2026 Crypto Crime Report

TRM identifies record USD 158 billion in illicit crypto flows in 2025, reversing a multi-year decline

These takeaways reflect the current state of the cryptocurrency environment: no longer novel or peripheral, but broadly integrated and, in some cases, deeply embedded in traditional economic activity. Regulators, everyday users, governments, and criminal actors alike now encounter crypto as a routine part of financial life. Crypto tools are easier to use, increasingly seamless, and woven into both legitimate and illicit financial services, while many governments are incorporating digital assets into national economic strategies. The result is a growing baseline fluency with crypto that has, at the same time, improved the detection of illicit activity and enabled larger volumes of value to move through the broader illicit crypto ecosystem.

The percentage of illicit activity represents only a small fraction of overall activity, as has always been the case. However, TRM believes there are better ways to contextualize this figure and has adopted methodological changes to reflect this, detailed below.

Illicit cryptocurrency wallets received an estimated USD 158 billion in incoming value in 2025 , a sharp increase from USD 64.5 billion in 2024 and the highest level observed over the past five years. Prior to this rebound, total incoming value to illicit entities had declined steadily from USD 85.9 billion in 2021 to USD 75.4 billion in 2022 and USD 73.3 billion in 2023, before reaching a low point in 2024. The change in 2025 reflects a combination of intensified sanctions designations, increased use of crypto by nation-state actors, and technological advances by TRM that enable detection of previously unattributed illicit volume. The Beacon Network is one such example: a real-time intelligence-sharing system that allows law enforcement agents to flag addresses linked to financial crime, immediately alerting exchanges and triggering risk-based responses.

Despite the increase in absolute value in 2025, the percentage of illicit activity continued to decline. Measured as a of total attributed on-chain volume, illicit activity fell slightly to 1.2% in 2025 from 1.3% in 2024 1 , well below the 2023 high of 2.4%.

When we contextualize illicit activity relative to incoming liquidity, a similar trend emerges: illicit entities received 2.7% of incoming VASP flows in 2025 , compared with 2.9% in 2024 and 6.0% in 2023. Together, these metrics indicate that while certain illicit categories expanded in absolute terms, illicit actors absorbed a smaller proportion of new capital entering the crypto ecosystem.

{{28-2026-crypto-crime-report-footnote-1}}

Volumes associated with sanctioned entities and jurisdictions rose sharply in 2025, led by USD 72 billion received by the A7A5 token, followed by an additional USD 39 billion associated with the A7 wallet cluster. This growth was highly concentrated: the vast majority of sanctions-linked volume was connected to Russia-linked entities, including Garantex, Grinex, and A7.

The increase is not linked to growth in sanctions evasion activity alone, but also to new designations of large entities in combination with improved attribution of cryptocurrency addresses to already-sanctioned actors.

{{28-2026-crypto-crime-report-callout-1}}

A7 stands out not only for its scale, but for its role as centrally coordinated sanctions evasion architecture tied to Russian state interests . On-chain activity indicates that A7 functions as a hub connecting Russia-linked actors with counterparties across China, Southeast Asia, and Iran-linked networks — reflecting a deliberate shift toward crypto-enabled, state-aligned financial infrastructure.

While the A7 wallet cluster is closely associated with sanctions evasion activity, the A7A5 token reflects a broader strategy to reduce reliance on USD-backed rails by expanding use of a ruble-pegged stablecoin . As a result, high volumes associated with A7A5 do not exclusively represent sanctions evasion, but rather sanctioned activity more broadly, including state-aligned economic flows. Together, these dynamics illustrate how Russia-linked actors are increasingly leveraging crypto — particularly stablecoins and higher-risk services — as part of a long-term, nationstate-backed strategy.

Inflows to sanctioned entities predominantly used stablecoins. This preference for stablecoins and move to high-risk services reflects the environment of more effective enforcement, expanded use of crypto identifiers in sanctions designations, and increased risk of detection or asset freezing. Together, these dynamics point to a sanctions environment in which authorities prioritize Russia-linked networks; enforcement tools are more crypto-native; and illicit actors adapt by moving to riskier, less regulated channels.

Geopolitical pressures reshaped illicit crypto activity in 2025, as state and state-aligned actors moved to using cryptocurrency as core financial infrastructure rather than a tool of last resort . While Russia-linked networks largely drove sanctions-related crypto volume, the more consequential shift was the institutionalization of crypto rails by other sanctioned actors.

In Venezuela , for example, crypto functioned as a pressure-release valve in a heavily sanctioned economy where traditional banking access is limited — supporting payments, remittances, and state-linked financial activity.

China occupies a distinct role in the illicit crypto landscape as a hub for illicit financial services infrastructure. TRM analysis shows that activity associated with Chinese-language escrow services and underground banking networks has grown sharply over time, with adjusted crypto volume rising from approximately USD 123 million in 2020 to over USD 103 billion in 2025 .

This sustained growth reflects the increasing reliance of a wide range of illicit actors — including scam networks, cybercrime groups, and sanctions evasion intermediaries — on escrow-based crypto services for settlement and cash-out across the APAC region.

These services facilitate high-volume stablecoin transactions and bridge crypto assets into the formal financial system through OTC brokers, money mule networks, and APAC-based casinos.

This activity reiterates a clear theme for 2025: the illicit crypto ecosystem is being shaped by its accessibility and integration into everyday financial activity . Globally accessible service providers like these Chinese escrow services enable criminal demand at scale, with stablecoins serving as the primary connective layer between geopolitical actors, intermediaries, and illicit markets.

Adjusted total incoming illicit cryptocurrency activity rose to approximately USD 158 billion in 2025 , the highest level observed in the past five years, and a sharp increase from USD 64 billion in 2024. This reversal followed three consecutive years of decline and reflects a renewed expansion of illicit activity across multiple categories, rather than growth driven by a single event type or market cycle.

Key drivers of this increase include:

Taken together, these dynamics indicate that the 2025 increase in total incoming illicit crypto activity was driven less by broad-based expansion across all illicit activity types and more by concentrated shocks, enforcement-linked developments, and faster, higher confidence attribution by TRM , particularly around large-scale hacks and sanctions-related flows.

{{premium-content_chapter-divider}}

Why we rethought how illicit crypto activity is contextualized

Illicit cryptocurrency activity has traditionally been expressed as a percentage of total blockchain transaction volume. While this framing offers a convenient high-level reference point, it has meaningful limitations that become more pronounced as crypto markets mature.

Total blockchain volume captures a wide range of activity that does not necessarily correspond to real economic transfers or changes in ownership. High-frequency trading, automated market making, arbitrage, internal exchange flows, and technical behaviors such as funds cycling repeatedly across addresses can materially inflate transaction volume without introducing new capital or increasing the amount of value effectively in circulation.

Although TRM applies techniques to estimate ownership changes and filter out certain internal or self-referential movements, these methods are inherently imperfect. In practice, distinguishing between genuine economic transfers and technical or intermediary-driven activity is increasingly difficult in markets defined by rapid trading, layered infrastructure, and repeated reuse of the same funds across multiple wallets. As a result, total blockchain volume often functions as a noisy denominator — one that can mask the true economic scale and impact of illicit activity rather than illuminate it .

For this reason, TRM has made two changes to this estimate this year:

For the lower-bound estimate, TRM now constrains the denominator to cryptocurrency activity involving known services, known wallets, and service-like clusters, along with a limited set of clusters that clearly behave like services but lack full attribution . This adjustment is designed to more closely align the denominator with activity that reflects real economic use, rather than technical or self-referential movement.

The revised approach intentionally excludes large volumes of activity that inflate transaction counts without representing meaningful transfers of value. This includes wash trading, peel chains, internal exchange movements, and high-frequency arbitrage activity. Such behaviors can generate substantial on-chain volume while introducing little to no new capital and without increasing the amount of value available to users. Their prevalence has grown alongside newer blockchains and trading environments that enable highly automated strategies.

TRM is introducing a new metric that frames illicit activity as a of VASP outflows, rather than as a of total on-chain transaction volume. This approach reflects our view that illicit risk is better understood relative to available liquidity than to aggregate blockchain activity. In this report, we approximate available liquidity using the USD value of funds leaving virtual asset service providers (VASPs). VASP outflows represent the point at which value exits custodial environments and becomes freely deployable across the on-chain ecosystem, where it can be transferred, converted, and used for a wide range of purposes — including illicit activity.

A simplified example illustrates the distinction.

{{28-2026-crypto-crime-report-callout-2}}

This liquidity-based framing better aligns with how illicit networks operate in practice. Illicit actors are constrained not by transaction counts, but by access to transferable value that can fund operations, payments, and downstream networks. By anchoring the denominator to funds leaving VASPs, this metric focuses on the pool of capital that is realistically accessible for use, rather than on technical transaction activity driven by market structure, trading strategies, or internal system behavior.

We do not suggest that VASP outflows capture all sources of liquidity, nor that every outflow represents newly introduced capital. However, as a consistent and observable baseline, available liquidity provides a more stable and economically meaningful context for assessing illicit activity than total blockchain volume alone . Used alongside traditional measures, this approach offers a clearer and more intuitive view of how illicit actors participate in — and draw value from — the crypto ecosystem.

TRM’s estimate of total illicit cryptocurrency volume is based on the USD value of funds stolen through crypto-native hacks, combined with the USD value of transfers to blockchain addresses on Bitcoin, Ethereum, TRON, Binance Smart Chain, and Polygon that TRM has attributed to illicit entities. These entities include a broad range of threat categories, such as fraud schemes, sanctioned actors, terrorist organizations, and darknet marketplaces.

We treat this estimate as a conservative baseline — a minimum, or “floor,” for illicit cryptocurrency activity. Illicit activity on blockchains is frequently identified with delay, as attribution improves over time through law enforcement actions, sanctions designations, judicial proceedings, and open-source reporting. As new intelligence emerges and additional wallets are linked to known illicit actors, historical estimates often increase, reinforcing the view that initial measurements understate the true scale of illicit activity at the time it occurred.

Several categories of activity are intentionally excluded from this estimate.

These figures reflect TRM’s current estimates of illicit cryptocurrency volume based on the best available intelligence at the time of publication. However, detecting and attributing illicit activity is inherently complex and often occurs with delay. As investigations progress, new sanctions are issued, cases are unsealed, and additional information becomes public, previously unknown wallets and transactions are frequently linked to illicit actors.

As a result, overall estimates of illicit volume tend to increase over time. Readers should therefore view the figures in this report as a dynamic baseline rather than a fixed measurement. This expectation of future upward revision applies both to our current methodology and to prior estimates, reflecting the evolving nature of attribution and the continual incorporation of new intelligence.

{{premium-content_chapter-divider}}

Inflows to sanctioned entities increased; counter-Russia sanctions remained an international priority

Cryptocurrency associated with inflows to sanctioned entities and jurisdictions reached USD 93 billion in 2025, with USD 72 billion of that associated with volumes with the A7A5 token. This increase, however, is largely due to new designations of large entities and to additional attribution of cryptocurrency addresses linked to already-designated entities.

While sanctions volume already accounts for the majority of illicit activity, this is compounded when considering entities under FinCEN special measures. 2025 saw the designation of Huione Group (a Cambodian conglomerate) as a foreign financial institution of primary money laundering concern under FinCEN, receiving over USD 39.6 billion in 2025 alone. New designations of major entities such as Russian cross-border payment platform A7 , the Grinex rebrand of now-sanctioned Russian cryptocurrency exchange Garantex, and the network of Cambodia-based transnational criminal organization (TCO) Prince Group , drove a large of volume to sanctioned entities and jurisdictions.

Authorities’ increasing comfort in the crypto space has enabled the attribution of cryptocurrency addresses to already-designated entities — such as the Islamic Revolutionary Guard Corps (IRGC), Herzallah Exchange and General Trading Company (Hamas), Ansarallah (Houthis), and North Korea’s Cheil Credit Bank — also contributed to this increase.

Nearly 95% of inflows to sanctioned entities and jurisdictions in 2025 were through stablecoins. Russia’s A7A5 and Tether (USDT) made up the majority of these inflows. Between 2024–2025, total flows to and from sanctioned entities and jurisdictions from centralized exchanges decreased by nearly 30%; however, flows to and from high-risk / no-KYC services and decentralized services increased by over 200%. This shift likely reflects multiple factors:

Sixteen of these designations included cryptocurrency addresses, one of which marked the first time the EU included actual addresses in a sanctions designation. In its 19th sanctions package against Russia, the EU also adopted transaction bans against the payment processor, Payeer, as well as a first of its kind action that prohibited all transactions involving A7A5. Four designations were joint sanctions between the US and allies — most notably the United Kingdom and Australia — largely focused around cybercrime and tackling international scam compounds. 2025 also marked the first de-listing of a sanctioned crypto entity, with the March 2025 de-listing of Tornado.cash following the November 2024 US Fifth Circuit decision.

Across jurisdictions, authorities' growing comfort and investigative abilities with crypto have allowed them to include addresses as identifiers in sanctions designations — especially when addresses are directly tied to designated entities and where authorities have confidence in attribution. These recent designations suggest OFAC and other designating bodies will continue to append wallet addresses where feasible to enhance enforcement.

Sanctions designations in the cryptocurrency space reflected a clear shift in executive branch priorities. Just over 50% of addresses designated in 2025 were associated with the illicit drug market, targeting businesses and individuals connected to fentanyl production and distribution. This 2025 change — when taken with other US activity in the Western Hemisphere — suggests US sanctions policy is likely to remain focused on TCOs, illicit drugs and oil, and foreign cyber actors in 2026, with an emphasis on Iranian and Venezuelan entities.

{{premium-content_chapter-divider}}

The A7 network anchored Russia’s professionalized sanctions evasion effort with over USD 56 billion in volume

When Russia invaded Ukraine in 2022 — drawing strict international sanctions — cross-border crypto movement became a function for sanctions evasion. By 2025, Russia’s sanctions evasion activity has become institutionalized, consolidating around the A7 network.

A7 is a Kremlin-backed cross-border sanctions evasion platform that has scaled functions previously carried out by smaller, fragmented networks. A leak of internal A7 communications enabled attribution of a large cluster of cryptocurrency addresses, revealing at least USD 56 billion in direct A7-related volume, with additional flows moving through intermediary wallets likely tied to A7 shell companies or foreign trade partners in places like China, Southeast Asia, and South Africa.

On-chain analysis shows over USD 2 billion in bidirectional exposure between A7, sanctioned Russian exchanges Garantex and Grinex, and multiple Kyrgyzstan-registered entities that are likely Garantex-affiliated. Several wallets display indicators consistent with shared infrastructure or overlapping control, suggesting common coordination for sanctions evasion. A7-associated addresses also show exposure to IRGC, Hamas, and sanctioned entities HuiOne and BYEX — highlighting overlap with other high-risk financial networks.

A7-linked funds moved through intermediaries across multiple jurisdictions, with particularly strong exposure to China and Hong Kong-based entities. TRM Labs identified several Chinese counterparties receiving transaction volumes far exceeding what would be expected given their apparent business profiles, indicating the use of crypto intermediaries possibly based in Hong Kong to process payments on behalf of mainland firms, where cryptocurrency use is restricted.

These entities were frequent recipients of USDT on TRON from A7, A7-affiliated wallets, and entities likely using Garantex infrastructure. Chinese logistics and electronics firms featured prominently. One Chinese freight forwarder agreed to ship missile components to Russia. They received USD 1.31 million from Garantex, with additional funds from a Kyrgyzstan-based Garantex-linked entity. Separately, A7-linked addresses show over USD 37 million in exposure to a Chinese electronics reseller, reinforcing the role of China-based intermediaries in supporting Russia’s wartime supply chains.

Stablecoins were central to Russian sanctions evasion activity in 2025, as they were in other heavily restricted economies. While A7A5 saw increased usage within the A7 and Garantex ecosystems, USDT was the dominant settlement asset for cross-border payments.

Approximately 34% of A7A5’s trading volume was likely artificially inflated through wash trading — including rapid, circular transfers consistent with automated behavior — according to TRM analysis. The scale and velocity of these patterns make explanations such as P2P trading or fiat on and off-ramps unlikely. Instead, the activity appears designed to inflate apparent liquidity and build confidence in a relatively novel stablecoin for international trade.

On-chain analysis indicates that A7A5 was used disproportionately in transactions between A7, Garantex, and Kyrgyzstan-based entities that are likely part of the same sanctions evasion network. A7A5 was primarily used to settle transactions between these foreign intermediaries, Russian entities, and trade partners involved in procurement — bolstering TRM’s assessment that A7A5 is meant as an internal settlement mechanism as part of a larger sanctions evasion network, not a globally competitive stablecoin . The pairing of a domestically linked stablecoin with shared on-chain infrastructure underscores the need for innovation and coordination from sanctioning bodies as Russia adapts to sanction regimes.

Russia-linked crypto services increasingly responded to sanctions and enforcement actions through rapid rebranding and reincorporation. Following the March 2025 international law enforcement operation against Garantex , Telegram channels associated with the platform quickly a successor service, Grinex . On-chain analysis later confirmed continuity between the two , including asset migration facilitated through A7A5.

TRM also identified multiple additional Russia-linked platforms launched in Kyrgyzstan that shared almost identical user interfaces, backend infrastructure, and wallet heuristics with Garantex. ABCeX and its rebrand AEXBit showed similar patterns — such as co-spending into a shared hot wallet — indicating common control. In a similar effort, Russia-affiliated payment processor Cryptomus launched a parallel service, Heleket , which received its initial liquidity directly from Garantex. TRM identified shared characteristics — including coordinated launch timelines, minimal service or compliance changes, and overlapping on-chain infrastructure — confirming our assessment that these services were simply rebranded.

These 2025 rebrands are likely part of a centrally coordinated effort to preserve Russia’s access to international crypto liquidity while insulating core operators from sanctions and legal exposure. Faster attribution, targeting shared infrastructure rather than specific brands, and greater comfort with crypto-specific sanctions may enable authorities to more effectively combat these networks in 2026.

Stablecoins, P2P activity were central to Venezuela’s evolving crypto ecosystem

In 2025, Venezuela’s cryptocurrency ecosystem was shaped by macroeconomic instability, sanctions pressure, and regulatory uncertainty — contributing to widespread reliance on stablecoins (particularly USDT) for everyday financial activity. Stablecoins are commonly used for retail payments, remittances, and informal financial transactions, reflecting the ongoing depreciation 2 of the bolívar and limited access to trusted banking infrastructure. Crypto use is growing fast in Venezuela, which ranked 11th of the top 20 countries by crypto adoption ranking in 2025, according to TRM's 2025 Crypto Adoption Report .

Following the 2023 restructuring of the National Superintendency of Cryptoassets and Related Activities (SUNACRIP), Venezuela’s crypto regulatory environment remains fragmented and opaque. Gaps in formal oversight — alongside persistent peer‑to‑peer (P2P) usage and nested service models operating within global platforms — introduce structural risks, including for sanctions exposure.

Large international exchanges offering P2P functionality continue to play an outsized role, enabling users to convert between bolívares and stablecoins without interacting directly with traditional financial institutions. Alongside these major platforms, a range of informal providers operate via messaging apps and wallet‑to‑wallet transactions. While these channels may support financial inclusion, their informality reduces transparency into counterparties and transactional flows, increasing ecosystem‑wide exposure to financial crime risk.

In parallel with informal activity, several domestic crypto-enabled payment platforms appear to operate with a degree of government tolerance — offering merchant payments, fiat off‑ramps, and stablecoin‑based services. Some of these entities likely operate under local authorization frameworks and are integrated into domestic payment systems, while others cross multiple jurisdictions — linking stablecoin accounts and regional payment rails, including local banks.

This dynamic reflects a hybrid financial environment shaped by economic necessity, regulatory ambiguity, and ongoing efforts to maintain access to dollar‑linked value.

Venezuela’s digital asset activity, while often driven by macroeconomic necessity, also operates within an increasingly complex web of cross-border financial infrastructure. In 2025, stablecoins such as USDT remained central to domestic financial activity and informal FX settlement, but were also observed in transactions that mirror alternative settlement mechanisms used in heavily sanctioned jurisdictions.

Intermediaries operating in and around Venezuela have likely engaged in digital asset activity involving stablecoins, in contexts consistent with oil-linked trade flows. These patterns appear to reflect structural adaptations to limited access to traditional dollar channels and banking infrastructure. In some cases, this activity routes through regional high-risk exchanges or regional and international exchanges operating across multiple jurisdictions.

TRM has also identified exposure involving intermediaries historically linked to high-risk financial networks associated with Iran, Russia, and China. In some cases, these exposures occurred alongside the use of alternative digital assets that may limit traceability or enforcement visibility. These observations highlight the systemic risks inherent in high-velocity stablecoin ecosystems, particularly those operating across fragmented or low-transparency regulatory environments.

{{28-2026-crypto-crime-report-footnote-2}}

Iran’s crypto economy was resilient under sanctions and conflict

Iran’s crypto economy largely sustained its engagement across 2024 and 2025, showing how deeply digital assets are now embedded in the country’s financial system. Despite persistent sanctions pressure, heightened enforcement scrutiny, geopolitical disruption, and cyber activity targeting financial infrastructure, Iran’s crypto flows adapted rather than collapsed.

TRM observed approximately USD 11.4 billion in total crypto activity in Iran in 2024 and roughly USD 10 billion in 2025, including both inbound and outbound flows. While activity declined modestly year over year, the scale and consistency of these volumes point to structural demand, not speculative participation. As attribution of offshore intermediaries and broker-mediated settlement continues to expand, observed totals for both years remain subject to upward revision.

The 12-day Iran-Israel conflict from June 13 to June 24, 2025 served as a stress test of Iran’s crypto ecosystem, and highlighted its resilience under acute geopolitical pressure. During the conflict window, Iran’s crypto volume increased by approximately 35%, while transaction counts declined by roughly 40%. At the same time, average transaction size rose by 122% when compared to the same time period in 2024.

This divergence points not to reduced crypto usage, but to a consolidation of activity into fewer, larger transfers — a pattern consistent with crisis-driven behavior such as capital flight, balance consolidation, and risk mitigation rather than routine retail trading. Even with network disruptions, heightened sanctions pressure, and active conflict, Iran’s crypto rails continued to function as a reliable channel for moving value when traditional financial pathways were most constrained.

This consolidation dynamic was visible at the exchange level. In the days preceding Israel’s strikes on June 13, outflows from Nobitex (Iran’s largest cryptocurrency exchange) surged by more than 150% week over week, indicating that users were proactively moving funds off domestic platforms in anticipation of escalation. Shortly after, the Israel-linked group Predatory Sparrow targeted Nobitex in a roughly USD 90 million hack, triggering widespread user distrust and temporary market dislocation. In the aftermath, incoming transaction volumes dropped by more than 70% year over year.

Iran’s domestic crypto ecosystem continued to function despite these shocks. Nobitex resumed service in stages beginning in late June, aided in part by reserves held in bitcoin, including funds consolidated from previously dormant mining-linked wallets. More broadly, activity rerouted through intermediary wallets and offshore services rather than disappearing.

In late December 2025, the regime met widespread anti-government protests with aggressive state controls, including near-total internet shutdowns and restrictions on digital services aimed at suppressing mobilization and information flow. This produced a different outcome for the crypto ecosystem than the war earlier in the year.

Between December 28, 2025 and January 16, 2026, Iran’s total crypto volume declined by roughly 60% year over year, while transaction counts fell by approximately 63% compared to the same period in 2024–2025. Though these dates are a defined window, protests and associated connectivity restrictions have continued beyond this period, suggesting that the observed suppression of activity reflects ongoing conditions — not a short-lived shock.

The data shows that retail and small-scale crypto participation was heavily constrained, likely due to internet outages, fear of surveillance, and restricted access to exchanges. While hundreds of millions of dollars still moved on-chain, activity narrowed to a smaller set of higher-capacity actors able to operate through disruptions. In short, external conflict accelerated capital movement, while domestic unrest limited who could participate at all.

In 2025, illicit Iranian crypto volume totaled just over USD 580 million, representing approximately 5.9% of observed activity. In 2024, illicit activity accounted for roughly 5.1% of total observed volume, or approximately USD 600 million. While absolute illicit volume declined slightly in line with overall activity, its of total flows remained stable — reinforcing the view that illicit and sanctions evasion usage is structurally embedded. As additional illicit activity is identified, these figures remain subject to upward revision.

Across both years, Iran’s illicit activity was overwhelmingly concentrated in stablecoins particularly USDT. This preference likely reflects USDT’s liquidity, low transaction costs, and compatibility with broker-mediated settlement networks. At the margins, actors continued to layer transactions using alternative assets and routing techniques — but these methods complemented, rather than replaced, USDT as the core settlement asset.

TRM analysis identified two cryptocurrency exchanges incorporated in the UK that processed hundreds of millions of dollars in stablecoin transactions while functioning as offshore financial infrastructure linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Although the entities — registered in the UK as Zedcex and Zedxion — publicly presented themselves as conventional crypto trading platforms, on‑chain and corporate records indicate that they operated as a single exchange enterprise embedded within a broader sanctions evasion ecosystem.

Between 2023 and 2025, a substantial of Zedcex’s activity involved wallets linked to IRGC‑controlled entities. In 2023, IRGC‑linked flows accounted for roughly USD 24 million, representing approximately 60% of observed activity. That rose sharply in 2024, when IRGC‑linked volume increased to around USD 620 million (or nearly 90% of total flows) before declining to approximately USD 410 million in 2025 as non‑IRGC‑linked activity increased. Across this period, Zedcex processed close to USD 1 billion in IRGC‑associated transactions, primarily in USDT on the TRON blockchain, a combination which offers low fees, deep liquidity, and broad broker acceptance.

Corporate records show that the two exchanges were incorporated in the UK using virtual office addresses, overlapping directors, and repeated dormant filings, despite the scale of activity observed on‑chain. The sequencing of their incorporation and leadership changes suggests continuity rather than separation of operations. Earlier corporate control was linked to Babak Morteza Zanjani, a financier previously sanctioned by the US and EU for facilitating Iran‑linked sanctions evasion. The Zedcex case reflects a broader pattern in which exchange‑branded crypto infrastructure operates offshore while maintaining functional ties to sanctioned economies.

On‑chain tracing connects Zedcex‑attributed wallets directly to addresses designated by Israeli authorities as IRGC property and blocklisted by stablecoin issuers. Funds were routed between IRGC‑controlled wallets, offshore intermediaries, and domestic Iranian exchanges — integrating sanctioned flows into Iran’s broader crypto economy. In at least one instance, TRM observed direct transfers exceeding USD 10 million from Zedcex‑linked infrastructure to a US‑designated terrorist financier associated with the IRGC, without intermediary routing.

Taken together, these findings illustrate a shift in sanctions risk: rather than episodic abuse of crypto rails, sanctioned actors are increasingly operating or embedding themselves within crypto financial infrastructure itself , raising fundamental questions platform control, beneficial ownership, and the limits of traditional compliance approaches.

{{premium-content_chapter-divider}}

Operational compromise drove USD 2.9 billion in losses

In 2025, illicit actors stole USD 2.87 billion across nearly 150 distinct hacks and exploits. 3 While incident volume remained broadly consistent with recent years, the severity of losses increased sharply due to a structural shift in attack vectors: adversaries moved up the stack, targeting operational infrastructure — keys, wallets, and control planes — over smart contract code.

The landscape was defined by the massive Bybit breach in February, which accounted for USD 1.46 billion (51%) of all funds stolen in 2025. This concentration of loss, in which the top 10 incidents represented 81% of the annual total, signals a maturing threat environment. Sophisticated actors, particularly those linked to North Korea (DPRK), are no longer just exploiting code — they are compromising the operational foundations of crypto asset services and the ecosystems around them.

{{28-2026-crypto-crime-report-footnote-3}}

The annual totals for hacks in 2025 were weighted heavily toward larger hacks — in some cases, catastrophic failures. While the average incident size rose to USD 19.5 million, the median incident size fell to USD 1.3 million. In 2025, just five events accounted for 70% of all stolen crypto value.

This widening gap illustrates a “long tail” risk environment: a handful of mega-heists drive global loss figures, while a high volume of smaller incidents continues to inflict persistent damage across the crypto ecosystem.

TRM’s dataset classifies hacks and exploits into five top-level categories: Infrastructure Attack , Code Exploit , Protocol Attack , Unknown , and Other . In 2025, the disparity between operational compromise and on-chain exploitation was clear — infrastructure attacks drove the clear majority of losses.

While Code Exploits were the most frequent category (52 incidents), they accounted for a comparatively smaller of total losses (USD 350 million, 12.1%) — USD 6.7 million per incident on average. Protocol Attacks were less frequent (25 incidents) but more severe on average (USD 277 million, 9.6%) — roughly USD 11.1 million per incident.

The February 2025 Bybit breach — which TRM assesses was carried out by North Korean operatives — was the defining event of the year. With USD 1.46 billion stolen in a single event, Bybit distorts annual totals. But it also clarifies the threat reality.

Even excluding Bybit, 2025 losses would have totaled USD 1.4 billion, underscoring a persistent baseline of criminal activity. More importantly, the breach validated a long-observed dynamic: for top-tier adversaries, the highest ROI increasingly lies in compromising operational infrastructure (keys, signers, wallet orchestration) at centralized entities instead of discovering novel logic errors in smart contracts .

TRM Labs attributes USD 1.92 billion to North Korea-linked actors (DPRK) in 2025. The 2025 data also reflects a continued evolution in how stolen assets are processed after theft. DPRK operators increasingly rely on “Chinese laundromat” networks — a term used by investigators to describe professionalized OTC brokers and underground intermediaries that facilitate off-ramping and settlement at scale.

These networks provide subcontracted laundering: high-volume OTC brokers absorb stolen assets and settle off-chain, distancing the theft operation from the cash-out point. They also facilitate chain hopping and fragmentation : rapid movement across chains and services to break traceability and route liquidity toward cashout channels. This professionalization complicates recovery, as the faster stolen assets can be routed through layered intermediaries, the narrower the window for interdiction.

The data from 2025 shows that the primary risk surface is operational. Smart contract audits are necessary, but they are no longer sufficient.

The shift toward infrastructure compromise emphasizes the criticality of hardware-backed key custody and strict signer isolation, withdrawal governance (including velocity controls and tiered approvals to limit the blast radius of compromised access), and operational security hardening for developer environments and privileged systems. Additionally, typology-driven monitoring that goes beyond entity screening to detect complex cross-chain routing consistent with industrialized laundering would enable a more proactive response.

{{premium-content_chapter-divider}}

The fraud landscape evolved through converging typologies

Actors sent approximately USD 35 billion in cryptocurrency to fraud schemes in 2025 alone, on par with the value received last year at USD 38 billion. This figure reflects a combination of funds traced to confirmed fraud-linked wallets and additional victim-reported scam addresses submitted through public reporting and incident response channels.

While TRM’s current dataset shows a decrease in fraud volumes, this should not be interpreted as a decline in real-world fraud activity. Fraud reporting is often delayed, with victim disclosures taking weeks or months to surface. Additionally, the vast majority of victims never report at all, due to factors such as embarrassment, fear of reputational harm, uncertainty where to report, skepticism that funds can be recovered, or lack of awareness that a crime has occurred. As a result, observed fraud totals almost always understate the true scale of activity, even as reported figures continue to rise over time.

In 2025, TRM observed USD 23 billion in verified fraud and an additional USD 12 billion tied to community complaints. As scammers become more sophisticated and adapt quickly, community complaints and shared reporting networks are increasingly critical for surfacing new scam wallets early, accelerating attribution, and disrupting fraud before losses scale further.

Crypto fraud is increasingly dominated by organized groups operating with business-like structure, specialization, and efficiency. Scam operators openly tools and techniques, reuse proven playbooks, and run recruitment pipelines that resemble legitimate hiring processes.

In addition to financial theft, many large scam operations are connected to scam compounds , which can employ human trafficking, coercion, and violence — with some maintaining relationships with local power structures. Governments have started more direct enforcement, including through sanctions targeting entities and individuals linked to scam operations.

As in years, investment-related schemes accounted for the majority of observed victim losses, representing 62% of 2025 fraud inflows . Within this category, TRM observed victim losses tied to pig butchering scams and pyramid / Ponzi schemes , which continued their streak among the most prominent subtypes.

A defining trend in the current state of crypto fraud is the convergence of distinct scam typologies . Victim journeys increasingly span multiple phases of deception, combining elements of romance scams, investment fraud, and advance fee schemes. Pig butchering exemplifies this overlap: a scam might begin with a romantic connection, shift into a false investment opportunity, and end with the scammer demanding additional funds under the guise of taxes or administrative fees. Although social engineering remains a key component of fraud campaigns, it is now reinforced by technical and organizational innovations that make fraud more scalable and harder to detect.

This layered approach reflects fraud networks’ broader shift toward more sophisticated campaigns. Networks operate more like enterprises, deploying specialized teams and standard playbooks to target and exploit victims at scale. Supporting this evolution is a growing ecosystem of illicit service providers. Some offer AI-as-a-service tools to automate outreach and engagement, while others sell phishing kits or provide access to breached data. These services lower the barrier to entry for fraud actors and enable them to replicate scams across geographies.

Scam operators have evolved their laundering tactics in response to enforcement pressure. In past years, large amounts of stablecoin funds often remained parked for extended periods, creating opportunities for freezing or investigative intervention. Since 2024, however, many fraud-linked networks have reduced holding times, often moving funds onward within 48 hours.

Scammers have also increased the complexity of how they move and manage funds on-chain. To complicate freezing and tracing, they often convert proceeds into less freeze-prone assets such as ETH or DAI, then briefly shift into stablecoins like USDT or USDC closer to cash-out points. This shift is reflected in TRM’s balance data: across 2024 and 2025, the average value held in scam-linked wallets declined sharply, suggesting faster turnover and shorter holding periods .

Fraud networks are increasingly leveraging generative AI to boost outreach, impersonation, and persuasion, with AI-enabled scam activity rising by roughly 500% over the past year.

Large language models (LLMs) enable scams to cross language and cultural contexts with less friction, while AI-generated images, voice cloning, and deepfake videos reduce the cost of creating convincing personas. These capabilities are expanding impersonation-style scams across messaging platforms, recruitment campaigns, and investment fraud — and they increase the likelihood that victims can be deceived even when aware of scam warnings.

As outlined in TRM Labs’ The Rise of AI-Enabled Crime Report and related publications , AI tactics such as voice cloning have powered impersonation scams across WhatsApp, fake job recruitment sites, and giveaway campaigns — many of which now use fabricated deepfake endorsements from celebrities like Elon Musk .

As discussed in TRM’s 2025 Crypto Crime Report , another common typology is non-investment related authorized push payment (APP) scams , where victims are manipulated into transferring funds to imposters posing as tax authorities, financial professionals, or lawyers.

AI-generated multimedia is increasingly used in investment fraud campaigns. Scam operators now routinely employ generative tools to create professional-looking branding assets for websites and social media, including logos, images, and in some cases videos featuring deepfake avatars. This reduces setup costs and makes it easier to rapidly rebrand, recycle infrastructure, and launch new scam iterations at scale.

On the inflow side, TRM’s verified fraud dataset showed that stablecoins are the primary vehicle for deposits into fraud schemes, and their grows meaningfully year over year. In 2024, stablecoins represented ~70% of fraud inflows, rising to ~84% in 2025. This reflects fraud actors’ continued preference for assets that offer high liquidity, broad exchange acceptance; easy denomination for victims; and frictionless movement across addresses and services.

In 2025, pyramid and Ponzi schemes received approximately USD 6.1 billion in victim funds, marking a 49% increase compared with 2024 and broadly in line with levels observed in 2023. This increase was driven in part by growth in the number of large schemes receiving over USD 100 million, which rose to 13 in 2025, compared with six in 2024 and 14 in 2023.

TRM Labs identified new iterations of previously observed decentralized investment fraud schemes that re-emerged in 2025, with operators collapsing and reconstituting them with largely identical infrastructure. These pyramid-like operations are structured around multiple smart contracts frequently as transparent and supposedly unchangeable. In practice, however, most participants lack the technical capacity to independently assess the underlying code and verify its legitimacy.

While major pyramid and Ponzi schemes operate on a global scale and appear to spread opportunistically across jurisdictions, TRM analysis indicates that several of the largest schemes in 2025 proliferated most strongly in developing markets and economically vulnerable communities . For example, CBEX, which received approximately over USD 250 million in victim funds, gained significant traction in Nigeria; while Treasure NFT, which received approximately USD 800 million, spread extensively in India and Pakistan.

Prince Group is one of the largest pig butchering scam operations ever uncovered. In October 2025, the US and UK imposed sanctions on a number of individuals and entities related to what they called the Prince Group Transnational Criminal Organization. An indictment was filed simultaneously by the US Department of Justice (DOJ), charging the founder and chairman of Prince Group, Chen Zhi, with money laundering conspiracy for directing Prince Group’s operation of forced labor scam compounds across Cambodia.

According to the indictment, Chen and Prince Group allegedly laundered fraud-derived funds through a variety of methods — including the use of professional money laundering organizations and by routing money through Prince Group’s legitimate business operations, including two mining companies: Warp Data and Lubian Mining. From there, funds seem to have been sometimes sent to Chen himself.

It is possible to trace a clear connection between bitcoin mining activity, Lubian Mining specifically, and a substantial portion of the 127,271 bitcoin seized by the US on the blockchain. Based on the allegations, victim funds were likely laundered and converted into fiat, then used to purchase mining equipment and support related operational expenses. Because much of this process occurs off-chain, it can be difficult to fully trace these connections using blockchain data alone.

Financial connections may shift off-chain through operational expenses, infrastructure purchases, and energy costs — making the traceability picture more complex. This enables a layered laundering model where an organization can continuously recycle proceeds through hybrid on and off-chain steps, reducing exposure signals while preserving liquidity and control.

Sanctioned Cambodian conglomerate HuiOne Group is a key financial enabler for Prince Group-linked illicit activity, including scam compounds operating in Southeast Asia. TRM identified a Prince Group-linked escrow service that sent almost 80% of its funds to HuiOne Pay-linked wallets, demonstrating direct fund flows from a Prince-associated node into HuiOne’s payments infrastructure.

This level of dependency matters because facilitator nodes provide repeatable pathways, high-throughput routing, and access to services that make large flows operationally manageable. When a scam enterprise relies on a single facilitator at this scale, that entity becomes a structural dependency that can accelerate fund movement, shrink the interdiction window, and expand downstream risk for institutions that may interact with connected activity.

HuiOne Pay functions as a high-leverage facilitation layer that can move and concentrate funds at scale. That scale is visible in its activity over time: incoming volume grew from tens of millions per month in early periods (for example, roughly USD 44 million in December 2020) into sustained multi-billion-dollar monthly inflows by 2024 and 2025, peaking at approximately USD 4.7 billion in July 2025. That kind of consistent, high-volume throughput is what makes this kind of facilitator infrastructure so valuable.

HuiOne Pay suspended operations and halted withdrawals following an apparent bank run as of December 2, 2025. Activity levels seem to reflect that disruption: after moving multiple billions per month throughout much of 2025, incoming volume fell sharply to around USD 803 million in November 2025, and approximately USD...