Topic starter
12/07/2026 12:17 pm
TL;DR: At least 154 billion dollars flowed to illicit crypto addresses in 2025, a 162 percent increase driven largely by a 694 percent jump in sanctions-linked receipts, according to Chainalysis. Stablecoins accounted for 84 percent of illicit volume and North Korean theft reached 2 billion dollars, while the market signal is clear: compliance teams now have to treat on-chain crime as infrastructure, not just transaction monitoring.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “2025年、国家主導の制裁回避がオンチェーンで大規模に進行し、暗号資産犯罪が過去最高を記録”.
By the numbers:
- That was a 162% year-over-year increase, according to Chainalysis.
- Receipts tied to sanctioned entities rose by 694%, according to Chainalysis.
- Stablecoins accounted for 84% of illicit transaction volume, according to Chainalysis.
Key questions
Q: What breaks when crypto crime is treated as isolated transactions instead of infrastructure?
A: Teams miss the reusable rails that make laundering, sanctions evasion, and state-linked activity scalable.
Q: Why do stablecoins attract so much illicit on-chain activity?
A: Stablecoins combine speed, cross-border reach, and low volatility, which makes them efficient for settlement and layering.
Q: Where do sanctions controls fail in professionalised crypto networks?
A: They fail when teams focus only on direct address screening and ignore the hosted services, laundering brokers, and delegated infrastructure that connect sanctioned activity to broader flows.
Practitioner guidance
- Map wallet exposure to infrastructure providers Build inventories that link wallets to hosted services, laundering intermediaries, and other infrastructure dependencies so you can see reuse across cases.
- Prioritise sanctions-linked counterparties for review Escalate counterparties associated with sanctioned entities, especially where receipts, routing, or settlement behaviour suggests repeated use rather than one-off contact.
- Segment stablecoin monitoring by use case Separate legitimate treasury, customer flow, and high-risk transfer patterns so low-volatility assets do not mask abnormal velocity or layering behaviour.
Bottom line: Crypto crime now depends on reusable infrastructure that supports laundering, sanctions evasion, and state-linked activity at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
Crypto crime has become an infrastructure problem, not merely a monitoring problem. The article describes professionalised networks that provide laundering, hosting, and sanctions-evasion services to multiple illicit actors. That is a governance shift because the risk now sits in reusable rails, not just in bad endpoints. For practitioners, the implication is that detection must extend to service-provider relationships and dependency chains, not only suspicious transactions.
A question worth separating out:
Q: How should compliance teams respond when sanctioned crypto exposure is detected?
A: Compliance teams should treat sanctioned crypto exposure as an operational containment problem, not only a screening alert. First, confirm whether the address is directly linked, adjacent, or merely transacting with a risky cluster. Then escalate through legal, treasury, exchange partners, and case management so movement can be frozen or blocked before additional hops obscure provenance.
👉 Read our full editorial: Crypto crime is professionalising into national security infrastructure