Crypto crime reached a record level in 2025. TRM Labs estimates that illicit wallets received $158 billion, up from $64.5 billion in 2024.
Scams, hacks, sanctions and money laundering each played a part. This article uses data from Chainalysis, TRM Labs and INTERPOL to show where the money came from and where it went.
These figures are estimates from blockchain analysis firms and law enforcement. Both firms say totals tend to rise later, as more wallets are linked to crime.
Each section below covers one part of the picture and includes a chart and a table of the key numbers.
Key Crypto Crime Statistics at a Glance
- $158 billion in illicit crypto inflows in 2025, up nearly 145% from 2024 (TRM Labs)
- $35 billion sent to fraud schemes in 2025 (TRM Labs), and an estimated $17 billion in scam losses (Chainalysis)
- $2.87 billion stolen in nearly 150 hacks, with the Bybit breach alone at $1.46 billion
- $93 billion in inflows to sanctioned entities and jurisdictions
- AI-linked scams earned 4.5 times more per operation than other scams
- Illicit actors took 2.7% of available crypto liquidity, down from 6.0% in 2023
Illicit Crypto Volume Reached a Record in 2025
Illicit cryptocurrency wallets received an estimated $158 billion in 2025. That is the highest level in five years, according to TRM Labs.
The jump followed three years of decline. Totals fell from $85.9 billion in 2021 to $64.5 billion in 2024.
TRM says a few large events drove most of the rise. New sanctions designations, big hacks and faster wallet attribution all added to the total.
| Year | Illicit inflows (USD billions) |
|---|---|
| 2021 | 85.9 |
| 2022 | 75.4 |
| 2023 | 73.3 |
| 2024 | 64.5 |
| 2025 | 158.0 |
TRM treats its figure as a floor. Wallets are often linked to crime months or years later, so past totals tend to be revised upward.
As an example, TRM’s earlier estimate for 2023 rose from $34.8 billion to more than $58 billion after new data came in. TRM also changed its method this year, so older figures may not match past reports.
Illicit Share of Crypto Activity Fell
The dollar total grew, but crime took a smaller slice of the market. Illicit activity was 1.2% of attributed on-chain volume in 2025, down from 1.3% in 2024 and 2.4% in 2023.
TRM also added a new measure. It compares illicit inflows with the money leaving exchanges and other service providers, which it uses as a stand-in for available liquidity.
Its reasoning is that the same dollar can move many times and inflate volume. Liquidity gives a clearer view of how much new capital reaches criminals.
| Year | Share of on-chain volume | Share of liquidity |
|---|---|---|
| 2023 | 2.4% | 6.0% |
| 2024 | 1.3% | 2.9% |
| 2025 | 1.2% | 2.7% |
Both measures point the same way. Crime grew in dollars but fell as a share of the wider market.
Which Crime Types Grew Fastest
Sanctions-related inflows grew by more than 400% from 2024 to 2025. Blocklisted entities rose 32% and hacked or stolen funds rose 31%.
Market-driven crime grew more slowly. Darknet markets were up 20% and illicit goods and services were up 12%.
| Crime type | Growth, 2025 vs 2024 |
|---|---|
| Sanctions | More than 400% |
| Blocklisted | 32% |
| Hacked or stolen funds | 31% |
| Darknet markets | 20% |
| Illicit goods and services | 12% |
TRM links part of the sanctions jump to better attribution. Authorities now add wallet addresses to designations, and Tether has expanded its blocklisting of wallets tied to sanctions, fraud and hacking.
TRM also credits its Beacon Network, a tool that lets law enforcement share high-confidence intelligence. It says the network speeds up attribution but does not change what counts as illicit.
Crypto Scam Statistics
Chainalysis estimates that crypto scams and fraud took in $17 billion in 2025. The firm counted at least $14 billion on-chain so far and expects the total to grow as more wallets are identified.
The average scam payment rose from $782 in 2024 to $2,764 in 2025, an increase of 253%. Scammers are taking more from each victim.
TRM uses a different method and a wider net. It counted about $35 billion sent to fraud schemes in 2025, close to the $38 billion it recorded for 2024.
Of the 2025 total, $23 billion was verified fraud and $12 billion came from community complaints. TRM warns that most victims never report, so the real figure is likely higher.
| Measure | 2025 figure | Source |
|---|---|---|
| Estimated scam and fraud losses | $17 billion | Chainalysis |
| Average scam payment | $2,764 (up 253%) | Chainalysis |
| Inflows to fraud schemes | $35 billion | TRM Labs |
| Share from investment scams | 62% | TRM Labs |
| Stablecoin share of fraud inflows | About 84% (up from 70%) | TRM Labs |
| Pyramid and Ponzi inflows | $6.1 billion (up 49%) | TRM Labs |
Investment schemes made up 62% of fraud inflows. Pig butchering and Ponzi schemes were the main types.
Large Ponzi schemes also grew in number. Thirteen schemes took in more than $100 million in 2025, compared with six in 2024.
Impersonation and AI Scam Statistics
Impersonation scams grew more than 1,400% from 2024, according to Chainalysis. The average payment to these scams rose by more than 600%.
One example was the fake E-ZPass text campaign. Google’s lawsuit says a related group sent as many as 330,000 texts in a day and took in $1 billion over three years from more than 1 million victims in at least 121 countries.
Phishing kits for such scams can cost under $500. The Lighthouse kit vendor received more than 7,000 deposits and about $1.5 million in crypto over three years.
Scammers also pose as private firms. In December 2025, Brooklyn prosecutors charged a man over a scheme that posed as Coinbase support and took nearly $16 million.
The scheme relied on stolen customer data. An insider allegedly took $250,000 in bribes, and the leak exposed the data of nearly 70,000 customers.
Chainalysis says fraud now works like a supply chain. The Lighthouse group split the work among developers, data brokers, spammers, thieves and administrators, which lets unskilled criminals run large campaigns.
AI tools add to the effect. Scams with on-chain links to AI vendors earned an average of $3.2 million per operation, compared with $719,000 for those without. That is 4.5 times more.
| Measure | AI-linked scams | Other scams |
|---|---|---|
| Average revenue per operation | $3.2 million | $719,000 |
| Median daily revenue | $4,838 | $518 |
| Average transfers per day | 35.1 | 3.89 |
INTERPOL reached the same 4.5 times figure in its 2026 threat assessment. TRM says AI-enabled scam activity rose by about 500% in the past year.
Ready-made tools also help. Chainalysis found that scams using phishing kits were 688 times more effective in dollar terms than regular scams.
Crypto Hack Statistics
Hackers stole $2.87 billion across nearly 150 incidents in 2025, TRM reports. The number of incidents was similar to recent years, but losses were concentrated in a few large attacks.
The February breach of the Bybit exchange took $1.46 billion, or 51% of the year’s total. Without it, losses would have been about $1.4 billion.
The top 10 incidents made up 81% of all stolen value. The average hack was $19.5 million, while the median was only $1.3 million.
| Attack type | Incidents | Losses | Share of total |
|---|---|---|---|
| Infrastructure attacks | 45 | $2.2 billion | 76% |
| Code exploits | 52 | $350 million | 12.1% |
| Protocol attacks | 25 | $277 million | 9.6% |
Infrastructure attacks target keys, wallets and access controls. They averaged about $48.5 million per incident, compared with $6.7 million for code exploits.
TRM attributes $1.92 billion in thefts to North Korea-linked actors in 2025. It says these groups often use Chinese over-the-counter brokers to cash out quickly.
TRM says audits of smart contract code are no longer enough. It points to hardware-backed key storage, limits on withdrawals and tighter security for developer systems as the main defenses.
Sanctions and State Use of Crypto
Inflows to sanctioned entities and jurisdictions reached $93 billion in 2025. Russia-linked flows drove most of it.
The ruble-pegged stablecoin A7A5 handled more than $72 billion. The A7 wallet cluster, tied to a Russian sanctions evasion network, was linked to about $39 billion.
TRM says about 34% of A7A5 trading volume was likely inflated by wash trading. The Cambodian group Huione received $39.6 billion after being designated by FinCEN.
Nearly 95% of inflows to sanctioned entities used stablecoins. Flows through centralized exchanges fell by nearly 30% from 2024 to 2025, while flows through high-risk and no-KYC services rose by more than 200%.
Authorities made 21 crypto-related sanctions designations in 2025 across the EU, UK and US. Sixteen included wallet addresses.
Iran’s crypto activity stayed steady under pressure. TRM counted about $11.4 billion in 2024 and $10 billion in 2025.
| Iran measure | 2024 | 2025 |
|---|---|---|
| Total crypto activity | About $11.4 billion | About $10 billion |
| Illicit volume | About $600 million | About $580 million |
| Illicit share of activity | 5.1% | 5.9% |
Venezuela ranked 11th among the top 20 countries for crypto adoption in 2025, according to TRM. Residents use the stablecoin USDT for payments and remittances because the bolivar has lost value and banking access is limited.
Terror groups also use crypto. TRM links ISIS affiliates in Syria, Nigeria and Somalia to crypto fundraising, and says eight wallets sanctioned for links to the Houthis handled over $1.8 billion.
During the 12-day Iran-Israel conflict in June, volume rose about 35% while transaction counts fell about 40%. TRM reads this as users moving money in fewer, larger transfers.
Money Laundering Statistics
More than $60 billion left illicit wallets and reached other services in 2025, TRM reports. Most of it flowed through exchanges and other service providers.
Chinese-language escrow and guarantee services are now a main settlement layer. Their inflows rose from about $123 million in 2020 to over $103 billion in 2025.
The market is concentrated. Huione Pay handled about $73 billion, followed by Haowang, Xinbi and Tudou.
Enforcement moved the market rather than ending it. After FinCEN’s action on Huione, Telegram removed channels tied to Haowang and Xinbi, and activity shifted toward Tudou.
Scam Compounds and the Southeast Asia Link
Chainalysis ties much of the scam economy to East and Southeast Asia. Many operations run from compounds in Cambodia and Myanmar, where trafficking victims are forced to carry out the fraud.
One sign is the calendar. Since about 2022, pig butchering inflows have dropped during the seven-day Chinese New Year holiday, which suggests that workers in the region drive a large part of the activity.
The cash-out route has changed as well. In Q1 2022, under 1% of pig butchering laundering flows went to Chinese-language laundering networks. By Q1 2024 the share was slightly over 20%, and it stayed above 10% through 2025.
Over the same period, scammers used centralized exchanges less often. Chainalysis suggests this is because exchanges can freeze funds.
Scammers also move money faster. Since 2024, many fraud networks pass funds on within 48 hours, which narrows the window to freeze them.
Crypto ATMs are one entry point for older victims. The FBI reported that people aged 60 and older lost $2.8 billion to crypto-related scams in 2024.
INTERPOL says scam centers are no longer a regional problem. They have been found worldwide and involve hundreds of thousands of people.
Ransomware and Darknet Market Statistics
Ransomware payments stayed high in 2025 but did not reach past peaks. Victim claims on leak sites rose sharply, which suggests more targets refused to pay.
TRM counted 93 new ransomware variants in 2025, up 94% from 48 in 2024. By year-end there were 161 active variants.
Akira took in $150 million in 2025, almost twice as much as the next group, Qilin. The newcomer SafePay posted 452 victims by December.
Laundering habits changed too. Bridge use grew 66% across 2024 and 2025, while mixer use fell 37%.
Akira has changed its laundering method at least four times since 2023. Its current pattern sends each payment through a unique address and two consolidation addresses before it reaches the same exchange cash-out point.
Online drug markets also grew. Darknet marketplaces received $1.7 billion in 2025, up 20%, and the wider online drug trade received over $3.4 billion.
| Darknet market measure | 2025 figure |
|---|---|
| Total online drug trade inflows | Over $3.4 billion |
| Darknet marketplace inflows | $1.7 billion (up 20%) |
| Share from Russian-language markets | More than 90% |
| New marketplaces launched | 21 |
| Western darknet market volume | About $60 million (flat) |
Russian-language markets drive the growth. Nearly half of new markets accept only Monero, a privacy coin.
Chinese chemical makers supply the ingredients for synthetic drugs. Inflows to precursor vendors rose from $30.9 million in 2023 to $34.7 million in 2024 and $39.1 million in 2025.
Cartel-linked money launderers have moved more than $3 billion through crypto over time, TRM estimates. Most of that came in the past two years.
Law Enforcement and Global Fraud Response
Enforcement also set records. In the UK, police recovered more than 61,000 bitcoin from Zhimin Qian, who ran a fraud that hit more than 128,000 victims in China. She was sentenced to 11 years and eight months.
In the US, charges against Prince Group chairman Chen Zhi came with efforts to seize more than $15 billion linked to scam activity. OFAC and the UK also sanctioned 146 targets tied to the group.
The effect on payment hubs was clear. Huione Pay inflows peaked near $4.7 billion in July 2025, then fell to about $100 million by December.
INTERPOL’s 2026 assessment shows growing cooperation. Fraud-related notices and diffusions have risen 54% since 2024, and INTERPOL supported more than 1,500 cross-border fraud cases involving $1.1 billion in lost assets.
Other takedowns hit laundering tools. German and Swiss authorities seized the Cryptomixer service and about 12 terabytes of its data, and Canada took down the TradeOgre exchange in its largest crypto seizure.
Spain and the EU arrested dozens of people in a cash-to-crypto case and seized more than 30 million euros in cash, crypto and bank funds. Authorities also froze tens of millions of dollars in USDT, which shows they can now act fast on stablecoins.
The agency also warns that scam centers now operate worldwide and involve hundreds of thousands of people, many of them trafficked. It launched Operation Shadow Storm to target the money behind them.
| Enforcement action | Result |
|---|---|
| UK Metropolitan Police case | More than 61,000 bitcoin recovered |
| US action on Prince Group | More than $15 billion targeted for seizure |
| OFAC and UK designations | 146 targets sanctioned |
| Canada, TradeOgre takedown | Largest crypto seizure in Canadian history |
| INTERPOL fraud support | 1,500+ cases, $1.1 billion in assets |
What the Crypto Crime Statistics Show
The 2025 data points to a larger, more organized crime economy. Total illicit flows hit a record, but criminals took a smaller share of the market than in earlier years.
A few large events shaped the year. Sanctions designations, the Bybit hack and Russia-linked networks account for much of the rise.
Scams are changing as well. AI tools, phishing kits and laundering services make fraud cheaper to run and larger in scale.
Law enforcement is catching up. Record seizures, wallet-level sanctions and wider cooperation are making it harder to cash out, but networks keep moving to new platforms.
