Illicit crypto proceeds jump to $158 billion in 2025 as bad actors professionalize, TRM report shows

TRM Labs’ 2025 review records a substantial jump in the dollar value routed to criminal actors after several years of decline, estimating roughly $158 billion moved in the year. Framed against a much larger market, that sum represents near‑one percent of total activity, shifting the policy conversation from prevalence to concentrated, high‑impact abuse. The report identifies two technical and operational accelerants: state‑linked and sanctioned groups are leaning on tailored stablecoins and dense, purpose-built wallet clusters to ferry value across economic barriers, while attackers increasingly target service and operational layers — custody, bridges and other plumbing — to reap larger single‑event gains. Sanctions‑related flows skew heavily to Russia, where a ruble‑pegged stablecoin and an associated wallet cluster account for a large share of identified transfers; the A7 cluster is singled out as a major conduit. Hacking and exploit incidents were fewer by count but far costlier, with infrastructure compromises contributing most of the dollars lost. Concurrently, TRM documents the professionalization of laundering: a maturing ecosystem of brokers, mule networks, over‑the‑counter venues and language‑specific service communities (notably Chinese‑language networks) are stitching on‑ramps, bank rails and peer‑to‑peer marketplaces together so funds can move rapidly even when individual channels are disrupted. These intermediaries use reputation systems and escrow-like mechanisms inside encrypted chat platforms to preserve liquidity and speed, enabling fast chain‑hopping, transaction fragmentation and third‑party staging that compress interdiction windows. The combination of larger stablecoin volumes, more concentrated high‑value thefts, and resilient service providers reduces the effectiveness of classic trace‑and‑freeze tactics and requires detection at scale plus cross‑platform, cross‑jurisdiction cooperation. For exchanges, custodians and stablecoin issuers the implications are operational: beefed up sanctions screening, quicker takedowns and deeper service‑level controls. For policymakers the report points toward layered responses — from targeted sanctions and disruption of intermediary service archetypes to regulatory rules that raise friction and traceability on high‑risk rails. International information sharing and collaboration with messaging platforms and informal trading venues will be critical, because the most damaging flows exploit multilingual networks and cross‑border intermediaries. In short, while the proportion of crypto tied to crime has fallen, misuse is becoming more institutionalized, faster and harder to interdict, calling for coordinated technical, regulatory and investigative remedies.