Key Highlights
- Chainalysis reported that illegal crypto activities reached about $154 billion in 2025, the highest level on record.
- Stablecoins were used in most crypto heists, making up 84% of total illegal transactions, while Bitcoin dropped just 7%.
- North Korean-linked groups led major attacks, stealing around $2 billion.
Illegal crypto activity in 2025 reached a record $154 billion. According to a report from Chainalysis, the surge was likely driven by state-backed hackers and organized criminal groups.
One of the prominent actors was Lazarus Group, a group of hackers linked to North Korea. The group alone reportedly stole about $2 billion in a single year. The largest single theft was the Bybit exploit that happened in February, where nearly $1.5 billion was taken, marking it the largest crypto heist in history.
According to Chainalysis, the year 2025 was the start of the third wave of crypto crime, following the first wave of niche hackers from 2009 to 2019 and the second wave of professional criminal organizations from 2020 to 2024. The third wave is different because nation-states are now acting on a large scale to avoid international sanctions, which increased illegal activity by 162% compared to the previous year.
Stablecoins replaced Bitcoin in illegal deals
Stablecoins dominated illicit crypto activity in 2025, accounting for 84% of all illicit transaction volume, while Bitcoin fell to just 7%. Five years ago, Bitcoin made up roughly 70% of illegal crypto use, and stablecoins were only 15%.
Chainalysis reported that stablecoins are now preferred because they are easy to move across borders. Aside from that, they are less volatile and widely accepted. Popular stablecoins like USDT and USDC have a combined total market value of around $317.8 billion, while Russia’s ruble-backed A7A5 stablecoin handled over $93.3 billion in transactions despite a smaller market cap of $500 million.
According to the report, North Korean hackers primarily use stablecoins with high liquidity, USDT, USDC, and sometimes BUSD, because they can be moved easily and traded globally.
From online hacks to real-world violence
China and Iran have also upped their game in crypto crime. Chinese Money Laundering Networks (CMLNs) are now offering ‘laundering as a service’ to assist criminals in laundering stolen funds and evading sanctions.
In Iran, the Islamic Revolutionary Guard Corps and its proxy groups reportedly moved over $2 billion for money laundering, illegal sale of oil, and the purchase of arms in 2025. Terrorist groups like Hezbollah, Hamas, and the Houthis are also using crypto more than ever.
Chainalysis also highlighted a rise in physical violence linked to crypto theft, where the attackers use violence to get what they want from the victim in the form of wallets and devices. Over 215 cases have been recorded since 2020 alone, and in 2025, it was almost double the previous year.
Also Read: Truebit Exploit Drains $26M in ETH as Hacks Pile Up
