Illicit activity in the cryptocurrency market reached a new nominal high in 2025, yet its overall footprint within the fast-growing digital asset ecosystem continued to shrink. That is the central finding of TRM Labs’ latest Crypto Crime Report, which paints a nuanced picture of a sector often criticized for its association with crime.
According to TRM Labs, illicit crypto transactions totaled approximately $158 billion in 2025, marking a sharp 145% increase from the previous year. At first glance, the figure appears alarming. However, when measured against the expanding scale of the global crypto market, illicit activity represented just 1.2% of total crypto transaction volume, down from 1.3% in 2024 and well below the 2023 peak of 2.4%.
These findings closely align with recent estimates from Chainalysis, which reported $154 billion in crypto-related crime in 2025, accounting for less than 1% of total transaction volume. Together, the reports reinforce a recurring conclusion from blockchain security firms: while crypto crime exists, it remains a small slice of overall activity and is often overshadowed by illicit finance conducted through traditional banking systems.
A new way to measure crypto crime risk
This year, TRM introduced a new metric designed to better reflect real-world risk. Instead of focusing solely on transaction volume, the firm analyzed illicit activity relative to deployable crypto liquidity.
Using this approach, TRM found that illicit actors captured 2.7% of available crypto liquidity in 2025, down from 2.9% in 2024 and 6.0% in 2023. The decline suggests that although some criminal categories grew in absolute dollar terms, illicit actors absorbed a smaller share of new capital entering the ecosystem.
In TRM’s words, the data shows that “illicit actors absorbed a smaller proportion of new capital entering the crypto ecosystem,” signaling gradual improvements in market resilience and compliance controls.
Crypto crime becomes a geopolitical issue
While the overall share of illicit activity is falling, its nature is changing. TRM noted that crypto crime is increasingly shaped by geopolitical pressures, with a growing share of illicit flows linked to sanctions evasion and state-aligned activity.
Sanction-related crypto flows surged by roughly 400% year over year, driven largely by actors connected to Russia, Iran, Venezuela, North Korea, and China. North Korean hacking groups, in particular, remained a major threat, while Chinese money laundering networks and underground banking services continued to expand.
One standout case highlighted in the report is the A7A5 token, which TRM described as a centrally coordinated sanctions-evasion system tied to Russian state interests. Alongside platforms such as Garantex, Grinex, and A7, the token reportedly acted as a hub connecting Russia-linked entities with counterparties across China, Southeast Asia, and Iran. TRM characterized this as a deliberate shift toward crypto-based financial infrastructure aligned with state objectives.
The report also pointed to the rapid growth of Chinese-language escrow services and underground banking networks, where adjusted crypto volumes jumped from $123 million in 2020 to $103 billion in 2025. Much of this activity has been fueled by large-scale fraud operations, including so-called “pig butchering” schemes.
How crypto theft is evolving
TRM’s analysis of crypto hacks suggests that attackers are changing tactics. While the number of hacking incidents has remained relatively stable, the methods used have shifted.
Rather than exploiting smart contract code, adversaries are increasingly targeting operational infrastructure, including private keys, wallets, and control systems. These infrastructure attacks accounted for $2.2 billion in losses across 45 incidents, representing 76% of total stolen digital assets in 2025.
By comparison, smart contract exploits and protocol attacks resulted in lower average losses per incident. The data is partly skewed by a major breach at Bybit attributed to North Korean affiliates, which alone accounted for more than half of the year’s total exploit losses. Even without that incident, however, crypto theft would have totaled around $1.4 billion, underscoring what TRM described as a persistent baseline of criminal activity.
Notably, just five incidents accounted for 70% of all stolen crypto value last year. This pattern highlights a growing gap between rare, high-impact breaches and a steady stream of smaller attacks that continue to strain the ecosystem.
Scams, stablecoins, and organized fraud
Losses from crypto scams dipped slightly in 2025, but TRM observed that fraud is becoming more organized and professionalized. Pig butchering schemes and pyramid-style frauds each accounted for nearly one-third of total estimated scam losses, often run by groups with clear roles and business-like structures.
Stablecoins played a growing role in illicit activity, making up about 84% of fraud inflows for the year. TRM also reported rising darknet market volumes and identified at least 93 new ransomware variants, pointing to continued innovation among cybercriminals.
A clearer picture of risk
Taken together, TRM’s findings suggest that crypto’s relationship with crime is becoming more complex, but also more measurable. While illicit activity reached record levels in raw dollar terms, its share of the overall market continues to decline as adoption grows and security practices improve.
As cryptocurrencies become more integrated into global finance, the challenge for regulators, platforms, and users alike will be managing evolving risks without overstating them. The data from 2025 shows progress, but also a reminder that vigilance remains essential.
