Illicit cryptocurrency activity reached a record $154 billion in 2025, a 162% year-over-year increase driven by nation-state sanctions evasion, professionalized laundering-as-a-service networks, and the February 2025 Bybit hack that alone transferred $1.5 billion in a single theft. The on-chain money laundering ecosystem has expanded eightfold since 2020, from $10 billion to over $82 billion in laundered funds in 2025, as Chinese money laundering networks, Russian state-backed stablecoin schemes, and Southeast Asian guarantee platforms have industrialized the movement of illicit capital at a scale that rivals the balance sheets of mid-sized financial institutions.
At KoinX, we produce this reference article as part of our commitment to building infrastructure that supports legitimate crypto tax compliance and helps the industry distinguish clean transaction histories from flagged addresses. The statistics below are drawn exclusively from primary sources: blockchain analytics firms’ own research datasets, regulatory agency enforcement records, intergovernmental compliance assessments, and government financial intelligence publications.
Scope and Methodology
Statistics are drawn from primary sources: Chainalysis 2026 Crypto Crime Report introduction (published January 8, 2026), Chainalysis 2025 Crypto Crime Report introduction, Chainalysis 2026 crypto money laundering report, Chainalysis blog posts on Huione Group and pig butchering, TRM Labs 2025 Crypto Crime Report, FATF 2025 Sixth Targeted Update on Virtual Assets and VASPs (published June 2025), FATF 2024 Targeted Update, IRS-CI FY2025 Annual Report, IRS enforcement press releases, FinCEN Huione Group NPRM (May 2025), Kroll Financial Compliance Regulation analysis (citing Napier AI and UN estimates), SlowMist 2025 Blockchain Security and AML Annual Report, and Chainalysis seizable crypto assets analysis (July 2025).
Global Illicit Crypto Volume Statistics
Illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase from the revised $57.2 billion recorded in 2024, based on the Chainalysis 2026 Crypto Crime Report published January 8, 2026.
Despite record illicit volumes, crypto crime still represents less than 1% of all attributed cryptocurrency transaction volume in 2025, with global crypto total transaction volumes exceeding $10.6 trillion in 2024 alone, a 56% increase from 2023, based on the TRM Labs 2025 Crypto Crime Report.
TRM Labs independently identified a record $158 billion in illicit crypto flows in 2025, reversing a multi-year decline; illicit transactions as a share of total volume fell from 0.61% in 2023 to 0.14% in 2024, before rising again in 2025 as nation-state activity dominated, based on TRM Labs’ reports and whitepapers page and Chainalysis 2025 Crypto Crime Report.
The on-chain money laundering ecosystem grew eightfold from $10 billion in 2020, with Chinese-language money laundering networks emerging as the fastest-growing segment at a rate 7,325 times faster than inflows to centralized exchanges since 2020, based on Chainalysis’s 2026 crypto money laundering report.
In 2024, illicit cryptocurrency transactions experienced a decline of 51% to $45 billion, representing approximately 0.4% of total transaction volume; however, Chainalysis historically revises annual illicit figures upward by an average of 25% per reporting period, meaning 2024 totals were expected to eventually surpass the $51 billion threshold, based on the TRM Labs 2025 Crypto Crime Report and Chainalysis 2025 Crypto Crime Report.
Stablecoins accounted for 84% of all illicit crypto transaction volume in 2025, up from 63% in 2024, continuing a multi-year shift away from Bitcoin as the preferred asset for sanctioned entities and money launderers seeking price stability and ease of cross-border transfer, based on the Chainalysis 2026 Crypto Crime Report.
Illicit entity balances of BTC, ETH, and stablecoins reached almost $15 billion as of July 2025, a 359% surge from balances observed in 2020, with nearly 95% of stablecoin balances drained within 90 days after an entity’s last inflow, and only 29.5% of wallets maintaining any stablecoin balance after 1 year, based on Chainalysis’s July 2025 analysis of seizable crypto assets.
Nation-State and Sanctioned Entity Activity
Russia’s ruble-backed A7A5 token transacted over $93.3 billion in its first year of operation after launching in February 2025, accounting for the single largest component of the 694% increase in sanctioned entity activity; the U.S. Office of Foreign Assets Control sanctioned the A7A5 network on August 14, 2025 and the European Union designated it on October 23, 2025, based on the Chainalysis 2026 Crypto Crime Report.
North Korean hackers stole $2 billion in cryptocurrency in 2025, a 51% increase from the $1.34 billion stolen in 2024, pushing their cumulative all-time total to $6.75 billion; the February 2025 Bybit exploit was identified as the largest single digital asset theft in history, based on the Chainalysis 2026 Crypto Crime Report and FATF’s 2025 Sixth Targeted Update.
Only 3.8% of the $1.46 billion stolen from Bybit in February 2025 had been recovered as of the FATF 2025 Targeted Update publication in June 2025, highlighting the critical asset recovery gap in cross-border cryptocurrency enforcement, based on the FATF 2025 Sixth Targeted Update on Virtual Assets and VASPs.
In 2024, DPRK-linked hackers accounted for approximately 35% of all cryptocurrency stolen funds, with attacks averaging nearly 5 times larger than those by other actors, and total DPRK-linked theft reaching approximately $800 million in incidents where TRM Labs had moderate or higher confidence, based on the TRM Labs 2025 Crypto Crime Report.
Iran-aligned terrorist organizations including Lebanese Hezbollah, Hamas, and the Houthis used cryptocurrency at scales described as unprecedented in 2025, while Iranian proxy networks collectively moved over $2.3 billion through confirmed sanctions-designated wallets for money laundering, illicit oil sales, and arms procurement, based on the Chainalysis 2026 Crypto Crime Report.
OFAC issued 13 sanctions designations in 2024 that included 86 cryptocurrency addresses targeting Russia and cyber-related entities; inflows to the 3 designated exchanges NetEx24, Bitpapa, and Cryptex dropped an average of 82% in the 3 months following designation compared to pre-designation volumes, based on the TRM Labs 2025 Crypto Crime Report.
Ransomware and Darknet Markets
Ransomware attackers received approximately $813.55 million in cryptocurrency payments in 2024, a 35% decrease from the record $1.25 billion in 2023, with the $75 million payment to the Dark Angels group in H1 2024 setting the record for the largest single ransom payment ever recorded, based on Chainalysis’s September 2025 ransomware report.
LockBit, disrupted by the UK National Crime Agency and the FBI in early 2024, saw H2 2024 ransomware payments decrease by approximately 79% following the operation, demonstrating measurable law enforcement impact on a major ransomware strain, based on Chainalysis’s September 2025 ransomware report.
In 2025, roughly 64% of ransomware victims refused to pay, the median ransom dropped to $115,000, and approximately 54% of ransomware cases began with a malicious phishing email as the primary entry point, based on deepstrike.io’s 2025 crypto crime analysis citing Chainalysis.
Darknet markets received approximately $2 billion in cryptocurrency in 2024, down from $2.3 billion in 2023, while fraud shop volume fell by more than 50% to $220.1 million following a U.S.-Dutch takedown of Universal Anonymous Payment System (UAPS), based on Chainalysis’s 2025 Crypto Crime Report introduction.
Cryptocurrency-enabled illicit drug sales grew over 19% year-over-year between 2023 and 2024, nearing $2.4 billion, with Russian-language darknet marketplaces contributing over 97% of illicit drug sales volume and the proportion of Monero-only darknet markets launched in 2024 rising from one-third to nearly half of all new markets, based on the TRM Labs 2025 Crypto Crime Report.
Huione Group and Chinese Money Laundering Networks
Huione Guarantee and vendors advertising on its platforms processed $70 billion in cryptocurrency transactions since 2021, with FinCEN designating Huione Group as a primary money laundering concern on May 1, 2025 under Section 311 of the USA PATRIOT Act, citing facilitation of at least $4 billion in illicit funds between 2021 and January 2025, based on Chainalysis’s 2025 Crypto Crime Report and Chainalysis Huione Group shutdown analysis.
In 2024, Huione scam technology vendors received at least $375.9 million in cryptocurrency, with AI service vendors on the platform recording 1,900% year-over-year revenue growth, reflecting an explosion in the use of generative AI to facilitate crypto fraud and scams, based on Chainalysis’s February 2025 pig butchering report.
Chinese-language money laundering networks (CMLNs) now account for approximately 20% of known illicit laundering activity globally, operating approximately $44 million per day across 1,799+ active wallets in 2025, with Chainalysis identifying 6 discrete service types that make up the CMLN ecosystem, based on Chainalysis’s January 2026 crypto money laundering report.
In 2024, Chinese authorities prosecuted 3,032 individuals linked to crypto-related money laundering cases despite China’s 2021 cryptocurrency trading ban; in January 2026, South Korean customs dismantled a $102 million crypto remittance ring coordinated by a Chinese national using WeChat Pay and Alipay to disguise illegal transfers, based on Chainalysis reporting cited by Coinspeaker.
Crypto scam revenue in 2024 reached at least $9.9 billion, likely exceeding $12.4 billion as more wallets are identified; pig butchering scam revenue grew approximately 40% year-over-year, with high-yield investment scams and pig butchering collectively representing 50.2% and 33.2% of all scam inflows respectively, based on Chainalysis’s February 2025 pig butchering report.
Impersonation scams surged more than 1,400% year-over-year in 2025 as criminals used AI tools and phishing-as-a-service infrastructure to scale attacks, with Chainalysis estimating scammers received at least $14 billion in crypto in 2025, potentially exceeding $17 billion, based on The Defiant’s reporting on the Chainalysis 2026 Crypto Crime Report.
AML Enforcement and Financial Penalties
Global penalties for AML, countering the financing of terrorism, sanctions, and customer due diligence violations totaled $3.8 billion in 2025, an 18% drop from $4.6 billion in 2024 and a continued decline from $6.6 billion in 2023, based on Kroll’s Financial Compliance Regulation analysis citing Napier AI data.
U.S. AML penalties declined to approximately $1.7 billion in 2025, a 61% drop from the previous year, while EMEA region fines rose 767% and APAC fines rose 44%, reflecting a geographic shift in enforcement activity that creates potential regulatory arbitrage vulnerabilities, based on Kroll’s Financial Compliance Regulation analysis.
The cryptocurrency sector faced the heaviest enforcement in 2025 with over $1 billion in global fines, including major actions against exchanges for inadequate AML and KYC programs, while the overall U.S. regulatory approach shifted toward fewer but more targeted enforcement actions under the DOJ’s April 7, 2025 policy ending regulation-by-prosecution of digital assets, based on Kroll’s analysis.
IRS Criminal Investigation identified over $10.6 billion in financial crimes in FY2025, referred 2,043 cases for prosecution, and dedicated 64% of investigative time to tax crimes, with cryptocurrency market manipulation and unreported digital asset gains among its enforcement priorities, based on the IRS-CI FY2025 Annual Report published December 2025.
The DOJ seized more than $225.3 million in cryptocurrency linked to investment fraud and money laundering schemes in a 2025 operation involving cryptocurrency confidence scams, marking the largest cryptocurrency seizure in U.S. Secret Service history, with reported victim losses exceeding $5.8 billion in 2024 alone, based on National Law Review reporting on DOJ forfeiture cases.
Spanish authorities seized more than EUR 27 million in cryptocurrency from a transnational criminal organization in a 2025 operation spanning multiple provinces and involving the freezing of assets on several major exchanges, with support from U.S. law enforcement and blockchain intelligence firms, based on National Law Review reporting on international cryptocurrency forfeiture.
FATF Compliance and Travel Rule Statistics
Of the 138 jurisdictions assessed for compliance with FATF Recommendation 15 (virtual asset AML standards) as of April 2025, only 29% were largely compliant, up from 25% in 2024, while 49% remained only partially compliant and 21% were non-compliant, with only 1 jurisdiction achieving full compliance, based on the FATF 2025 Sixth Targeted Update on Virtual Assets and VASPs.
73% of jurisdictions (85 of 117) had passed Travel Rule legislation as of the 2025 FATF survey, up from 65 jurisdictions in 2024, but 59% of those 85 jurisdictions had yet to issue supervisory findings, directives, or take enforcement actions related to Travel Rule compliance, based on the FATF 2025 Sixth Targeted Update.
FATF’s June 2025 report covering 67 jurisdictions representing approximately 98% of global VASP activity found that 90% had enacted or were in the process of enacting licensing and AML/CFT legislation, while only 33% of assessed jurisdictions required licensing in practice, leaving a large gap between regulatory intent and operational implementation, based on TRM Labs’ analysis of the FATF June 2025 update.
The FATF 2025 Targeted Update reported $30 trillion in stablecoin volume growth between May 2024 and May 2025, noting that mass adoption of stablecoins could amplify illicit finance risks particularly with uneven VASP regulatory implementation, based on the official FATF 2025 Targeted Update PDF.
The FATF 2025 Targeted Update found that 76% of 163 jurisdictions (124 of 163) reported conducting money laundering and terrorist financing risk assessments for virtual assets and VASPs in the 2025 survey, up from 71% in 2024; the report also warned that mass stablecoin adoption in unhosted wallets could reduce the use of AML-obliged entities and amplify illicit finance risks, based on the FATF 2025 Sixth Targeted Update on Virtual Assets and VASPs.
Blockchain Forensics and Investigation Tools
SlowMist’s 2025 Blockchain Security and AML Annual Report recorded 200 blockchain security incidents resulting in approximately $2.935 billion in losses in 2025, compared to 410 incidents and $2.013 billion in losses in 2024; the number of incidents declined year-over-year but total losses increased by approximately 46%, based on SlowMist’s 2025 Blockchain Security and AML Annual Report.
From January 2024 to September 2025, DPRK-related hacker groups stole a total of at least $2.837 billion in crypto assets, with approximately $1.645 billion stolen in just the first 9 months of 2025, setting a new historical record, based on MSMT research cited in SlowMist’s 2025 Blockchain Security and AML Annual Report.
Infrastructure attacks involving private key and seed phrase compromises accounted for nearly 70% of all cryptocurrency stolen funds in 2024, as hackers exploit poor storage practices, phishing campaigns, and malware to gain access to wallet credentials, based on the TRM Labs 2025 Crypto Crime Report.
The T3 Financial Crime Unit, a public-private partnership between TRON, Tether, and TRM Labs, played a significant role in freezing illicit proceeds on the TRON blockchain; despite accounting for 58% of total illicit transactions in 2024, TRON experienced the most significant reduction in illicit volume among major blockchains following targeted enforcement and T3 FCU operations, based on TRM Labs’ 2025 Crypto Crime Report.
Chainalysis identified on-chain behavioral fingerprints of 6 distinct service types within the CMLN ecosystem: running point brokers, money mules, informal over-the-counter desks, Black U services, gambling platforms, and money movement services; Black U and gambling services fragment large transactions into small amounts while OTC services consolidate small transactions into large ones, collectively processing $16.1 billion in 2025 across more than 1,799 active wallets, based on Chainalysis’s 2026 crypto money laundering report.
Longstanding UN Office on Drugs and Crime and IMF estimates place annual global money laundering at $800 billion to $2 trillion, equivalent to 2% to 5% of global GDP, while on-chain crypto laundering of $82 billion in 2025 represents approximately 4% to 10% of total estimated illicit flows, based on Kroll’s Financial Compliance Regulation analysis citing UNODC and IMF data.
Huione Guarantee’s on-chain coverage was identified as processing more than $49 billion in cryptocurrency transactions since 2021 in a Chainalysis mid-year 2024 update, significantly higher than previously reported; Huione’s connections include pig butchering, stolen funds addresses, the OFAC-sanctioned Garantex exchange, fraud shops, and Chinese gambling sites, making it the largest known cross-crime infrastructure hub in the illicit crypto ecosystem, based on Chainalysis’s mid-year 2024 crypto crime update Part 2.
The IRS Whistleblower Office paid awards totaling $123.5 million in FY2024 based on $474.7 million in collected proceeds, a 39% increase over FY2023, with crypto-related financial crime increasingly among the category of tax fraud and money laundering cases generating whistleblower tips, based on the IRS FY2024 Whistleblower Office Annual Report.
The OECD Crypto-Asset Reporting Framework had 75 jurisdictions committed to implementation as of November 2025, up from 48 in November 2023, creating an automatic information exchange network that will expose cross-border crypto money laundering flows between participating tax authorities, based on the OECD 2025 CARF Monitoring and Implementation Update.
Europol coordinated a major 2025 enforcement action targeting fake investment crypto platforms and money laundering that revealed a criminal network moving over EUR 700 million across borders, while the Research and Markets 2025 Global Crypto AML market report valued the blockchain analytics industry at $4.21 billion in 2024, growing at 20.1% CAGR, based on Kroll’s Financial Compliance Regulation analysis and Research and Markets data.
When Chainalysis published the 2024 Crypto Crime Report, it reported $24.2 billion for 2023’s illicit volume; one year later, the updated estimate for 2023 reached $46.1 billion, a 90% upward revision driven by identification of new illicit addresses, illustrating why current-year estimates should be treated as lower bounds, based on Chainalysis’s 2025 Crypto Crime Report introduction.
TRM Labs supports over 1.9 billion assets across 190+ blockchains and provides blockchain intelligence to government agencies, law enforcement, exchanges, and financial institutions in more than 60 countries; its database covers FATF’s full set of money laundering predicate offenses across all major chains and is used by regulators to assess compliance with AML standards, based on TRM Labs’ platform overview page.
PwC’s 2026 Global Crypto Tax Report, its 5th consecutive annual edition, documents direct and indirect tax treatment across 58 jurisdictions; the 58-market scope reflects the geographic spread of exchanges and VASPs that now face simultaneous tax reporting under Form 1099-DA-equivalent rules and AML obligations under FATF Recommendation 15, producing a compliance cost that PwC estimates has materially increased operating expenses for regulated crypto businesses, based on PwC’s global crypto tax report updated to October 1, 2025.
The Chainalysis 2025 Geography of Crypto Report documented a 69% year-over-year increase in on-chain crypto value received by the Asia-Pacific region between June 2024 and June 2025; the report identified APAC as the region with the highest regional growth rate globally, amplifying AML compliance obligations for local exchanges where Chinese money laundering networks account for approximately 20% of all tracked illicit laundering activity, based on the Chainalysis 2025 Geography of Crypto Report.
IRS Revenue Procedure 2024-28 requires crypto holders to elect a cost-basis method per wallet as of January 1, 2025, and the IRS digital assets guidance page covers over 111 FAQs on virtual currency compliance; the IRS noted that unmonitored crypto transaction activity reached approximately $18.3 trillion in 2024, highlighting the scale of on-chain flows requiring compliance oversight, based on the IRS FY2025 Annual Report.
The IRS charged 10 foreign nationals in an international operation targeting cryptocurrency market manipulation in cases filed through 2025 and 2026, including Russian, Indian, Taiwanese, and Serbian nationals accused of wash trading and pump-and-dump schemes, with 1 defendant sentenced and multiple extradited from Singapore, based on IRS enforcement press releases.
The Chainalysis 2025 Crypto Crime Report estimated $2.57 billion in illicit wash trading volume was artificially generated in 2024 on decentralized exchanges, with the SEC’s enforcement resulting in charges against CLS Global which pleaded guilty to wash-trading a token created by the FBI as part of a sting operation, based on Chainalysis’s 2025 Crypto Crime Report introduction.
Infrastructure attacks involving private key and seed phrase compromises caused the average amount of cryptocurrency stolen per heist to increase by almost 80% in H1 2024, with BTC accounting for 40% of total transaction volume in those heists as crypto thieves returned to targeting centralized exchanges, based on Chainalysis’s mid-year 2024 crypto crime update.
Sanctioned entities and jurisdictions accounted for $14.9 billion in transaction volume in 2023, representing 61.5% of all illicit transaction volume that year, with the majority driven by cryptocurrency services sanctioned by OFAC or located in sanctioned jurisdictions, based on Chainalysis’s 2024 Crypto Crime Report introduction.
The Chainalysis mid-year 2024 crime update found that $10.8 billion of the $40.9 billion received by illicit crypto addresses in 2024 went to “illicit-actor org” wallets; these are entities directly committing cybercrime or selling the tools and infrastructure needed to commit crime, including laundering-as-a-service providers, based on Chainalysis’s 2025 Crypto Crime Report introduction.
The EU launched the Anti-Money Laundering Authority (AMLA) in 2025 to supervise high-risk cross-border entities across member states, while U.S. FinCEN rules for registered investment advisers were delayed again with the effective date pushed to January 1, 2028, leaving an estimated $33 trillion U.S. asset management sector partially outside mandatory AML obligations, based on Kroll’s Financial Compliance Regulation analysis.
![[object Object]](/_next/static/media/ISO_27001-2022_certification.ae776691.svg)
![[object Object]](/_next/static/media/GDPR_Compliance.a2dc5933.svg)
![[object Object]](/_next/static/media/SOC_2_Type_II_certification.dd69381e.svg)
