Sanctions Evasion Fuels Record $154B in Illicit Crypto Activity, Chainalysis Report Finds

Sanctions evasion emerged as the dominant driver of crypto-related illicit finance in 2025, with state-linked actors from Russia, Iran, and North Korea significantly increasing their use of digital assets, according to a new report released Thursday by blockchain analytics firm Chainalysis.

The report estimates that sanctioned entities received at least $104 billion in cryptocurrency transactions, marking nearly an eightfold increase compared with 2024. As a result, the total volume of illicit on-chain activity surged to a record $154 billion, highlighting how governments facing economic restrictions are increasingly integrating cryptocurrency into their financial systems to bypass traditional banking networks.

The findings align with a similar report from TRM Labs published in February, which revealed that illicit entities received $141 billion in stablecoins over the past year, the highest level recorded in five years. According to TRM Labs, 86% of those transactions were linked to sanctions-related activity, with stablecoins serving as the preferred medium for moving funds across borders.

Roughly $72 billion of the stablecoin flows tracked by TRM Labs were tied to A7A5, a ruble-pegged stablecoin registered in Kyrgyzstan. Chainalysis also identified A7A5 as a key participant in sanctions-related crypto activity, reporting that the token processed $93.3 billion in transactions within less than a year. The token has reportedly functioned as a settlement mechanism for sanctioned Russian companies conducting international trade.

A7A5 is connected to exchanges Grinex and Meer, both of which handled billions of dollars in transactions before being sanctioned by the United States and the European Union.

Chainalysis also identified an “A7A5 Instant Swapper” service, which allows users to convert the ruble-backed token into widely used dollar-pegged stablecoins while requiring minimal or no know-your-customer (KYC) verification. The service has already processed more than $2.2 billion, enabling sanctioned entities to move funds into the broader cryptocurrency ecosystem.

Oleg Ogienko, director for regulatory and overseas affairs at A7A5, dismissed the allegations, telling CoinDesk that the claims were politically motivated. He said the platform provides payment infrastructure for Russian export and import operations and operates in compliance with regulations in Russia, Kyrgyzstan, and other partner countries. Ogienko also stated that the project follows strict KYC and anti-money laundering (AML) procedures and noted that the stablecoin has not been referenced in Financial Action Task Force (FATF) reports.

The Chainalysis study also highlights the growing use of cryptocurrency by Iran. Addresses linked to the Islamic Revolutionary Guard Corps (IRGC)—which is designated as a terrorist organization by the United States and several other jurisdictions—accounted for more than half of the value received by Iranian crypto services by late 2025. The transactions totaled more than $3 billion and were associated with regional proxy financing, oil trading, and procurement networks.

Meanwhile, North Korea remained the most active cybercrime actor in the crypto sector, stealing more than $2 billion in digital assets in 2025. The figure includes $1.5 billion taken during the Bybit exchange hack, which Chainalysis described as the largest cryptocurrency theft ever recorded.

The report also underscores a broader transformation in crypto crime patterns. Stablecoins now represent roughly 84% of all illicit crypto transaction volume, reflecting the increasing reliance of sanctioned actors on liquid, dollar-pegged digital assets to transfer funds quickly and discreetly across international borders.