Shift in the Illicit Crypto Economy
The era of secretive hackers stashing away Bitcoin in hidden wallets seems to be fading. By 2025, the focus of the underground crypto economy has markedly shifted away from the unpredictable nature of cryptocurrencies like Bitcoin, gravitating toward a more stable framework based on the dollar.
Data from Chaina Analysis reveals that stablecoins made up 84% of the $154 billion in illegal trading volume last year. This marks a significant move toward managing risk with these more stable digital currencies.
This notable transformation has enabled Chinese money laundering networks to broaden their operations labeled as “laundering-as-a-service.” Additionally, countries such as North Korea, Russia, and Iran are now using similar systems to navigate around Western regulations.
Reasons for Bitcoin’s Decline
One of the most striking developments in the data from 2025 is the diminishing role of Bitcoin in illegal transactions. For over a decade, Bitcoin has been recognized as the go-to currency for criminal activities, yet its prominence has steadily declined since 2020.
Looking at the trends from 2020 to 2025, it’s evident that while Bitcoin’s share of illicit transactions has drastically decreased, stablecoins have surged to dominate the market.
This shift isn’t just accidental; it aligns with larger trends in the legitimate crypto world. Stablecoins are gaining traction due to their ease of transfer across borders, less volatility than Bitcoin or Ethereum, and their utility in decentralized finance (DeFi) platforms.
However, these same attributes have made stablecoins the currency of choice for advanced criminal organizations. The move away from Bitcoin highlights the evolving nature of financial crime.
By utilizing assets tied to the U.S. dollar, criminals operate a shadow version of the mainstream banking system, facilitating transactions at internet speed while remaining beyond the direct scope of U.S. regulations. This “dollarization” allows criminals and state-sponsored entities to transact without worrying about extreme price fluctuations typical of other cryptocurrencies.
Geopolitical Context
If the years from 2009 to 2019 represented the initial phase of niche cybercrime, and 2020 to 2024 marked its professionalization, then 2025 signifies the onset of the third wave—large-scale operations at the state level.
Governments are now employing specialized services initially developed for cybercriminals, alongside launching their infrastructure to dodge significant sanctions. Notably, Russia has showcased how state-sponsored digital currencies can effectively breach sanctions. After a law was passed in 2024 to promote such efforts, Russia introduced the ruble-backed A7A5 token in February 2025.
In less than a year, this token has seen transactions surpassing $93.3 billion, allowing Russian firms to circumvent the global banking channels and transact without relying on SWIFT or Western banks.
Iranian networks similarly continue to use blockchain for illicit purposes, with reports indicating these groups have engaged in money laundering and illegal oil sales totaling more than $2 billion.
Furthermore, Iranian-affiliated terrorist organizations like Hezbollah and Hamas are increasingly utilizing cryptocurrencies, in ways not previously seen. North Korea also experienced its most lucrative year, with hackers stealing around $2 billion in 2025, including notable exploits such as the February Bybit hack, which resulted in almost $1.5 billion in losses—the largest theft in crypto history.
Industrialization of Money Laundering
The increase in transaction volumes is largely driven by the rise of the Chinese Money Laundering Network (CMLN), which has become a major player in the illicit on-chain ecosystem. This network has expanded the diversity and specialization within the cryptocrime landscape, establishing comprehensive criminal enterprises that provide “laundering-as-a-service” to various clients, from fraudsters to state-sponsored hackers.
As we look ahead in 2025, it’s clear that both illicit actors and states will increasingly rely on full-service infrastructure providers. These platforms have evolved from niche services to integrated systems offering domain hosting and other services resilient against law enforcement actions.
Connecting Digital and Physical Threats
While much of the discussion around crypto crime focuses on digital theft, 2025 showcased a troubling trend: on-chain activities are intersecting more with physical violence. Cryptocurrencies are now being utilized in human trafficking operations for financial logistics. Alarmingly, there’s also been an uptick in violent coercion, where criminals use threats and violence to force victims into transferring assets, often timed with spikes in cryptocurrency values.
Illegal Activities Still a Small Fraction of Crypto
Despite these concerning developments, it’s crucial to view the broader picture. The total volume of illicit transactions in 2025 will still be less than 1% of the overall crypto market. However, that shift within that 1% raises alarms for regulators and intelligence agencies. The integration of nation-states into the illicit supply chains enabled by stablecoins heightens national security vulnerabilities.
Moving towards 2026, agencies and professionals will need to focus on disrupting this specialized shadow economy that has adeptly utilized modern financial efficiencies. Collaboration among law enforcement, regulators, and the cryptocurrency industry is essential, especially as the integrity of the ecosystem directly impacts global geopolitical stability.
