First Coin

Illicit cryptocurrency activity jumps in 2025, TRM Labs reports

Illicit cryptocurrency activity rose sharply in 2025, according to a new report from TRM Labs. In simple terms, criminals used digital money more often to do illegal things last year. The report points to Russia-related sanctions designations and better ways to identify where money comes from as important reasons for the rise.

TRM Labs is a company that studies how crypto moves on the blockchain. A blockchain is a public ledger or record where people write down every transaction. The firm published detailed findings about criminal use of crypto in 2025. It found that fraudulent wallets received about $158 billion in value during the year. That is the highest level seen in the last five years.

To put this in perspective, 2024 saw inflows of about $64.5 billion. In earlier years the numbers were higher or lower: $85.9 billion in 2021, $75.4 billion in 2022, and $73.3 billion in 2023. So 2025 marked a big rebound after a period of lower totals.

Sanctions, stablecoins, and state strategy. The report says the rise comes from more than just sanctions evasion. It also comes from the broader use of cryptocurrency by nation-state actors and from new technology that helps investigators identify illicit activity that was hard to trace before. The biggest shift is tied to sanctions activity, and most of this involves Russia.

Two names stand out in the report: the A7A5 token and the A7 wallet cluster. The A7A5 token alone accounted for about $72 billion in incoming value. The A7 wallet cluster accounted for about $39 billion. Most of this activity is linked to Russia-related actors, including groups named Garantex, Grinex, and A7. On-chain activity — that is, activity recorded on the blockchain — shows that A7 acts as a central hub. It links Russia-aligned actors with partners in China, Southeast Asia, and Iran-connected networks. This is part of a larger move toward crypto-enabled, state-backed financial infrastructure.

What does that mean in simple terms? A7 is described as a central node or hub. It helps connect Russian-backed players with other networks around the world. The goal appears to be moving money across borders using cryptocurrency in ways that might be harder to block than traditional bank transfers. This is seen as a big shift in how some states use digital money to support their goals.

While the A7 wallet cluster is strongly tied to sanctions evasion, the A7A5 token has a broader purpose. It supports a larger plan to reduce reliance on the U.S. dollar and to expand a ruble-pegged stablecoin. A stablecoin is a kind of cryptocurrency that tries to keep its value steady, usually by tying it to something real like a government fiat currency or a commodity. In this case, the idea is to use a stablecoin pegged to the ruble, Russia’s national currency, to help move money around the world without depending on the dollar. For example, a ruble-pegged stablecoin could be used to buy goods or move funds even if dollar-based systems are restricted.

Because of these factors, the high activity around the A7A5 token shows more than just sanctions activity. It also reflects broader money flows that align with state interests and use crypto to support political or strategic goals. In short, some actors are using crypto to build alternative financial systems that work alongside or outside traditional money rules.

Fraudulent crypto grows beyond sanctions. Looking beyond sanctions-related activity, the report shows that total illicit crypto inflows reached a record high in 2025. However, the illicit activity represented a smaller share of the crypto market than in past years. When the report measures on-chain activity (the data recorded directly on the blockchain), illicit activity accounted for about 1.2% of total on-chain volume in 2025. This is a small drop from 1.3% in 2024, and well below the 2.4% peak seen in 2023.

Another way to look at the figures is to measure the amount of new money entering the system. Illicit actors received about 2.7% of incoming flows to virtual asset service providers (VASPs) in 2025. This is a slight drop from 2.9% in 2024, and much lower than 6.0% in 2023. VASPs are companies like crypto exchanges and wallet providers that help people buy, sell, and use crypto. These numbers tell us that while illegal activity grew in absolute size, it took a smaller share of new money entering the crypto world.

To understand these numbers better, it helps to explain a few terms in simple language. A sanction is a punishment by a country or group of countries. It can include restrictions on money, trade, or other activities. Attribution means figuring out who owns a crypto address or who is behind a digital wallet. On-chain means data that is stored on the blockchain and can be seen by anyone. A hub or node is a central place that connects many other players in a network. A stablecoin is a crypto designed to keep a stable value. It is often tied to a real asset like the dollar or the ruble. For readers who want to learn more, the definitions section at the end of this article provides short explanations with links to Wikipedia.

The TRM Labs report also highlights a practical idea: sanctions and new government actions are becoming more precise and easier to connect to real people and groups because of better tools. This means investigators can track money flows more accurately and understand how criminals move funds across borders. It also means policymakers can respond with updated rules and new sanctions when needed. In this way, the report shows a dynamic picture where technology and geopolitics work together to shape how crypto money moves around the world.

The headline finding from the report is notable: Russia-linked crypto activity helped push illicit wallet inflows to a five-year high in 2025. This is not a forecast for the future, but a snapshot of what happened in that year. It shows how political decisions, enforcement actions, and technology interact with digital money in new and important ways. As the world uses crypto more and more in everyday life, researchers say it is essential to keep watching how money moves and who is using it for good or bad purposes.

Definitions