Uncovering the Dark Side of Crypto: $158 Billion in Illicit Funds Funneled Through Wallets in 2021

An unprecedented surge in illegal cryptocurrency flows totaling $158 billion was recorded in 2025, marking a stark reversal of the declining trend observed over the previous three years. This sharp 145% increase has been reported by blockchain intelligence experts at TRM Labs, despite the illicit activity share of the total on-chain volume slightly dropping from 1.3% in 2024 to 1.2% in 2025.

TRM Labs attributes the spike in volumes to various factors:

• An increase in sanctions-linked crypto activity, primarily driven by Russian networks such as A7 and the A7A5 stablecoin following new sanctions designations and enhanced attribution of already-sanctioned entities.
• Expanded utilization of cryptocurrency by nation-states and state-aligned actors, with countries like Russia, Iran, and Venezuela integrating crypto into their financial infrastructure.
• Enhanced attribution and quicker intelligence sharing, including tools developed by TRM Labs, which have facilitated the identification of previously unattributed illicit flows and accelerated the recognition of sanctions-related activities and major hacks.

Hacks, scams, and ransomware

TRM Labs documented total losses of $2.87 billion from 150 hacking incidents in 2025, with the top 10 incidents comprising 81% of the stolen value. The most significant breach was the February 2025 Bybit incident, attributed to North Korean hackers, resulting in approximately $1.46 billion in losses.

Scam activity remained prevalent in 2025, with around $35 billion in cryptocurrency directed towards fraudulent schemes throughout the year. Investment scams dominated the sector, constituting 62% of total inflows and encompassing schemes like romance baiting, Ponzi schemes, and fake task scams.

TRM Labs noted an increase in the sophistication and scale of these scams, believed to be fueled by the utilization of AI tools.

Furthermore, cryptocurrency inflows related to ransomware remained elevated in 2025, although they did not reach the levels observed in previous years. While the year saw a record number of victims listed on extortion portals, more individuals are now resisting paying ransom demands to cybercriminals.

TRM Labs also observed a significant increase in ecosystem fragmentation, with 161 active strains and 93 variants added in 2025 alone. Ransom laundering operations evolved, with a decrease in mixer usage by 37% and a rise in bridge usage and cross-chain routing by 66%.

As budget season approaches, over 300 CISOs and security leaders have shared insights on their planning, spending, and priorities for the year ahead. This comprehensive report compiles their strategies, allowing readers to benchmark, identify emerging trends, and compare priorities for 2026.

Discover how top leaders are translating investments into tangible impact.

Download Now