Gone are the days of hooded hackers hoarding Bitcoin in dark web wallets.
In 2025, the center of gravity of the illicit crypto economy has shifted decisively away from the volatility of the original crypto and toward a dense shadow system pegged to the dollar.
According to new Chaina Analysis data shared with crypto slatestablecoins accounted for 84% of last year's $154 billion in illegal trading volume, indicating a clear shift of risk to programmable dollars.
This structural shift has allowed Chinese money laundering networks to expand their “laundering-as-a-service” operations while nation-states such as North Korea, Russia, and Iran connect to the same rails to circumvent Western regulations.
Why did criminals abandon Bitcoin?
The most notable trend in the 2025 data is the replacement of Bitcoin as the primary currency for crime. For more than a decade, Bitcoin has been synonymous with illegal online activity, but since 2020 its dominance has steadily declined.
As shown in the illegal activity graph from 2020 to 2025 below, Bitcoin's share of dirty flows has plummeted over the years, while stablecoins have soared to account for a large portion of the market.
This transition is no accident. This reflects trends in the broader legitimate crypto-economy, where stablecoins are becoming increasingly dominant due to practical advantages such as easy transferability across borders, lower volatility than assets such as Bitcoin and Ethereum, and wide utility in decentralized finance (DeFi) applications.
However, these same features have made stablecoins the preferred vehicle for sophisticated criminal organizations.
The transition away from Bitcoin therefore represents the modernization of financial crime.
By leveraging assets pegged to the U.S. dollar, criminals effectively leverage a shadow version of the traditional banking system that moves at the speed of the internet and operates beyond the direct reach of U.S. regulators.
This “dollarization” of crime allows cartels and state actors to settle payments in stable units of account without exposing them to the wild price fluctuations that characterize other crypto markets.
geopolitical key points
If 2009-2019 was the “early days” of niche fraudulent cybercrime, and 2020-2024 was the era of “professionalization,” 2025 marks the arrival of the “third wave,” or large-scale state operations.
In this new phase, geopolitics is moving on-chain. Governments are now leveraging specialized service providers originally built for cybercriminals, while also launching their own bespoke infrastructure to avoid large-scale sanctions.
Russia, in particular, has demonstrated that state-sponsored digital assets can be effective in circumventing sanctions. Following a law introduced in 2024 to encourage such activities, the country launched the ruble-backed A7A5 token in February 2025.
In less than a year, the token has traded more than $93.3 billion, allowing Russian companies to bypass the global banking system and move value across borders without relying on SWIFT or Western correspondent banks.
Similarly, Iranian proxy networks continue to utilize blockchain for illicit financing.
Confirmed wallets identified in the sanctions designation indicate that Iran-aligned networks facilitated money laundering, illegal oil sales, and procurement of arms and supplies totaling more than $2 billion.
Despite various military setbacks, Iran-aligned terrorist organizations, including Lebanon's Hezbollah, Hamas, and the Houthis, are making use of cryptocurrencies on a scale never before observed.
North Korea also recorded its most destructive year ever. North Korea-linked hackers stole $2 billion in 2025, a figure the result of a devastating massive hack.
The most notable of these was February's Bybit exploit, which resulted in nearly $1.5 billion in losses, making it the largest digital heist in crypto history.
Industrialization of money laundering
This surge in transaction volumes is fueled by the rise of the Chinese Money Laundering Network (CMLN) as a dominant force in the illicit on-chain ecosystem. These networks have dramatically expanded the diversification and specialization of cryptocrime.
These networks created full-service criminal enterprises, building on the framework established by activities such as the Fuione Guarantee.
They offer specialized “laundering-as-a-service” capabilities and support a diverse customer base ranging from fraudsters and fraud operators to North Korean state-sponsored hackers and terrorist financiers.
A key trend identified in 2025 is that both illegal actors and nation-states will increasingly rely on infrastructure providers offering a “full stack” of services.
These providers themselves appear on-chain and have evolved from niche hosting resellers to integrated infrastructure platforms. They offer domain registration, bulletproof hosting, and other technical services specifically designed to withstand takedowns, abuse complaints, and sanctions enforcement.
These providers extend the reach of malicious cyber activity by providing a resilient technical backbone. This allows financially motivated criminals and state-aligned actors to maintain their operations even as law enforcement attempts to dismantle the networks.
Combining digital and physical threats
While crypto crime stories often focus on digital theft and laundering, 2025 provided clear evidence that on-chain activity is increasingly intersecting with violent crime in the physical world.
In human trafficking operations, cryptocurrencies are increasingly being used for financial logistics to move proceeds across borders with relative anonymity.
Even more worrying is the reported increase in physical coercive attacks. Criminals are increasingly using violence to force victims to transfer assets, often timing these attacks to coincide with peak cryptocurrency prices to maximize the value of their thefts.
Illegal activity remains less than 1% of the crypto economy
Despite these worrying trends, the broader context remains important. The volume of illicit transactions tracked in 2025 will remain less than 1% of the legitimate crypto economy.
But that 1% qualitative change is what regulators and intelligence agencies are concerned about. Integrating nation-states into illicit supply chains via stablecoins increases national security risks.
As government agencies, compliance teams, and security professionals work toward 2026, the challenge will be to disrupt the specialized, state-sponsored shadow economy that has successfully weaponized the efficiencies of modern finance.
Cooperation between law enforcement, regulators, and crypto businesses is critical now that ecosystem integrity directly intersects with the world's geopolitical stability.
