Sanctioned entities moved $104B through crypto in 2025: Report

Sanctioned entities moved roughly

, accounting for the majority of illicit on-chain activity during the year, according to a new report from Chainalysis.

The findings come from the

, which estimates that illicit crypto addresses received at least . The report attributes much of the increase to a sharp rise in activity linked to sanctioned entities.

The report notes that

, highlighting the growing role of digital assets in geopolitical financial flows.

Sanctions activity drives illicit crypto surge

While illicit crypto activity has long been associated with hacks and scams, the report suggests that sanctions evasion now accounts for the largest share of illicit transaction volume.

Of the

, about , according to the analysis .

Sanctioned entities include governments, financial institutions, and organizations restricted from accessing traditional financial systems under international sanctions regimes.

The report points to several geopolitical drivers behind the trend, including networks tied to

, which have increasingly turned to digital assets to move funds across borders.

North Korea-linked actors alone were responsible for

, according to the report.

Stablecoins dominate illicit transaction flows

The report also highlights a shift in the types of digital assets used in illicit activity.

, reflecting their growing role in global crypto payments and transfers.

The increasing use of dollar-pegged tokens suggests that actors engaged in sanctions evasion and cross-border financial activity may prefer stable-value assets over more volatile cryptocurrencies.

Illicit activity remains a small share of crypto economy

Despite the record figures, the report notes that

.

Blockchain analytics firms say the transparency of public ledgers continues to aid investigations and enforcement actions against illicit actors.

However, the report warns that criminal networks are becoming more sophisticated, increasingly relying on laundering services and cross-chain infrastructure to obscure the origin of funds.

Criminal infrastructure becoming more organized

The report also points to the rise of organized crypto laundering networks that provide financial infrastructure for illicit actors.

These networks often combine services such as

to move and obfuscate funds.

Analysts say the trend reflects a broader shift toward professionalized cybercrime ecosystems, where specialized services handle different stages of illicit financial activity.

Final Summary

• Sanctioned entities accounted for roughly $104 billion of the $154 billion in illicit crypto activity recorded in 2025, according to the report.
• Despite record figures, illicit transactions still account for less than 1% of global cryptocurrency activity.