Illicit cryptocurrency wallets received an estimated $158 billion in 2025 — the highest level in five years and a rise of nearly 145% from $64.5 billion in 2024 — according to blockchain intelligence firm TRM Labs. Scams, hacks, sanctions evasion and money laundering all contributed to the record, with data from TRM Labs, Chainalysis and INTERPOL tracing where the money came from and where it went.

Both analytics firms stress that their figures are estimates compiled by blockchain analysis companies and law enforcement, and that totals tend to rise in later revisions as additional wallets are tied to crime.

Key Figures at a Glance

• $158 billion in illicit crypto inflows in 2025, up nearly 145% from 2024 (TRM Labs)
• $35 billion sent to fraud schemes in 2025 (TRM Labs), alongside an estimated $17 billion in scam losses (Chainalysis)
• $2.87 billion stolen in nearly 150 hacks, with the Bybit breach alone at $1.46 billion
• $93 billion in inflows to sanctioned entities and jurisdictions
• Scams with on-chain links to AI vendors earned 4.5 times more per operation than other scams
• Illicit actors took 2.7% of available crypto liquidity, down from 6.0% in 2023

Illicit Volume Hits a Five-Year High

The $158 billion estimate for 2025 marks the highest total in five years, TRM Labs says, reversing three straight years of decline during which totals fell from $85.9 billion in 2021 to $64.5 billion in 2024.

The firm attributes most of the increase to a handful of large events: new sanctions designations, major hacks and faster wallet attribution all pushed the total higher.

TRM treats its figure as a floor rather than a final count. Because wallets are often linked to crime months or years after the fact, past totals tend to be revised upward. The firm's earlier estimate for 2023, for example, rose from $34.8 billion to more than $58 billion as new data came in. TRM also changed its methodology this year, meaning older figures may not match previously published reports.

Crime's Share of the Market Shrank

Despite the record dollar total, crime took a smaller slice of overall market activity. Illicit activity represented 1.2% of attributed on-chain volume in 2025, down from 1.3% in 2024 and 2.4% in 2023.

TRM also introduced a new metric this year that compares illicit inflows with funds leaving exchanges and other service providers, which it uses as a proxy for available liquidity. The reasoning is that the same dollar can move many times and inflate volume figures, whereas liquidity offers a clearer view of how much new capital reaches criminals.

By that measure, illicit actors captured 2.7% of available liquidity, down from 6.0% in 2023. Both measures point the same way: crime grew in dollar terms but fell as a share of the wider market. The gap is what lets both facts hold at once — illicit volume set a record even as overall attributed activity grew faster, leaving crime a smaller slice of a much larger market.

Sanctions-Related Flows Grew Fastest

Sanctions-related inflows grew by more than 400% from 2024 to 2025, the fastest of any category. Blocklisted entities rose 32% and hacked or stolen funds rose 31%. Market-driven crime grew more slowly, with darknet markets up 20% and illicit goods and services up 12%.

TRM links part of the sanctions surge to improved attribution. Authorities now include wallet addresses in designations, and Tether has expanded its blocklisting of wallets tied to sanctions, fraud and hacking. TRM also credits its Beacon Network, a tool that lets law enforcement share high-confidence intelligence, saying the network speeds up attribution without changing what counts as illicit.

Scams: $17 Billion to $35 Billion, Depending on Method

Chainalysis estimates that crypto scams and fraud took in $17 billion in 2025. The firm has counted at least $14 billion on-chain so far and expects the total to grow as more wallets are identified. The average scam payment rose from $782 in 2024 to $2,764 in 2025, an increase of 253%, indicating scammers are extracting more from each victim.

TRM, using a different methodology and a wider net, counted about $35 billion sent to fraud schemes in 2025, close to the $38 billion it recorded for 2024. Of the 2025 total, $23 billion was verified fraud and $12 billion came from community complaints. TRM warns that because most victims never report, the real figure is likely higher.

Investment schemes made up 62% of fraud inflows, with pig butchering and Ponzi schemes the dominant types. Large Ponzi schemes also multiplied: 13 schemes took in more than $100 million in 2025, compared with six in 2024.

Impersonation Scams and the AI Effect

Impersonation scams grew more than 1,400% from 2024, according to Chainalysis, while the average payment to such scams rose by more than 600%.

One prominent example was the fake E-ZPass text campaign. According to Google's lawsuit, a related group sent as many as 330,000 texts in a single day and took in $1 billion over three years from more than 1 million victims across at least 121 countries.

The infrastructure behind such campaigns is cheap. Phishing kits can cost under $500, and the Lighthouse kit vendor received more than 7,000 deposits totaling about $1.5 million in crypto over three years. Scammers also pose as private companies: in December 2025, Brooklyn prosecutors charged a man over a scheme that posed as Coinbase support and took nearly $16 million. That scheme relied on stolen customer data — an insider allegedly took $250,000 in bribes, and the leak exposed the data of nearly 70,000 customers.

Chainalysis describes modern fraud as a supply chain. The Lighthouse group, for instance, divided work among developers, data brokers, spammers, thieves and administrators, allowing unskilled criminals to run large campaigns.

AI tools amplify the effect. Scams with on-chain links to AI vendors earned an average of $3.2 million per operation, compared with $719,000 for those without — a 4.5-fold difference. INTERPOL reached the same 4.5-times figure in its 2026 threat assessment, and TRM says AI-enabled scam activity rose by about 500% over the past year. Ready-made tools compound the trend: Chainalysis found that scams using phishing kits were 688 times more effective in dollar terms than regular scams.

Hacks: Losses Concentrated in a Few Large Attacks

Hackers stole $2.87 billion across nearly 150 incidents in 2025, TRM reports. Incident counts were similar to recent years, but losses were concentrated in a few large attacks. The February breach of the Bybit exchange took $1.46 billion — 51% of the year's total — and without it, losses would have been about $1.4 billion. The top 10 incidents accounted for 81% of all stolen value.

The average hack was $19.5 million, while the median was only $1.3 million. Infrastructure attacks, target keys, wallets and access controls, averaged about $48.5 million per incident, compared with $6.7 million for code exploits.

TRM attributes $1.92 billion in thefts to North Korea-linked actors in 2025 and says these groups often use Chinese over-the-counter brokers to cash out quickly. The firm argues that audits of smart contract code are no longer enough, pointing to hardware-backed key storage, withdrawal limits and tighter security for developer systems as the main defenses.

Sanctions and State Use of Crypto

Inflows to sanctioned entities and jurisdictions reached $93 billion in 2025, driven mostly by Russia-linked flows. The ruble-pegged stablecoin A7A5 handled more than $72 billion, while the A7 wallet cluster, tied to a Russian sanctions evasion network, was linked to about $39 billion. TRM says about 34% of A7A5 trading volume was likely inflated by wash trading. The Cambodian group Huione received $39.6 billion after being designated by FinCEN.

Nearly 95% of inflows to sanctioned entities used stablecoins. That concentration also gives regulators and issuers a direct lever, since blocklists and token freezes act on the stablecoins themselves — tools authorities applied repeatedly in 2025. Flows through centralized exchanges fell by nearly 30% from 2024 to 2025, while flows through high-risk and no-KYC services rose by more than 200%.

Authorities made 21 crypto-related sanctions designations in 2025 across the EU, UK and US, 16 of which included wallet addresses.

Iran's crypto activity stayed steady under pressure, with TRM counting about $11.4 billion in 2024 and $10 billion in 2025. Venezuela ranked 11th among the top 20 countries for crypto adoption in 2025, according to TRM, with residents using the stablecoin USDT for payments and remittances because the bolivar has lost value and banking access is limited.

Terror groups also use crypto. TRM links ISIS affiliates in Syria, Nigeria and Somalia to crypto fundraising and says eight wallets sanctioned for links to the Houthis handled over $1.8 billion. During the 12-day Iran-Israel conflict in June, volume rose about 35% while transaction counts fell about 40%, which TRM reads as users moving money in fewer, larger transfers.

Money Laundering: Over $60 Billion Moved Onward

More than $60 billion left illicit wallets and reached other services in 2025, TRM reports, with most of it flowing through exchanges and other service providers.

Chinese-language escrow and guarantee services have become a main settlement layer, with their inflows rising from about $123 million in 2020 to over $103 billion in 2025. The market is concentrated: Huione Pay handled about $73 billion, followed by Haowang, Xinbi and Tudou.

Enforcement has moved the market rather than ended it. After FinCEN's action on Huione, Telegram removed channels tied to Haowang and Xinbi, and activity shifted toward Tudou.

Scam Compounds and the Southeast Asia Link

Chainalysis ties much of the scam economy to East and Southeast Asia. Many operations run from compounds in Cambodia and Myanmar, where trafficking victims are forced to carry out the fraud.

One telltale sign is the calendar: since about 2022, pig butchering inflows have dropped during the seven-day Chinese New Year holiday, suggesting that workers in the region drive a large share of the activity.

The cash-out route has changed as well. In Q1 2022, under 1% of pig butchering laundering flows went to Chinese-language laundering networks; by Q1 2024 the share was slightly over 20%, and it stayed above 10% through 2025. Over the same period, scammers used centralized exchanges less often — Chainalysis suggests this is because exchanges can freeze funds. Fraud networks are also moving money faster: since 2024, many pass funds on within 48 hours, narrowing the window for freezes.

Crypto ATMs are one entry point for older victims. The FBI reported that people aged 60 and older lost $2.8 billion to crypto-related scams in 2024. INTERPOL says scam centers are no longer a regional problem — they have been found worldwide and involve hundreds of thousands of people.

Ransomware and Darknet Markets

Ransomware payments stayed high in 2025 but did not reach past peaks, and victim claims on leak sites rose sharply, suggesting more targets refused to pay. TRM counted 93 new ransomware variants in 2025, up 94% from 48 in 2024, with 161 active variants by year-end. Akira took in $150 million in 2025, almost twice as much as the next group, Qilin, while the newcomer SafePay posted 452 victims by December.

Laundering habits changed too: bridge use grew 66% across 2024 and 2025, while mixer use fell 37%. Akira has altered its laundering method at least four times since 2023; its current pattern sends each payment through a unique address and two consolidation addresses before it reaches the same exchange cash-out point.

Online drug markets grew as well. Darknet marketplaces received $1.7 billion in 2025, up 20%, and the wider online drug trade received over $3.4 billion. Russian-language markets drive the growth, and nearly half of new markets accept only Monero, a privacy coin. Chinese chemical makers supply the ingredients for synthetic drugs, with inflows to precursor vendors rising from $30.9 million in 2023 to $34.7 million in 2024 and $39.1 million in 2025. Cartel-linked money launderers have moved more than $3 billion through crypto over time, TRM estimates, with most of that coming in the past two years.

Law Enforcement and Global Fraud Response

Enforcement also set records. In the UK, police recovered more than 61,000 bitcoin from Zhimin Qian, who ran a fraud that hit more than 128,000 victims in China; she was sentenced to 11 years and eight months. In the US, charges against Prince Group chairman Chen Zhi came with efforts to seize more than $15 billion linked to scam activity, and OFAC and the UK sanctioned 146 targets tied to the group.

The effect on payment hubs was visible: Huione Pay inflows peaked near $4.7 billion in July 2025, then fell to about $100 million by December.

INTERPOL's 2026 assessment documents growing cooperation. Fraud-related notices and diffusions have risen 54% since 2024, and the agency supported more than 1,500 cross-border fraud cases involving $1.1 billion in lost assets.

Other takedowns hit laundering tools. German and Swiss authorities seized the Cryptomixer service and about 12 terabytes of its data, and Canada took down the TradeOgre exchange in its largest crypto seizure. Spain and the EU arrested dozens of people in a cash-to-crypto case and seized more than 30 million euros in cash, crypto and bank funds. Authorities also froze tens of millions of dollars in USDT, showing they can now act quickly on stablecoins.

INTERPOL warns that scam centers now operate worldwide and involve hundreds of thousands of people, many of them trafficked. It launched Operation Shadow Storm to target the money behind them.

What the Data Shows

The 2025 figures point to a larger, more organized crypto crime economy. Total flows hit a record, but criminals took a smaller share of the market than in earlier years. A few large events shaped the year: sanctions designations, the Bybit hack and Russia-linked networks account for much of the rise. Scams are evolving as AI tools, phishing kits and laundering services make fraud cheaper to run and larger in scale.

At the same time, law enforcement is catching up. Record seizures, wallet-level sanctions and wider cooperation are making it harder to cash out — though networks keep migrating to new platforms. Two markers will show how the picture evolves from here: whether the 2025 total climbs in later revision the way earlier years' figures did, and where laundering activity displaced from hubs such as Huione Pay settles next.

Sources

• Chainalysis: Record $17 Billion Estimated Stolen in Crypto Scams and Fraud in 2025
• TRM Labs: 2026 Crypto Crime Report
• TRM Labs: 2026 Crypto Crime Report Key Insights
• INTERPOL: Report warns of increasingly sophisticated global financial fraud threat

This article is based on reporting originally published by CoinCentral: https://coincentral.com/crypto-crime-statistics/