security found that the United States added 3,135 entities to its Specially Designated Nationals and Blocked Persons List in 2024, the highest annual total ever recorded.

This expanding sanctions environment has increased incentives to seek alternative settlement systems.

Russia’s growing role

One of the most prominent contributors to the rise in illicit crypto flows was Russia, which has faced extensive international sanctions since it invaded Ukraine.

In February 2025, Russia launched a ruble-backed digital token known as A7A5.

According to Chainalysis, the token processed more than $93.3 billion in transactions in less than a year.

The use of a state-linked token illustrates how sanctioned governments are experimenting with blockchain-based instruments to maintain trade and financial connectivity.

This approach differs from earlier crypto usage patterns, where states were largely indirect beneficiaries of illicit networks rather than active participants in token-based systems.

Stablecoins take centre stage

Stablecoins played a dominant role in illicit crypto activity throughout 2025, accounting for 84% of total illegal transaction volume.

Chainalysis linked this to their price stability, high liquidity, and ease of cross-border transfer.

These same characteristics that support legitimate payments and remittances have also made stablecoins attractive to sanctioned users seeking predictable settlement.

The growing reliance on stablecoins signals a shift away from volatile assets for illicit transfers.

Rather than speculative trading, the focus has moved toward efficiency, reliability, and scale, particularly for large-value transactions involving sanctioned entities.

Crime remains a smaller share

Despite record illicit volumes, Chainalysis stressed that criminal activity still accounts for a small fraction of the broader crypto economy.

Overall, on-chain activity expanded significantly during the year, keeping illicit transactions below 1% of total volume, even as their absolute value surged.

Other forms of crypto-related crime persisted alongside sanctions-driven flows.

Blockchain security firm PeckShield documented over 20 major exploits in December, including address-poisoning scams and private-key leaks that led to losses of tens of millions of dollars.