Crypto Crime Surges 700% as States Evade Sanctions (Chainalysis)

State-Sanctioned Crypto Volume Hit $104 Billion in 2025

The blockchain intelligence firm Chainalysis documented a 694% year-over-year surge in cryptocurrency volume linked to state-sponsored sanctions evasion in 2025. This activity reached $104 billion for sanctioned entities, driving total illicit on-chain activity to a record $154 billion for the year. Russia, Iran, and North Korea led this growth by embedding cryptocurrency into national financial strategies for trade settlements, dual-use goods procurement, and proxy funding operations.

The scale of state-driven crypto activity represents a fundamental shift in how certain nations approach international finance. Rather than treating cryptocurrency as a peripheral tool, these countries have integrated digital assets into core infrastructure for geopolitical objectives. Chainalysis analysts describe this transformation as states “industrializing evasion tactics,” moving beyond individual bad actors to systematic, state-level operations.

Despite the record volumes, illicit activity remains under 1% of total cryptocurrency transaction volume. This figure underscores both the scale of legitimate crypto use and the relatively concentrated nature of sanctioned entity activity within the broader ecosystem.

Russia’s A7A5 Stablecoin Processed $93 Billion for Sanctioned Entities

Russia’s A7A5 ruble-pegged stablecoin processed over $93 billion in less than one year, becoming the primary vehicle for sanctioned Russian firms to access global markets. The stablecoin operates through no-KYC swap services that handled approximately $2.2 billion in transactions, enabling entities cut off from traditional banking to continue international commerce.

The A7A5 stablecoin represents a sophisticated attempt to create financial infrastructure immune to Western sanctions. By pegging the token to the ruble and operating through decentralized exchange mechanisms, the system attempts to bypass conventional regulatory oversight. Regulators have responded by sanctioning A7A5 infrastructure and associated exchange platforms.

The enforcement response included actions against Grinex, a crypto exchange that processed $4.76 billion in transactions. The U.S. Office of Foreign Assets Control (OFAC), the European Union, and the UK’s Office of Financial Sanctions Implementation (OFSI) coordinated efforts targeting service layers to disrupt liquidity flows. These actions focus on the exchange infrastructure rather than the stablecoin itself, recognizing that addressing the underlying swap services may prove more effective in limiting functionality.

Iran and North Korea Processed Billions Through State-Linked Crypto Addresses

Iran’s IRGC-linked cryptocurrency addresses received over $3 billion, representing more than 50% of all Iranian crypto inflows by the fourth quarter of 2025. These funds supported proxy organizations including Hezbollah and Hamas, according to analysis linking state financial infrastructure to regional military activities. The concentration of inflows into IRGC-controlled addresses demonstrates how state actors can direct cryptocurrency traffic through controlled points.

North Korea’s cryptocurrency hacking operations yielded approximately $2 billion in stolen digital assets during 2025. The largest single exploit involved $1.5 billion stolen from Bybit, one of the year’s most significant crypto security breaches. Proceeds from these operations flow to North Korea’s weapons of mass destruction program, according to intelligence assessments.

TRM Labs confirmed the broader trend in its parallel analysis, noting that Russia-linked flows dominated sanctions-related activity throughout 2025. The combination of stablecoin issuance, exchange infrastructure, and direct hacking operations creates multiple pathways for state actors to monetize illicit activities while evading traditional financial surveillance.

Blockchain Transparency Paradox Enables Tracking Despite Illicit Volume

The transparency inherent in blockchain technology creates an unusual dynamic in the fight against state-sponsored crypto crime. Every transaction leaves a permanent, publicly visible record that blockchain intelligence firms can analyze to trace fund flows. This transparency enables regulators and law enforcement to identify patterns and track assets even when actors attempt to obscure their activities through mixers,chain hopping, or decentralized protocols.

Kimberly Donovan, a senior fellow at the Atlantic Council specializing in financial sanctions, has emphasized that blockchain intelligence exposes what she describes as “jurisdictional arbitrage” in evasion networks. Her analysis identifies a coordinated “Axis of Evasion” involving Russia, Iran, China, and North Korea working to circumvent AML/CFT compliance frameworks. The transparency of public blockchains, while not preventing illicit activity, provides investigators with tools that did not exist in traditional finance.

Stablecoins account for 84% of illicit volume, reflecting their utility for large-value transfers and liquidity provision. This concentration presents both a challenge and an opportunity for enforcement. The same features that make stablecoins attractive for legitimate large-scale transactions, speed, stability, and interoperability, also facilitate rapid movement of sanctioned assets across jurisdictions.