Illicit actors capture nearly 3% of crypto liquidity in 2025: TRM

Crypto security firm TRM Labs found that illicit crypto volume surged to an all-time high of $158 billion in 2025, up nearly 145% from the year before. While these figures are in some sense startling, there’s reason to believe illicit use of crypto and security incidents are actually on a downtrend. 

According to TRM’s latest Crypto Crime Report, illicit volume as a proportion of overall crypto volume fell in 2025 to 1.2% from 1.3% in 2024 and “well below the 2023 high of 2.4%.”

These figures are largely in line with Chainalysis’ estimates, published earlier this month, which found crypto crime hit a nominal value of $154 billion in 2025. That represents less than 1% of the total crypto transaction volume. 

Year after year, crypto security firms publish reports showing that crypto’s longstanding association with crime is largely overblown, with illicit use almost always only representing a fraction of overall blockchain transactions and crypto crime paling in comparison to the illicit trade supported by the traditional banking system. 

This year, TRM published a new metric looking to compare the risk of crypto crime “relative to deployable capital,” as opposed to measuring raw transaction volume. According to the firm, illicit entities managed to capture 2.7% of available crypto liquidity in 2025, down from 2.9% in 2024 and 6.0% in 2023.

“Together, these metrics indicate that while certain illicit categories expanded in absolute terms, illicit actors absorbed a smaller proportion of new capital entering the crypto ecosystem,” the firm wrote. 

Geopolitical concerns

That said, crypto’s criminal use can be said to be a growing geopolitical issue, with a significant portion of these illicit flows being tied to Russian, Iranian, and Venezuelan sanctions evasions, North Korean hacks, and Chinese money laundering, among other threats. 

“Geopolitical pressures reshaped illicit crypto activity in 2025, as state and state-aligned actors moved to using cryptocurrency as core financial infrastructure rather than a tool of last resort,” TRM wrote in its report. 

According to the report, sanction-related flows increased about 400% year-over-year. Like Chainalysis, TRM flagged the sanctioned A7A5 token as receiving a significant portion of sanctioned flows alongside other sanctioned entities like Garantex, Grinex, and A7.

“A7 stands out not only for its scale, but for its role as centrally coordinated sanctions evasion architecture tied to Russian state interests,” TRM said, noting it acted like “a hub” connecting Russia-linked actors with counterparties across China, Southeast Asia, and Iran, “reflecting a deliberate shift toward crypto-enabled, state-aligned financial infrastructure.”

TRM argued that the increasing integration of crypto into the “everyday financial” system, the rise of underground Chinese-language escrow and banking services, and the adoption of stablecoins are reshaping the illicit crypto ecosystem.

For instance, activity associated with Chinese-language escrow services and underground banking networks has grown sharply over time, with adjusted crypto volume rising an order of magnitude to $103 billion last year from $123 million in 2020, in part reflecting the rise of “pig butchering” schemes.

Types of theft

TRM also found that while the “incident volume” of crypto hacks has largely stayed the same over the past several years, there may have been a “structural shift in attack vectors.” 

“Adversaries moved up the stack, targeting operational infrastructure — keys, wallets, and control planes — over smart contract code,” TRM said. These types of infrastructure attacks drove $2.2 billion in losses, representing 76% of the total stolen digital assets across 45 incidents. 

That’s compared to 52 known code exploits, which accounted for a comparatively smaller share of total losses at about $6.7 million per incident, and about 25 protocol attacks, losing roughly $11.1 million per incident.

Of course, the historic Bybit breach by North Korea affiliates skews these metrics, representing over 51% of the $2.87 billion total exploit losses. But even removing that attack, the 2025 figures would have totaled $1.4 billion, “underscoring a persistent baseline of criminal activity” as well as the rising threat of compromised “operational infrastructure.”

“In 2025, just five events accounted for 70% of all stolen crypto value,” TRM said. “This widening gap illustrates a 'long tail' risk environment: a handful of mega-heists drive global loss figures, while a high volume of smaller incidents continues to inflict persistent damage across the crypto ecosystem.”

Likewise, losses connected to crypto scams dipped slightly in 2025, but the sector appears to be increasingly dominated by “organized groups operating with business-like structure, specialization, and efficiency.” Pig butchering and pyramid schemes, for instance, each represented nearly a third of estimated fraud losses. 

While TRM reported that criminal networks appear to be becoming more adept at deploying “freeze-prone assets such as ETH or DAI,” they are also seeing a notable increase in the use of stablecoins, which saw about 84% of fraud inflows in 2025. The firm also found increasing darknet volumes and at least 93 new ransomware variants.