Crypto Wallets Hit Record $158 Billion in Illicit Funds in 2025 — A Stark Reversal After Years of Decline

In a shocking turn of events, cryptocurrency wallets received a staggering $158 billion in illicit funds in 2025, marking a dramatic reversal of a three-year downward trend. According to blockchain intelligence firm TRM Labs, this represents a 145% increase from the $64 billion recorded in 2024 and the $86 billion in 2021. The surge comes despite the illicit activity’s share of total on-chain volume slightly decreasing from 1.3% to 1.2%.

What’s Driving the Surge in Crypto Crime?

TRM Labs attributes this unprecedented spike to several key factors:

• Sanctions-Linked Activity: Russia-associated networks like A7 and the A7A5 stablecoin have been at the forefront, driven by new sanctions designations and improved attribution of already-sanctioned actors.

• Nation-State Involvement: Countries like Russia, Iran, and Venezuela are increasingly using cryptocurrency as core financial infrastructure, alongside large-scale settlement activity through China-linked escrow and underground banking networks.

• Improved Attribution and Intelligence Sharing: Tools developed by TRM Labs have surfaced previously unattributed illicit flows, accelerating the identification of sanctions-related activity, major hacks, and blocklisted entities.

Hacks, Scams, and Ransomware: The Triple Threat

The year 2025 saw a record $2.87 billion lost to 150 hacking incidents, with the top 10 accounting for 81% of all stolen value. The most notorious was the February 2025 Bybit breach, attributed to North Korean hackers, which resulted in approximately $1.46 billion in losses.

Scam activity remained rampant, with $35 billion sent to fraud schemes throughout the year. Investment scams dominated, accounting for 62% of total inflows, including romance baiting, Ponzi schemes, and fake task scams. TRM Labs noted a rise in the organization, professionalism, and outreach of these scams, likely fueled by the use of AI tools.

Ransomware-linked cryptocurrency inflows remained elevated, though not at previous record levels. Interestingly, 2025 was a record year for victims listed on extortion portals, but more victims are now resisting paying ransoms to cybercriminals.

The Evolving Landscape of Crypto Crime

TRM Labs observed unprecedented ecosystem fragmentation, with 161 active ransomware strains and 93 new variants added in 2025 alone. Ransom laundering operations evolved, with mixer usage falling by 37%, while bridge usage and cross-chain routing increased by 66%.

As the cryptocurrency landscape continues to evolve, so too do the tactics of bad actors. The rise in illicit activity underscores the need for robust security measures and international cooperation to combat these threats.

Tags: #Cryptocurrency #Blockchain #CryptoCrime #Hacking #Scams #Ransomware #Sanctions #NationState #AI #Security #TRMLabs #Bybit #NorthKorea #Russia #Iran #Venezuela #China #UndergroundBanking #Mixers #Bridges #CrossChainRouting

Viral Phrases:

• “Crypto wallets hit record $158 billion in illicit funds!”
• “145% spike in crypto crime reverses years of decline!”
• “Russia, Iran, and Venezuela using crypto as financial infrastructure!”
• “North Korean hackers behind $1.46 billion Bybit breach!”
• “AI tools fueling organized crypto scams!”
• “Ransomware victims increasingly refuse to pay!”
• “Mixers down, bridges up: the new face of crypto laundering!”
• “161 active ransomware strains in 2025 — the ecosystem is fragmenting!”
• “Sanctions-linked crypto activity surges as attribution improves!”
• “China-linked underground banking networks fueling illicit flows!”

,