TL;DR: At least 154 billion dollars flowed to illicit crypto addresses in 2025, a 162 percent increase driven largely by a 694 percent jump in sanctions-linked receipts, according to Chainalysis. Stablecoins accounted for 84 percent of illicit volume and North Korean theft reached 2 billion dollars, while the market signal is clear: compliance teams now have to treat on-chain crime as infrastructure, not just transaction monitoring.
At a glance
What this is: Chainalysis says illicit crypto activity in 2025 expanded into a professionalised infrastructure layer, with sanctions evasion, state-linked theft, and laundering services operating at scale.
Why it matters: This matters because identity, sanctions, fraud, and financial-crime teams now have to govern on-chain access, counterparties, and laundering pathways as connected risk rather than isolated transactions.
By the numbers:
- That was a 162% year-over-year increase, according to Chainalysis.
- Receipts tied to sanctioned entities rose by 694%, according to Chainalysis.
- Stablecoins accounted for 84% of illicit transaction volume, according to Chainalysis.
Context
Crypto crime is no longer just a series of opportunistic wallet-to-wallet transfers. It now includes organised services for laundering, sanctions evasion, and infrastructure provisioning, which makes the control problem closer to enterprise governance than to simple transaction review. The primary security issue is not only who sent value, but who built the rails that let illicit value move and persist.
For compliance, fraud, and security teams, the identity angle is the trust boundary around wallets, counterparties, and service providers. When states, criminal groups, and laundering networks all use the same on-chain infrastructure, due diligence has to consider delegated access, source-of-funds exposure, and ongoing counterparties, not just isolated alerts. This is a structural shift, not a temporary spike.
Key questions
Q: What breaks when crypto crime is treated as isolated transactions instead of infrastructure?
A: Teams miss the reusable rails that make laundering, sanctions evasion, and state-linked activity scalable. The result is fragmented monitoring, inconsistent escalation, and delayed attribution. A transaction-centric model can still catch obvious anomalies, but it will not show how the same infrastructure supports many different illicit actors over time.
Q: Why do stablecoins attract so much illicit on-chain activity?
A: Stablecoins combine speed, cross-border reach, and low volatility, which makes them efficient for settlement and layering. Those same operational benefits also make them attractive to criminals and sanctions evaders. The risk is not the token alone, but the way it supports rapid movement through reusable infrastructure and counterparties.
Q: Where do sanctions controls fail in professionalised crypto networks?
A: They fail when teams focus only on direct address screening and ignore the hosted services, laundering brokers, and delegated infrastructure that connect sanctioned activity to broader flows. In practice, sanctions exposure often sits in relationships and dependencies, not just in the final receiving wallet.
Q: How should compliance teams respond when sanctioned crypto exposure is detected?
A: Compliance teams should treat sanctioned crypto exposure as an operational containment problem, not only a screening alert. First, confirm whether the address is directly linked, adjacent, or merely transacting with a risky cluster. Then escalate through legal, treasury, exchange partners, and case management so movement can be frozen or blocked before additional hops obscure provenance.
Technical breakdown
How state-linked actors borrow criminal services
The article shows a convergence between state activity and professionalised criminal services. Instead of building every capability from scratch, states can use existing laundering infrastructure, payment rails, and hosting services to move value while obscuring origin and intent. That increases scale and reduces attribution friction. In practice, the same infrastructure can support ransomware proceeds, sanctions evasion, and geopolitical activity, which collapses traditional distinctions between cybercrime, financial crime, and national-security risk.
Practical implication: Fold state-linked indicators into sanctions, fraud, and cyber-financial monitoring so the same infrastructure is not reviewed in silos.
NHI Mgmt Group analysis
Crypto crime has become an infrastructure problem, not merely a monitoring problem. The article describes professionalised networks that provide laundering, hosting, and sanctions-evasion services to multiple illicit actors. That is a governance shift because the risk now sits in reusable rails, not just in bad endpoints. For practitioners, the implication is that detection must extend to service-provider relationships and dependency chains, not only suspicious transactions.
Sanctions evasion and cybercrime are converging into the same on-chain supply chain. State-linked use of criminal services means compliance teams can no longer assume a clean line between financial crime, cyber intrusion, and geopolitical activity. A wallet can be both an operational channel and a sanctions exposure point. The practical conclusion is that ownership, counterparty due diligence, and transaction monitoring need to be integrated.
Stablecoins are now a primary control concern because they provide the operational utility illicit actors need. Their low volatility and cross-border portability make them efficient for layering and rapid movement. That does not create the risk by itself, but it accelerates it once criminal infrastructure exists. Teams should treat stablecoin activity as a priority signal for velocity, routing, and beneficial-counterparty review.
On-chain criminal services illustrate a sanctions-trust gap. The same infrastructure can serve organised crime, state actors, and laundering intermediaries without a clear boundary visible to ordinary transaction monitoring. This is the core failure mode the article exposes: control frameworks still too often assume that illicit use is an isolated event rather than a persistent service layer. Practitioners need risk models that track infrastructure reuse across cases.
Identity governance matters here because the real question is who can act through which wallet, service, or delegated relationship. In an on-chain environment, access, delegation, and provenance are the identity controls that decide whether value movement is attributable or opaque. Where those controls are weak, states and criminals can share the same rails without immediate detection. Practitioners should connect sanctions, fraud, and identity governance around common actor and counterparty models.
What this signals
Crypto crime infrastructure now behaves like an illicit supply chain. That means teams should stop thinking in terms of single suspicious transfers and start modelling the service layers that make laundering durable. When the same infrastructure can serve organised crime, sanctions evasion, and state activity, governance has to follow the actor network, not the transaction alone.
Sanctions exposure is increasingly a relationship problem. The practical question is no longer whether a wallet touched a sanctioned entity once, but whether the surrounding infrastructure is built to support repeated contact with sanctioned flows. That requires tighter linkage between sanctions screening, wallet intelligence, and third-party risk analysis.
For practitioners
- Map wallet exposure to infrastructure providers Build inventories that link wallets to hosted services, laundering intermediaries, and other infrastructure dependencies so you can see reuse across cases.
- Prioritise sanctions-linked counterparties for review Escalate counterparties associated with sanctioned entities, especially where receipts, routing, or settlement behaviour suggests repeated use rather than one-off contact.
- Segment stablecoin monitoring by use case Separate legitimate treasury, customer flow, and high-risk transfer patterns so low-volatility assets do not mask abnormal velocity or layering behaviour.
- Unify fraud, sanctions, and cyber-financial alerts Correlate wallet intelligence, host infrastructure, and known laundering patterns so the same network is not handled differently by different teams.
Key takeaways
- Crypto crime now depends on reusable infrastructure that supports laundering, sanctions evasion, and state-linked activity at scale.
- The article shows a sharp rise in illicit receipts in 2025, with sanctions-linked activity and stablecoin use standing out as the main drivers.
- Practitioners should shift from transaction-only review to network-level governance that tracks counterparties, infrastructure reuse, and delegated access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article is about enterprise governance of escalating financial-crime and sanctions risk. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Wallet access, delegated control, and transaction authority are central to illicit movement. | |
| Recommendation — Integrate on-chain crime exposure into enterprise risk management and board reporting. Review permissions and delegated authorities that allow high-risk wallet movement. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes theft, movement, and laundering patterns that map to attacker access and data/value removal stages. |
| Recommendation — Map observed laundering and theft patterns to TA0006 and TA0010 for hunting and detection. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Over-broad wallet and platform permissions increase the blast radius of illicit or compromised access. |
| Recommendation — Apply least privilege to wallet administration and settlement workflows. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article's risk depends on who can open, reuse, and delegate accounts across on-chain services. |
| Recommendation — Tighten account lifecycle management for wallets, exchanges, and hosted crypto services. | ||
Key terms
- On-Chain Infrastructure: The collection of services, wallets, tokens, and routing patterns that make blockchain activity repeatable and scalable. In illicit contexts, this includes laundering services, proxy entities, and hosting providers that help actors move value, obscure origin, and maintain operational continuity.
- Sanctions evasion: Sanctions evasion is the deliberate movement of value or goods to avoid legal restrictions imposed on designated people, entities, or jurisdictions. In crypto markets, it often relies on speed, cross-border settlement, and intermediary services that make destination tracing harder without strong monitoring.
- Laundering-as-a-Service: A criminal service model where specialised actors offer value obfuscation, routing, and exchange support to other offenders. The pattern mirrors legitimate managed services, but its purpose is to preserve illicit proceeds and complicate attribution, seizure, and cross-jurisdiction enforcement.
- Stablecoin Flow Risk: The governance risk created when a low-volatility digital asset is used to move value quickly across borders or through layered counterparties. The concern is not the asset itself, but the operational advantage it gives to high-risk actors.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. If your programme has to govern access, delegation, and lifecycle risk, the course gives a structured baseline for the controls that matter.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org