How international sanctions are shaping illegal crypto activity.

Chainalysis has documented $154 billion in illegal revenue streams, mostly through authorized entities. The A7A5 token, backed by the Russian ruble, has transacted more than $93.3 billion in one year. Despite rapid growth, illegal transactions remain less than 1% of total on-chain activity.

In 2025, illegal cryptography has expanded rapidly, not because of a sudden increase in everyday crypto-crimes, but because of structural changes in how sanctioned states and entities move money.

As global financial restrictions expand, blockchain networks have become an alternative channel for cross-border transfers that are increasingly difficult to block or track with traditional systems.

According to a new report from Chainalysis, this shift is changing the shape, scale and participants of the illegal crypto ecosystem.

By 2025, illegal crypto addresses have earned at least $154 billion, a 162 percent jump from $59 billion in 2024.

Chinalizzi attributes much of this growth to the amount of money that sanctioned actors move through the chain.

While illegal activity still represents less than 1% of all crypto transactions, its rapid expansion shows how sanctions policy is affecting blockchain usage in ways not seen in years past.

Blocks prevent movement on the chain

Chainalysis describes 2025 as a turning point, unprecedented in relation to nation-state behavior.

Unlike earlier stages dominated by hacking, fraud and darknet markets, recent activities have shown greater coordination and technical sophistication.

This reflects the growing awareness among blockchain devices of the limited access to the global banking system among the entities that have been sanctioned.

Sanctions have increased significantly globally.

Global sanctions inflation estimated in May that approximately 80,000 individuals and entities are currently under sanctions.

A separate study from the Center for New American Security found that the United States will add 3,135 individuals to the list of specially designated nationals and embargoed persons by 2024, the highest annual total to date.

This expanding restriction environment has increased incentives to seek alternative settlement systems.

The growing role of Russia

Russia, which has faced heavy international sanctions since its invasion of Ukraine, is one of the main contributors to the growth of illicit crypto flows.

In the year In February 2025, a Russian ruble-backed digital token will be known as A7A5.

According to Chainalysis, the token has transacted more than $93.3 billion in less than a year.

The use of government-linked tokens shows how governments, which have been sanctioned, are experimenting with blockchain-based tools to secure business and financial communications.

This approach differs from earlier patterns of crypto use, where states were mostly passive users of illicit networks rather than active participants in token-based systems.

Stablecoins take center stage

In the year Stablecoins played a dominant role in illegal crypto activity in 2025, accounting for 84% of the total illegal transaction volume.

Chinalysis associates this with price stability, high liquidity and cross-border transferability.

These same features that support legitimate payments and funds have made stable funds attractive to sanctioned users seeking a predictable settlement.

The growing reliance on Statcoins reflects a shift from volatile assets to illicit transfers.

Instead of speculative transactions, the focus has shifted to efficiency, reliability and scale, especially in large-value transactions involving sanctioned entities.

Crime remains a small part

Despite recorded illegal volumes, Chinalysis emphasizes that criminal activity is still a small fraction of the broader crypto economy.

Overall, on-chain activity has expanded significantly over the year, with illegal transactions accounting for less than 1% of total volume, even as their absolute value continues to rise.

Other forms of crypto-related crime continue alongside sanctions-driven flows.

Blockchain security firm PeckShield documented more than 20 major exploits in December, including address poisoning scams and private key leaks that resulted in tens of millions of dollars in losses.