The era of the hooded hacker hoarding Bitcoin in a dark web wallet is over.
In 2025, the center of gravity of the illicit cryptocurrency economy shifted decisively away from the volatility of the original cryptocurrency and towards a dense, dollar-pegged shadow system.
According to new Chainalysis data shared with CryptoSlatestablecoins accounted for 84% of the $154 billion illicit transaction volume last year, marking a clear shift in risk to programmable dollars.
This structural shift has allowed Chinese money laundering networks to scale up money laundering-as-a-service operations, while nation states like North Korea, Russia and Iran have joined the same bandwagon to evade Western controls.
Why Criminals Dumped Bitcoin
The most noticeable trend in the 2025 data is the supplanting of Bitcoin as the top crime currency. For over a decade, Bitcoin was synonymous with illegal online activity, but its dominance has steadily eroded since 2020.
As shown in the illegal activity graph below from 2020 to 2025, Bitcoin’s share of the dirty streams has plummeted year after year, while stablecoins have boomed and captured the vast majority of the market.
This migration is not accidental. It reflects trends in the broader legitimate crypto economy, where stablecoins are becoming increasingly dominant due to their practical benefits: easy cross-border transferability, lower volatility than assets like Bitcoin or Ethereum, and broader utility in decentralized finance (DeFi) applications.
However, these same characteristics have made stablecoins the asset of choice for sophisticated criminal enterprises.
Bitcoin’s shift thus represents a modernization of financial crime.
By using assets linked to the US dollar, criminal actors are effectively exploiting a shadow version of the traditional banking system, one that moves at the speed of the internet and operates outside the direct reach of US regulators.
This “dollarization” of crime allows cartels and state actors to settle payments in a stable unit of account, without exposure to the wild price swings that characterize the rest of the crypto market.
The geopolitical pivot
If the period from 2009 to 2019 was the “early days” of rogue niche cybercriminals, and 2020 to 2024 was the era of “professionalization,” 2025 marked the arrival of “wave 3”: large-scale nation-state activity.
In this new phase, geopolitics has become on-chain. Governments are now leveraging the professional services firms originally built for cybercriminals, while at the same time building their own tailor-made infrastructure to evade sanctions on a large scale.
Russia in particular has demonstrated the viability of state-backed digital assets for sanctions evasion. Following legislation introduced in 2024 to facilitate such activities, the country launched its ruble-backed A7A5 token in February 2025.
In less than a year, the token traded more than $93.3 billion, allowing Russian entities to bypass the global banking system and move value across borders without relying on SWIFT or Western correspondent banks.
Likewise, Iran’s proxy networks have continued to use the blockchain for illicit financing.
Confirmed wallets identified in the sanctions designations show that Iran-affiliated networks facilitated money laundering, illicit oil sales, and the procurement of weapons and raw materials amounting to more than $2 billion.
Despite several military setbacks, terrorist organizations affiliated with Iran, including Lebanese Hezbollah, Hamas and the Houthis, are using cryptocurrency on a scale never before seen.
North Korea also recorded its most destructive year to date. DPRK-linked hackers stole $2 billion in 2025, a figure driven by devastating megahacks.
The most notable of these was February’s Bybit exploit, which resulted in losses of nearly $1.5 billion, marking the largest digital heist in cryptocurrency history.
Money laundering industrialization
This increase in volume is supported by the rise of Chinese money laundering networks (CMLNs) as the dominant force in the illicit ecosystem in the chain. These networks have dramatically increased the diversification and professionalization of cryptocrime.
Building on frameworks established by operations like Huione Guarantee, these networks have created full-service criminal enterprises.
They provide specialized money laundering-as-a-service capabilities and support a diverse customer base that ranges from fraudsters and scammers to North Korean state-backed hackers and terrorist financiers.
A key trend identified in 2025 is the increasing dependence of both illegal actors and nation states on infrastructure providers offering a ‘full suite’ of services.
These providers, who are themselves visible in the chain, have evolved from niche hosting resellers to integrated infrastructure platforms. They offer domain registration, bulletproof hosting, and other technical services specifically designed to withstand takedowns, abuse complaints, and sanctions enforcement.
By providing a resilient technical backbone, these providers increase the reach of malicious cyber activity. They enable financially motivated criminals and state-linked actors to continue their activities even as law enforcement agencies attempt to dismantle their networks.
Convergence of digital and physical threats
While the narrative of crypto crime often focuses on digital theft and money laundering, 2025 provided clear evidence that on-chain activity is increasingly intersecting with violent crime in the physical world.
Human trafficking operations are increasingly using cryptocurrency for financial logistics, moving proceeds across borders with relative anonymity.
Even more disturbing is the reported increase in physical coercive attacks. Criminals are increasingly using violence to coerce victims into transferring assets, often timing these attacks to coincide with cryptocurrency price spikes to maximize the value of the theft.
Illegal activities still make up less than 1% of the crypto economy
Despite these alarming trends, the broader context remains important. The illicit volumes tracked in 2025 will remain less than 1% of the legitimate crypto economy.
However, the qualitative shift in that 1% is what concerns regulators and intelligence services. The integration of nation states into the illicit supply chain via stablecoins raises the stakes for national security.
As government agencies, compliance teams and security professionals look to 2026, the challenge will be disrupting a professionalized, state-sponsored shadow economy that has successfully weaponized the efficiency of the modern financial world.
Collaboration between law enforcement agencies, regulators, and crypto companies will be critical as ecosystem integrity now intersects directly with global geopolitical stability.