State Actors Launder Billions in Record Crypto Crime Surge
▼ Summary
– Nation-state involvement in cryptocurrency crime increased significantly in 2025, with states using both professional services and custom-built systems to evade sanctions.
– Illicit cryptocurrency transactions reached a record $154 billion in 2025, a 162% increase, though they still accounted for less than 1% of total transaction volume.
– Stablecoins were the dominant asset in illicit activity, comprising 84% of the illicit transaction volume in 2025.
– State-linked actors like North Korean hackers stole around $2 billion, while Russian, Iranian, and Chinese networks were involved in sanctions evasion and money laundering on a massive scale.
– Cryptocurrency crime is increasingly linked to violent physical crimes like human trafficking and coercion, while traditional cybercrimes like ransomware and fraud also persisted.
The landscape of cryptocurrency crime has undergone a dramatic transformation, evolving from isolated scams into a highly organized, multi-billion dollar industry with significant state-level involvement. Research indicates that illicit cryptocurrency activity reached a staggering new high in 2025, with identified wallets receiving at least $154 billion. This represents a massive 162% surge from the previous year and underscores a troubling trend where sophisticated criminal networks and nation-states are increasingly leveraging blockchain technology for large-scale operations.
This infrastructure isn’t just for independent criminal groups. State actors are now actively utilizing these same on-chain systems, both through established professional money laundering services and through custom-built financial networks specifically engineered to circumvent international sanctions. While this illicit activity still constitutes less than one percent of total crypto transaction volume, its scale and sophistication pose a serious threat to global financial security.
A closer look at the data reveals the prominent role of stablecoins, which accounted for 84% of all illicit transaction volume in 2025. Their prevalence in cross-border payments makes them a favored tool for moving illicit funds. Beyond the choice of asset, the actors driving this volume are particularly alarming. North Korean-linked hacking groups were responsible for stealing approximately $2 billion in cryptocurrency, with a single attack on the Bybit exchange accounting for nearly $1.5 billion of that total.
Russian-aligned activity also featured prominently, with a ruble-backed stablecoin processing over $93 billion in transactions linked to sanctions evasion within its first year. Similarly, wallets connected to sanctioned Iranian entities moved more than $2 billion, often tied to oil sales and procurement. Furthermore, Chinese money laundering networks expanded their role, providing critical services to convert and move illicit funds for a wide range of clients, including fraud rings, scam operations, and state-associated hacking groups.
Perhaps most disturbingly, the connection between digital crime and real-world violence is strengthening. Criminal enterprises are now using cryptocurrency in human trafficking operations, and there has been a rise in physical coercion attacks where victims are violently forced to transfer assets, sometimes timed to periods of high crypto valuations.
Despite the focus on nation-state activity, traditional cybercrime remains a persistent force. The ecosystem continues to support ransomware operators, darknet marketplaces, and extensive fraud rings, all relying on resilient infrastructure designed to avoid law enforcement takedowns. This complex web of criminal and state-sponsored activity marks a new, more dangerous chapter in the ongoing challenge of securing the digital financial frontier.
(Source: HelpNet Security)
