A staggering $158 billion in cryptocurrency flowed through illicit channels in 2025, marking a record high and reversing a three-year decline from $86 billion in 2021 to $64 billion in 2024. It’s a jarring jump, and it begs the question: is crypto’s reputation as a haven for bad actors being cemented, or is this just a temporary surge?
This 145% increase was reported by blockchain intelligence experts at TRM Labs, who also noted that despite the surge, illicit activity actually represented a slightly smaller share—1.2%—of total on-chain volume compared to 1.3% in 2024.
Source: TRM Labs
What’s Driving the Spike in Crypto Crime?
According to TRM Labs, several factors contributed to the dramatic increase in illicit cryptocurrency flows:
- A significant rise in cryptocurrency activity linked to sanctions, largely driven by networks associated with Russia, such as A7 and the A7A5 stablecoin, following new sanctions and better tracking of sanctioned entities.
- Increased use of cryptocurrency by nation-states and their allies, with Russia, Iran, and Venezuela integrating crypto into their financial systems, alongside substantial settlement activity through Chinese escrow and underground banking networks.
- Improvements in identifying and sharing intelligence about illicit flows, including tools developed by TRM Labs, which helped uncover previously hidden activity and accelerate the identification of sanctioned actors, major hacks, and blacklisted entities.
Source: TRM Labs
Hacks, Scams, and Ransomware: A Closer Look
TRM Labs recorded $2.87 billion in losses from 150 hacking incidents in 2025, with the top 10 breaches accounting for 81% of the total stolen value. The most damaging was the February 2025 attack on Bybit, attributed to North Korean hackers, resulting in approximately $1.46 billion in losses.
Source: TRM Labs
Scam activity remained remarkably high in 2025, with roughly $35 billion in cryptocurrency falling victim to fraudulent schemes. Investment scams were the dominant force, accounting for 62% of total inflows, encompassing romance baiting, Ponzi schemes, and fake task scams.
Interestingly, TRM Labs observed a noticeable increase in the sophistication, professionalism, and reach of these scams, which they believe is linked to the use of artificial intelligence tools.
Source: TRM Labs
Ransomware-related cryptocurrency inflows remained substantial throughout the past year, though they didn’t reach the peaks seen in previous years. Despite a record number of victims listed on extortion portals in 2025, more individuals are now choosing to resist paying ransom demands to cybercriminals.
Source: TRM Labs
TRM Labs also noted an unprecedented level of fragmentation within the ransomware ecosystem, with 161 active strains and 93 new variants emerging in 2025 alone. Ransom laundering techniques continued to evolve, with a 37% decrease in mixer usage offset by a 66% increase in bridge usage and cross-chain routing.
