Report Date: February 09, 2026
Author: Expert Researcher
This comprehensive research report provides a detailed analysis of the findings presented in the Chainalysis Crypto Crime Report 2025. The report synthesizes data on the scale, scope, and evolving nature of illicit cryptocurrency activities throughout 2024, offering a forward-looking perspective on the threats facing the digital asset ecosystem in 2025 and beyond.
The key finding of the 2025 report is the staggering and record-breaking volume of illicit transactions, with estimates for 2024 initially pegged at 51 billion as new data emerges . Some analyses released in early 2026 suggest the total illicit value for 2025 itself reached a preliminary estimate of at least $154 billion, marking a dramatic 162% increase from the previous year, largely driven by a monumental surge in activity related to sanctioned entities . Despite this growth in absolute value, illicit activity continues to represent a diminishing fraction of the total on-chain transaction volume, falling to a four-year low of approximately 0.14% in 2024, highlighting the industry's exponential legitimate growth 9|PDF.
The character of crypto crime has undergone a significant transformation. Stablecoins have definitively replaced Bitcoin as the asset of choice for illicit actors, accounting for approximately 63% to 84% of illicit transaction volume, prized for their price stability and liquidity . Concurrently, fraud has entered a "professional era," marked by the alarming proliferation of AI-driven scams and impersonation schemes . Impersonation scams witnessed an explosive 1,400% increase in 2025, while AI-powered deepfakes and automated tools made fraudulent activities more convincing, targeted, and profitable than ever before .
Money laundering techniques have also evolved, with criminals increasingly leveraging Decentralized Finance (DeFi) protocols alongside traditional mixers and exchanges . Illicit actors are demonstrating greater sophistication, creating complex laundering networks that adapt to law enforcement pressure. Notably, the report underscores a significant trend towards "massive national behavior," where state-sponsored actors, particularly those from the Democratic People's Republic of Korea (DPRK), and sanctioned entities are responsible for a disproportionately large share of high-value thefts and illicit fund movements .
This report will dissect these findings in detail, examining the quantitative data on illicit volumes, analyzing the dominant crime typologies and their methodologies, exploring the assets and platforms implicated, and detailing the analytical framework Chainalysis employs to uncover these trends.
The headline figures from the Chainalysis 2025 Crypto Crime Report paint a complex picture of the illicit landscape. While the absolute value of illicit transactions has soared to new heights, its relative share of the burgeoning overall cryptocurrency economy has shrunk, indicating a maturation of the industry and improved compliance measures.
One of the most critical aspects of interpreting Chainalysis's data is understanding its dynamic and retrospective nature. Initial estimates for any given year represent a lower-bound figure, which is consistently revised upward in subsequent reports as law enforcement investigations conclude, new illicit addresses are identified, and previously unknown links in transaction chains are uncovered . The data for the period covered in the 2025 report is no exception and presents several key figures.
Initial 2024 Estimate: 40.9 billion 1|PDF44|PDF. This figure is based on the addresses known to be associated with illicit activity at the time of the report's publication in early 2025.
Projected 2024 Volume: 51 billion 6|PDF. This projection accounts for the anticipated discovery of additional addresses linked to hacks, scams, and other criminal enterprises throughout 2025 and beyond.
The Record-Breaking 2025 Figure: 154 billion (or $158 billion in some reports) has been associated with the 2025 calendar year, as reported in early 2026 . This preliminary estimate for 2025 represents a staggering 162% increase over the previous year . The primary driver of this unprecedented surge was a 694% increase in funds received by sanctioned entities, highlighting the growing geopolitical dimension of cryptocurrency crime . This figure underscores a shift towards large-scale, state-level illicit financial flows rather than just disparate criminal activities.
This wide variance in reported numbers—from 154 billion—is not necessarily a contradiction but rather a reflection of different reporting periods (2024 vs. 2025) and the evolving state of blockchain intelligence. The 51 billion range represents the findings for the 2024 calendar year as detailed in the main 2025 report, while the $154 billion figure is a preliminary estimate for the 2025 calendar year, which will be the focus of the 2026 report.
Placing these figures in historical context is crucial for understanding the trajectory of crypto crime.
Comparison with 2023: The year 2023 marked a notable downturn in illicit activity. The confirmed value of illicit transactions for 2023 was **40.9 billion) represents a substantial rebound, with an increase of nearly 70% year-over-year. The projected figure of $51 billion would constitute a more than 110% increase from 2023 levels.
Comparison with 2022: The previous peak for illicit activity was in 2022, with a revised total of **154 billion dwarfs all previous years combined.
Despite the alarming growth in raw dollar terms, the most critical contextual metric is the share of illicit activity relative to the total volume of on-chain cryptocurrency transactions. The 2025 report confirms a continuing downward trend in this percentage.
In 2024, illicit transactions accounted for just 0.14% of the total on-chain volume . This is the lowest share recorded in four years and continues a consistent decline from 0.34% in 2023 and 0.42% in 2022 10|PDF10|PDF.
This paradoxical trend—soaring absolute values but a shrinking relative share—is a powerful indicator of the cryptocurrency ecosystem's maturation. It signifies that legitimate use cases, including institutional investment, decentralized finance, and peer-to-peer payments, are growing at a far more explosive rate than criminal usage. This suggests that while crime remains a significant challenge, it is not the defining characteristic of the industry, and that enhanced compliance, law enforcement capabilities, and security protocols are having a positive effect on the overall health of the ecosystem.
The Chainalysis 2025 report reveals a landscape where criminal methodologies are becoming more sophisticated, professionalized, and technologically advanced. Illicit actors are adapting their strategies to exploit new technologies and market trends, shifting away from some traditional forms of crypto crime toward more targeted and lucrative schemes.
Fraud and scams continue to represent a substantial portion of illicit activity, but the nature of these crimes has transformed dramatically. The report highlights the emergence of what it calls a "professional era" of crypto fraud, characterized by two dominant and interconnected trends .
A. The Meteoric Rise of Impersonation Scams:
The most explosive trend identified is the growth of impersonation scams. These schemes saw a staggering 1,400% increase in 2025 . Unlike broad, low-effort phishing campaigns of the past, modern impersonation scams are highly targeted and sophisticated. Criminals leverage detailed personal information, often gathered from data breaches or social media, to build trust with their victims.
Characteristic methods of these scams include:
B. The Weaponization of Artificial Intelligence (AI):
The proliferation of accessible and powerful AI tools has become a force multiplier for fraudsters. The report identifies AI-driven scams as a primary threat, noting they are significantly more profitable than traditional methods, generating up to 4.5 times more revenue per scam .
Key AI techniques employed by criminals include:
Money laundering remains a core activity for cybercriminals, who must find ways to obscure the origins of stolen funds before cashing out. The 2025 report illuminates a clear evolution in their techniques, moving towards more stable and technologically complex platforms.
A. The Dominance of Stablecoins:
As detailed in Section 3.1, stablecoins have become the primary vehicle for money laundering and other illicit transactions. Their stable value eliminates the price volatility risk associated with assets like Bitcoin and Ethereum, making them an ideal medium for holding and moving illicit funds without losing value. Their widespread integration into centralized and decentralized exchanges provides the liquidity necessary for criminals to cash out into fiat currency .
B. The Growing Role of Decentralized Finance (DeFi):
While specific DeFi laundering incidents from the 2025 report were not detailed in the provided research, the general trend points to the increasing use of DeFi protocols by illicit actors . DeFi platforms offer several advantages to money launderers:
North Korean hackers, in particular, have been noted to use DeFi protocols extensively after high-value thefts, not necessarily because they are the most effective laundering tool (due to on-chain transparency), but because the initial proceeds of their hacks are often illiquid tokens that can only be swapped on DEXs .
While new threats are emerging, traditional forms of crypto crime remain prevalent.
The report indicates that these categories—stolen funds, darknet markets, and ransomware—form the core of Chainalysis's annual crime tracking, underscoring their persistent and significant impact on the ecosystem 1|PDF.
The choices of cryptocurrencies and blockchain platforms made by illicit actors are not random; they are driven by strategic considerations of anonymity, liquidity, stability, and transaction costs. The 2025 report highlights a definitive and ongoing shift in these preferences.
The most significant trend in the composition of illicit funds is the ascendancy of stablecoins. For years, Bitcoin was the currency of choice for criminals, but that has fundamentally changed.
In 2024, stablecoins accounted for an overwhelming majority—approximately 63%—of all illicit transaction volume . Some analyses cited in the report place this figure even higher, at 84% for 2025 . This marks a complete reversal from just a few years ago, when Bitcoin dominated.
The reasons for this shift are clear:
As stablecoins have grown in prominence, the underlying blockchain networks that support them have become the new battleground for illicit transaction volume. While the 2025 Chainalysis report did not provide a specific breakdown of illicit volume by blockchain, data from other blockchain intelligence firms and broader trends discussed by Chainalysis point to a clear migration of illicit activity away from Bitcoin.
The Rise of TRON: Analysis from TRM Labs and other sources indicates that the TRON network has emerged as a leader in illicit volume share. In 2023, TRON accounted for 45% of illicit volume, and by 2024, its share had grown to 58% 60|PDF. This dominance is almost entirely due to the massive volume of USDT stablecoin transactions on its network, which criminals favor for its low fees and high speed.
Ethereum's Persistent Role: The Ethereum network remains a major hub for illicit activity, consistently accounting for around 24% of the illicit volume 60|PDF. Its vast DeFi ecosystem and smart contract capabilities make it the primary venue for hacks, exploits, and sophisticated laundering schemes involving DEXs and other protocols.
Bitcoin's Diminishing Share: While Bitcoin remains the preferred asset for specific legacy crime types like ransomware and darknet markets 77|PDF, its overall share of illicit transaction volume has steadily declined. By 2024, its share had dropped to just 12% . This is due to its high transaction fees, slower confirmation times, and the market's shift toward the stability of stablecoins for value transfer.
Solana's Emerging Presence: While not yet a dominant player in illicit volume, the Solana blockchain was noted for having the largest number of security incidents in 2025 . Its rapid growth and burgeoning DeFi scene make it an attractive, albeit risky, environment that is increasingly monitored for illicit use.
This multi-chain reality complicates the work of law enforcement and compliance teams, who must now monitor activity across a diverse and interconnected ecosystem of blockchains.
The findings in the Crypto Crime Report are the product of a sophisticated, multi-faceted methodology that combines on-chain data analysis with off-chain intelligence. Understanding this process is key to interpreting the report's statistics and appreciating their limitations.
Chainalysis's methodology is built upon a foundation of comprehensive data collection from various sources:
Raw data is transformed into actionable intelligence through a combination of heuristics, graph analysis, and machine learning.
Address Clustering and Identification: The fundamental technique is the identification and labeling of cryptocurrency addresses associated with specific services or entities. Chainalysis uses proprietary heuristics to "cluster" addresses that are likely controlled by the same entity. For example, all addresses known to belong to a specific exchange are clustered together. Once an address is definitively linked to an illicit entity (e.g., a sanctioned entity, a darknet market), it is labeled as such, and all funds flowing to it are categorized as illicit.
Transaction Graph Analysis: Blockchain data is visualized as a transaction graph, mapping the flow of funds between addresses and clusters 16|PDF. This allows analysts to trace the path of stolen funds from a hack, through various intermediary wallets or mixing services, to an eventual cash-out point like an exchange 69|PDF. This technique is crucial for identifying money laundering networks and understanding criminal financial infrastructure.
Distinguishing Legitimate vs. Illicit Transactions: A transaction is categorized as "illicit" if it involves funds sent to an address that Chainalysis has identified and labeled as being controlled by a criminal or otherwise illicit entity 1|PDF. The methodology is conservative; transactions are only counted as illicit when a link to a confirmed illicit address can be established through reliable off-chain information (e.g., law enforcement data, public announcements from sanctioned bodies, darknet site analysis) 86|PDF. This means that transactions that are part of non-crypto-native crimes (e.g., traditional drug trafficking where crypto is merely the payment method) are generally not included unless the addresses are specifically identified in an investigation . This conservative approach is a primary reason why the report's figures are considered a lower bound and are subject to upward revision.
Machine Learning and Anomaly Detection: While the specific algorithms used in the 2025 report are not publicly detailed, the general methodology involves using machine learning to identify patterns and anomalies indicative of illicit behavior 16|PDF71|PDF. This could include detecting structuring (breaking large transactions into smaller ones to avoid detection) or identifying a new wallet that exhibits behavior similar to known laundering networks.
A key focus of the 2025 report is the identification of the actors behind the illicit activity. The analysis highlights a significant shift toward large-scale, state-sponsored crime.
The Chainalysis Crypto Crime Report 2025 presents a nuanced and critical perspective on the state of illicit finance in the digital asset world. The findings reveal an ecosystem grappling with record-breaking criminal revenue in absolute terms, driven by the alarming rise of state-sponsored activity and the professionalization of fraud through technologies like AI. The dramatic surge in funds flowing to sanctioned entities, potentially reaching over $154 billion in 2025, signals a new geopolitical reality where digital assets are a key battleground in international affairs.
However, the report simultaneously tells a story of an industry that is rapidly maturing. The fact that this record-breaking illicit volume constitutes a shrinking fraction—now just 0.14%—of total on-chain activity is a testament to the exponential growth of legitimate cryptocurrency adoption. The shift away from Bitcoin toward stablecoins and a multi-chain environment reflects rational choices by criminals, but also creates new challenges and opportunities for detection and enforcement.
The key takeaways are threefold:
For policymakers, law enforcement, and industry participants, the message is clear: the fight against crypto crime is a dynamic and ongoing challenge that requires constant adaptation, international cooperation, and a deep, data-driven understanding of the threats as they evolve.