Illicit crypto inflows reached at least $154 billion in 2025 per Chainalysis, while TRM Labs measured illicit activity at 1.2% of total on-chain volume in 2025, a dollars-up, share-down split. The 2025 picture is one of concentration, not contamination. Stablecoins now carry the dominant laundering rail, and a handful of state-linked actors (DPRK, Russia, Iran) moved an outsized share of the total. The numbers below trace each shift to a named primary source.

Key Takeaways

Illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase, according to Chainalysis.
TRM Labs’ parallel measurement put 2025 illicit inflows at $158 billion, an all-time high and a 145% year-over-year increase.
Stablecoins comprised 84% of verified fraud inflows in 2025, per TRM Labs.
Sanctioned entities alone received roughly $104 billion in 2025, driving a 694% year-over-year jump in sanctioned-entity inflows.
DPRK-linked actors stole $2.02 billion in cryptocurrency in 2025, accounting for nearly 60% of all global crypto theft.
The US Department of Justice penalized OKX $504 million on February 24, 2025, for systemic anti-money laundering failures tied to more than $5 billion in suspicious transactions.
The FATF counted 85 of 117 surveyed jurisdictions implementing the Travel Rule in 2025, up from 65 in 2024.

Editor’s Choice

Illicit activity’s share of total attributed on-chain volume slipped from 1.3% in 2024 to 1.2% in 2025, even as the absolute dollar figure set a record.
Illicit entities received roughly $141 billion via stablecoins in 2025, the highest level in five years.
Russia’s ruble-backed A7A5 token transacted over $93.3 billion within a year of its February 2025 launch.
OFAC’s Specially Designated Nationals list carried 1,245 unique crypto wallet addresses as of February 2025, a 32% year-over-year increase.
On-chain ransomware payments fell about 8% to $820 million in 2025 even as claimed attacks rose 50%.
IRS Criminal Investigation identified $10.59 billion in financial crimes in fiscal year 2025, a 15.7% year-over-year increase.

Cryptocurrency Anti-Money Laundering Statistics: New Illicit-Volume Record

TRM Labs called its $158 billion measurement of 2025 illicit incoming value an all-time high. Chainalysis works from attributed addresses tied to known illicit categories; TRM Labs classifies incoming value to illicit entities.

Chainalysis identified at least $154 billion in illicit crypto inflows for 2025, a 162% year-over-year increase.
TRM Labs identified $158 billion in incoming value to illicit entities for 2025, a 145% year-over-year increase.
The Chainalysis report attributes the jump primarily to a 694% surge in value received by sanctioned entities.

Chainalysis put 2025 illicit inflows at roughly at least $154 billion. TRM Labs measured the same year at $158 billion. Two methodologies built on different wallet-clustering models landing within 3% of each other on a $150 billion estimate is much harder to dismiss as definition drift.

Where the Illicit Dollars Came From

The composition cut, not the headline number, is what changed the most this year. Sanctions evasion eclipsed every other category, while scams remained large and ransomware kept declining despite louder attack volume.

Sanctioned-entity inflows reached about $104 billion in 2025.
Scams and fraud took in at least $14 billion on-chain in 2025, up from a revised $12 billion in 2024.
Stolen funds reached $3.4 billion in 2025 across all hack victims.
Ransomware payments fell approximately 8% to $820 million in 2025.

Why it matters: The category mix tells AML teams where to spend cycles. Sanctions evasion primarily drove the 694% surge in value received by sanctioned entities. The same shift reframes how to read cryptocurrency security and fraud data when scoping crypto exposure for the next cycle.

Recent Developments

March 21, 2025: The US Treasury announced it had removed Tornado Cash from the Specially Designated Nationals list.
February 24, 2025: OKX entered a plea agreement and accepted a $504 million penalty package, $420.3 million in forfeiture plus an $84.4 million criminal fine.
February 21, 2025: Bybit lost $1.5 billion in Ether in the largest digital heist in cryptocurrency history, with TRM Labs linking the breach to North Korea’s Lazarus Group.
August 4, 2025: FinCEN issued a notice citing increased misuse of convertible virtual currency kiosks in fraud schemes, drug trafficking and cybercrime.
June 26, 2025: The FATF published its 2025 Targeted Update on Virtual Assets, reporting 85 Travel Rule implementations across 117 surveyed jurisdictions.
December 12, 2025: IRS Criminal Investigation released its FY2025 annual report, disclosing $10.59 billion in identified financial crimes and 2.35 petabytes of seized digital data.

The dollar-record headline obscures the structural trend: illicit activity is shrinking as a portion of total measured volume. Compliance leaders should weight that ratio when modeling exposure.

TRM Labs measured illicit activity at 1.2% of attributed on-chain volume in 2025, down from 1.3% in 2024.
Illicit entities captured 2.7% of incoming VASP liquidity in 2025, down from 2.9% in 2024 and 6.0% in 2023.
Chainalysis reaches the same directional conclusion, noting that the illicit share of all attributed crypto transaction volume “remains below 1%” despite the absolute record.

Compliance reports that lead with the dollar headline alone risk overstating system-wide risk. The story is concentration, not contamination; illicit value is funneling through a narrower set of higher-velocity rails.

Stablecoins Now Carry the Illicit Rail

Stablecoins comprised 84% of verified fraud inflows and made up 86% of all illicit crypto flows in 2025, per TRM Labs, the primary laundering rail AML teams must monitor. Stablecoins settle faster, carry no volatility risk for the launderer, and route easily across borders.

TRM Labs measured stablecoins at 84% of verified fraud inflows in 2025, the cleanest single cut on the stablecoin laundering share.
TRM Labs measured stablecoins at 86% of all illicit crypto flows in 2025 and 84% of verified fraud inflows.
Illicit entities received roughly $141 billion via stablecoins in 2025, a five-year high.
Chinese-language escrow and money-laundering networks processed over $100 billion in 2025, acting as critical settlement infrastructure for global illicit markets.

Sanctions Evasion Became the Single Largest Crime Category

Russia-linked flows drove the sanctions concentration, anchored by the A7A5 ruble-pegged stablecoin, with Iran-aligned proxy networks also moving $2+ billion through OFAC-flagged wallets.

Chainalysis attributes about $104 billion in 2025 inflows to sanctioned entities, a 694% year-over-year increase.
Russia’s A7A5 ruble-backed token transacted over $93.3 billion within a year of its February 2025 launch.
TRM Labs measured A7A5 stablecoin volume at over $72 billion in 2025, with the broader A7 wallet cluster moving at least $39 billion.
Iran’s proxy networks moved more than $2 billion through wallets confirmed in sanctions designations.
TRM Labs attributes 86% of all 2025 illicit crypto flows to sanctions-related activity.

The implication for exchanges is that geopolitics is now a first-order AML variable. A transaction-monitoring stack tuned for retail fraud will not catch a ruble-stablecoin corridor that moves nine figures in a quiet week.

OFAC’s Crypto Sanctions Footprint Doubled

OFAC’s roster of crypto wallet addresses on the Specially Designated Nationals list grew 32% this year, with penalty totals also rising and the timing gap between designation and exchange enforcement decreasing to 72 hours from 5 days in 2023.

OFAC Metric	2023	2024	2025
Unique crypto wallets on SDN List	720	945	1,245
Share of new sanctions designations that were crypto-related	17%	23%	23%
OFAC penalties on crypto businesses	$307 million	$430 million	n/a
Stablecoins frozen via OFAC actions	$548 million	$740 million	n/a
Avg. time from designation to exchange enforcement	~5 days	~72 hours	~72 hours

Source: Chainalysis OFAC Sanctions Tracker, March 2026.

The Specially Designated Nationals list contained 1,245 unique crypto wallet addresses by February 2025, a 32% year-over-year increase.
OFAC has sanctioned 57 individuals and entities specifically for illicit activities involving cryptocurrencies as of 2025.
Crypto-related actions made up 23% of all new OFAC sanctions designations in 2024, up from 17% in 2023.
OFAC penalties on crypto businesses totaled $430 million in 2024, a 40% year-over-year increase.
OFAC enforcement actions froze $740 million in stablecoins in 2024, a 35% year-over-year increase.
North Korean Lazarus Group wallets account for 14% of all wallets designated by OFAC as of 2025.

North Korea Industrialized Crypto Theft

DPRK-linked actors stole $2.02 billion in 2025, nearly 60% of all global crypto theft. The Bybit breach was the largest digital heist in cryptocurrency history. A single breach laundered at speeds that no compliance program can match in real time.

DPRK-linked actors stole $2.02 billion in 2025, a 51% year-over-year increase.
DPRK theft accounted for nearly 60% of all 2025 crypto theft.
The lower-bound cumulative estimate for cryptocurrency stolen by the DPRK now stands at $6.75 billion.
The February 21, 2025 Bybit breach drained $1.5 billion in Ether, the largest digital heist on record.
Within 48 hours of the Bybit hack, at least $160 million had moved through illicit channels, with some estimates exceeding $200 million by the second day.

“Industrialized” is not a metaphor. A laundering pipeline that absorbs nine figures of fresh inflow inside two business days needs continuous OTC capacity, pre-positioned mixers and a downstream Chinese-language escrow layer, the same infrastructure TRM Labs sized at over $100 billion in throughput for the year.

US Enforcement Hit Exchanges Harder

US authorities recorded the $504 million OKX penalty for systemic AML failures. IRS Criminal Investigation posted $10.59 billion in identified financial crimes in fiscal year 2025.

OKX accepted a $504 million penalty package on February 24, 2025: $420.3 million in forfeiture plus an $84.4 million criminal fine, for facilitating more than $5 billion in suspicious transactions.
IRS Criminal Investigation identified $10.59 billion in financial crimes in fiscal year 2025, a 15.7% year-over-year increase.
IRS-CI seized 2.35 petabytes of digital data in fiscal year 2025, a nearly 60% year-over-year increase.
IRS-CI special agents seized more than $800 million in assets and returned nearly $100 million to crime victims in fiscal year 2025.
Search warrants rose 25% year over year, and prosecution referrals to the Department of Justice rose 14%.
The Bitfinex hack defendants Ilya Lichtenstein and Heather Morgan received 5-year and 18-month sentences, reflecting continued investment in crypto tracing and laundering prosecutions.

FATF Travel Rule Coverage Widens but Enforcement Lags

The FATF measures both legislative passage and live supervisory action, and the two diverged sharply this year, with legislative coverage stepping up while approximately 59% of jurisdictions with laws have yet to issue supervisory findings, directives or enforcement actions tied specifically to Travel Rule compliance across the 117 surveyed jurisdictions.

FATF Travel Rule Metric	2024	2025
Jurisdictions implementing the Travel Rule	65	85
Jurisdictions that have passed or are passing legislation	n/a	99
Respondents requiring VASP licensing or registration	82	96
Respondents reporting at least one VASP actually licensed	69	76
Jurisdictions still in the process of implementing the Travel Rule	n/a	14

Source: FATF Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs, June 2025.

85 jurisdictions implemented the Travel Rule in 2025, up from 65 in 2024.
99 jurisdictions had passed or were in the process of passing Travel Rule legislation by the 2025 measurement window.
96 of 117 respondents required VASPs to be licensed or registered, up from 82 in 2024.
Only 76 of the respondents reported having actually licensed or registered a VASP in 2025, up from 69 in 2024.
Approximately 59% of jurisdictions with Travel Rule laws have yet to issue any supervisory findings, directives, or enforcement actions tied specifically to Travel Rule compliance.

The 59% enforcement gap is the most under-discussed compliance-exposure data point of the year. A correspondent bank that takes paper-rule coverage as the proxy for live supervisory friction will be wrong almost six times out of ten.

Crypto Scams and the CVC Kiosk Funnel

Crypto scams and fraud took in at least $14 billion on-chain in 2025. FinCEN’s August notice cited increased misuse of convertible virtual currency kiosks in fraud schemes, drug trafficking, and cybercrime.

Crypto scams and fraud took in at least $14 billion on-chain in 2025, and the figure could exceed $17 billion as more illicit wallet addresses are identified.
The average scam payment grew from $782 in 2024 to $2,764 in 2025, a 253% year-over-year increase.
Impersonation tactics grew 1,400% year over year.
AI-enabled scams were 4.5 times more profitable than traditional schemes.
The FBI’s Internet Crime Complaint Center received more than 10,956 complaints in 2024 reporting the use of convertible virtual currency kiosks, with reported victim losses of approximately $246.7 million.
CVC kiosk complaint volume rose 99% year over year, and reported victim losses rose 31%.

Kiosks sit in the blind spot between exchange compliance and bank compliance. Until operators are forced to register, file SARs, and decline cash above a defined threshold, the channel will keep absorbing the bottom of the scam funnel.

Ransomware Kept Declining Even as Attacks Surged

Ransomware payments fell about 8% to $820 million even as claimed attacks rose 50%, with only 28% of victims paying, the lowest rate on record.

On-chain ransomware payments fell about 8% to $820 million in 2025.
Only 28% of ransomware victims paid in 2025, the lowest rate on record.
The median ransom payment surged 368% year over year to nearly $60,000, up from about $12,700 in 2024.
Claimed ransomware attacks rose 50% year over year in 2025.
Bitcoin remained the financial rail of choice for ransomware actors.

Tornado Cash Sanctions Lifted but Mixer Risk Remains

The US Treasury announced on March 21, 2025, that it had removed its sanctions on Tornado Cash, closing the sanctioned period that began August 8, 2022.

Tornado Cash has mixed over $7.6 billion worth of Ether since its August 2019 launch.
Almost 30% of funds sent through Tornado Cash have been tied to illicit actors.
Inflows to Tornado Cash more than doubled year over year in 2024, with the mixer still processing about $100 million each month.
Tornado Cash processed over $2 billion during its sanctioned period from August 8, 2022 to March 21, 2025.
In 2024, nearly a quarter of Tornado Cash inflows were stolen funds, including $145 million in Ether from the Heco Chain hack attributed to North Korean actors.

The court-driven sanctions removal does not change the underlying mixer risk profile. A wallet that touches Tornado Cash after March 21, 2025 is no longer reaching a sanctioned address, but the rest of the AML risk indicators, counterparty exposure, source-of-funds opacity, and downstream commingling are unchanged.

What Has and What Has Not Changed for Crypto AML

Compliance attention for crypto exchanges and broader RegTech tooling should track three shifts on the data side and one stubborn supervisory gap.

Three shifts on the data side, plus one stubborn supervisory gap, define the year-over-year change:

Stablecoins comprised 84% of verified fraud inflows and made up 86% of all illicit crypto flows in 2025.
Sanctioned-entity inflows rose 694% year over year, primarily driving the broader illicit increase.
The US Department of Justice imposed a $504 million penalty on OKX on February 24, 2025, for systemic anti-money laundering failures.
About 59% of jurisdictions with Travel Rule laws still report zero supervisory actions, leaving the implementation gap intact.

Key finding: At least $160 million of the Bybit funds moved through illicit channels within 48 hours of the hack. That speed sits largely outside any single regulator’s jurisdiction. Approximately 59% of jurisdictions with Travel Rule laws have yet to issue any supervisory findings, directives or enforcement actions. The gap leaves exchange-side compliance teams to carry most of the live-enforcement load.

The laundering supply chain has become more concentrated and cross-border, while supervisory cadence has stayed roughly where it was.

Conclusion

The 2025 data set is the year crypto-linked illicit volume reached at least $154 billion on the Chainalysis methodology and $158 billion on the TRM Labs methodology, with Chainalysis noting the illicit share of all attributed crypto transaction volume “remains below 1%” and TRM measuring the share at 1.2%. Sanctioned-entity inflows rose 694% year over year and drove most of the absolute increase. Stablecoins now account for roughly 84% of verified fraud inflows. The compliance implication is straightforward: the program tuned to 2022’s mix, bitcoin-first, scam-victim-tracing-first, is calibrated to a category distribution that no longer exists.

On the regulatory side, the FATF’s coverage of the Travel Rule reached 85 of 117 surveyed jurisdictions in 2025, but supervisory enforcement still lags legislative passage by a wide margin. OFAC’s crypto-specific sanctions footprint expanded to 1,245 wallets by February 2025. The next twelve months will be measured against how quickly that gap closes, how the post-Tornado Cash mixer landscape supervises itself, and whether any other exchange follows the $504 million path that OKX charted in February.