TRM Labs' Crypto Crime Report for 2026 states the illicit bitcoin wallets are projected to receive $158 billion in incoming value for 2025, meaning the sum of money flowing into them is at a 5-year high and is 145% greater than the $64.5 billion projected for 2024. This average annual statistic reflects 3 years of cumulative decline. However, the key counterpoint to that headline stat is that the percentage of illicit volume has declined to 1.2%, down from 1.3% in 2024 and far below the 2.4% seen in 2023, meaning the legitimate crypto market is growing faster than the illegitimate one. In 2025 alone, stablecoin activity was nearly $4 trillion. As Ari Redbord, the Global Head of Policy for TRM states: "That 1.2% is existential, and that's all I focus on — ransomware attacks on hospitals, seniors getting scammed out of their life savings, North Korea using Crypto to fund their weapons program and so on." The contradiction of 2025 is that the infrastructure that enables Crypto crime has truly professionalized, become linked to state sponsorship, and is well-entrenched into legitimate financial systems – this is why it has also hit a record absolute high volume. <h2>Russia's A7A5 Machine: Sanctions Evasion at Industrial Scale</h2> The<a href="https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline" rel="noopener noreferrer" target="_blank">$158 billion figure</a> largely stemmed from increased sanctions evasion activities related to Russia. This is up by over 400% from last year. The majority of this activity is attributed to A7A5, which is a stablecoin backed by rubles and had<a href="https://www.dlnews.com/articles/regulation/how-ruble-stablecoin-a7a5-drove-a-surge-in-sanction-dodging/" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.dlnews.com/articles/regulation/how-ruble-stablecoin-a7a5-drove-a-surge-in-sanction-dodging/" rel="noopener noreferrer" target="_blank">over $72 billion in volume</a> in 2025. Over $39 billion of the A7 sanctions evasion activity can be connected with the larger wallet cluster A7. Rather than opportunistic decentralised transactions, TRM refers to the overall relationship between all of these transactions and refers to them as a<a href="https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.chainalysis.com/blog/a7a5-grinex-russian-crypto-economy-ofac-sanctions-august-2025/" rel="noopener noreferrer" target="_blank">centrally managed ecosystem</a>, meaning the entire system has been created to send value outside the traditional banking system. In addition, A7A5 is a sanctioned token, therefore the risks associated with cryptocurrency sanctions include not only the individual wallet or transaction but also the entire ecosystem that surrounds a cryptocurrency, including the issuers, intermediaries and liquidity providers. Therefore, one of the most frustrating things for those in the crypto space is how stablecoins have quickly become the primary channels for carrying out unlawful transactions. The noose is tightening around them (and it's not just Russia) - TRM's estimate of 2025 crypto acceptance reported that Venezuela was in the<a href="https://www.trmlabs.com/reports-and-whitepapers/2025-crypto-adoption-and-stablecoin-usage-report" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.trmlabs.com/reports-and-whitepapers/2025-crypto-adoption-and-stablecoin-usage-report" rel="noopener noreferrer" target="_blank">11th position</a>. For example, USDT acts as a "pressure-release valve" facilitating payments, giving remittances to family, and providing state-linked financial services in a country that has strict sanctions placed on it and limited access to conventional banking systems. Meanwhile, intermediaries related to high-risk financial networks and regulations associated with China, Russia and Iran continue to help route funds for actors that have been sanctioned by finding ways to use different regional platforms with their own separate regulatory regimes. What we continue to see is all of these sanctioned actors turning to cryptocurrency because of how quickly and widely accessible they are globally and the fact that they can settle without having to use the international corresponding banking systems that have to comply with sanctioning rules - specifically NOT because they are able to remain anonymous due to the use of blockchain technology. <h2>Guarantee Marketplaces: Escrow-Based Trust as Criminal Infrastructure</h2> Research conducted by TRM indicates that escrow-based "guarantee marketplaces" are a major new finding on a structural level throughout the world that relates to the global criminal crypto economy regardless of what country you are from. For 2025, approximately<a href="https://www.coinspeaker.com/crypto-crime-record-158-billion-2025-russia-sanctions-evasion/" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.coinspeaker.com/crypto-crime-record-158-billion-2025-russia-sanctions-evasion/" rel="noopener noreferrer" target="_blank">$103 billion worth of adjusted cryptocurrency</a> was handed over through underground banking networks and escrow services using a Chinese language service. In the year 2020, that figure was just $123 million. When you compare this number with USD &amp; 5 years ago, it shows that this figure has increased by 800% since then. Guarantee services serve as the one-stop shop for custodial, informal escrow, disputes resolution, OTC brokerage and money mule services and have become attractive to networked frauds and organised cybercriminals as well as people trying to avoid sanctions, largely because they are fast, provide privacy, and require little or no identification. The majority of the settlement layer is comprised of USDT (a stablecoin that is pegged to the US dollar) that sits on the TRON blockchain which links cryptocurrency to the traditional financial world using OTC desks and established Asian casinos. Regulatory enforcement actions result in short-lived whack-a-mole effects rather than a long-term disruption to the illegal crypto economy as evidenced by the marketplace (ecosystem) model. After Telegram banned large channel clusters associated with illicit escrow services, transaction volumes plummeted across most assurance platforms in the spring of 2025. Contrastingly, a strong performing Chinese-language marketplace, Xinbi, had already spread its coordinators across multiple platforms. A rebound in wallet activity occurred by January 2026 given that on-chain volumes grew by<a href="https://www.trmlabs.com/resources/blog/xinbi-marketplace-remains-active-with-usd-17-9-billion-in-total-volume-despite-enforcement-actions" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.trmlabs.com/resources/blog/xinbi-marketplace-remains-active-with-usd-17-9-billion-in-total-volume-despite-enforcement-actions" rel="noopener noreferrer" target="_blank">98% between May and December</a> 2025 according to data from TRM Labs. Xinbi accepted demand that had previously been directed towards the competing<a href="https://www.coindesk.com/business/2025/07/30/illicit-crypto-trade-quickly-rebounds-despite-telegram-s-shutdown-of-usd35b-huione-marketplace" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.coindesk.com/business/2025/07/30/illicit-crypto-trade-quickly-rebounds-despite-telegram-s-shutdown-of-usd35b-huione-marketplace" rel="noopener noreferrer" target="_blank">Tudou Guarantee, which was shut down</a> following the imprisonment of Prince Group leader Chen Zhi for money laundering was also in concert with Xi's methods of removing crypto on platforms associated with illicit activity. The primary structural barrier preventing successful enforcement on crypto is a fragmented ecosystem whereby removing certain platforms only redistributes the flow of illegal crypto, as opposed to completely halting it via enforcement. <h2>Enforcement's Evolving Playbook: Attribution Over Disruption</h2> Law enforcement changed their focus from identifying individual illicit marketspaces to applying a wholesale infrastructure-based strategy of attack against all cryptocrime. The reason for the sharp rise in criminal attribution numbers in 2025 was the creation of the TRM "Beacon Network," which provides a collaborative framework allowing investigators to securely exchange high-confidence information. As investigators have better tools now than in the past, the 145% increase in the identified volume of illicit activity can be attributed to the increase in criminal activity. Due to real-time information sharing from the Beacon Network, enhanced blockchain analytics, and an increase in the number of designated economic sanctions, investigators have been able to identify blockchain wallets that have previously been untraceable. Based on the information provided in all prior TRM reports and the nature of ongoing forensic investigations, it is the opinion of TRM that all prior TRM reports underestimate the total volume of illicit activity and that the total volume will be increased by any additional incidents identified through ongoing forensic investigations. Starting at October 2023 and going through to 2026, law enforcement agencies are currently focusing their enforcement efforts on targeting infrastructure layers as opposed to targeting individual manufacturers. Law enforcement agencies, such as DEA and FBI, have been successful in disrupting the Incognito Market drug trade (the Incognito Market dealt only in cryptocurrency) through their use of undercover buy and block chain technology. The Incognito operator received a<a href="https://www.theblock.co/post/388385/incognito-market-founder-sentenced-crypto-drug-market" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.theblock.co/post/388385/incognito-market-founder-sentenced-crypto-drug-market" rel="noopener noreferrer" target="_blank">30-year jail sentence</a> and was ordered to repay<a href="https://www.trmlabs.com/resources/blog/operator-of-incognito-market-sentenced-to-30-years-for-global-darknet-drug-trafficking" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.trmlabs.com/resources/blog/operator-of-incognito-market-sentenced-to-30-years-for-global-darknet-drug-trafficking" rel="noopener noreferrer" target="_blank">$105 million of the profits</a> from the operation. The guaranteed marketplace operation is good evidence of how this can work - these practices (such as Xinbi) allow the repartition of the guaranteed services quickly while operating on multiple platforms, making them "resilient" to disruptions at any given point in its infrastructure. The Incognito Market, on the other hand, was a single, centralized location; therefore, law enforcement agencies carried out a successful "coordinated takedown" only. According to TRM, using targeted operations based on infrastructure targeting (rather than brand-specific targeting), aggressive attribution, and greater comfort with crypto-related violations to achieve disruption of network operations will make law enforcement agencies more effective in continuing to disrupt within these networks through 2026. <h2>The Proportional Decline: Why the Ratio Matters More Than the Total</h2> Fluidity Manipulation Rate is the number 1 figure in TRM's investigation in regard to total liquidation or total liquid value of $158 billion. Illicit actors had<a href="https://www.theblock.co/post/387453/illicit-actors-capture-nearly-3-of-crypto-liquidity-in-2025-trm" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.theblock.co/post/387453/illicit-actors-capture-nearly-3-of-crypto-liquidity-in-2025-trm" rel="noopener noreferrer" target="_blank">2.07% of total liquid value</a> of all remaining available cryptocurrency at year ending 2025 with estimated increase to 2.08% (2.97 – 3/01/2324). Unique Transaction Volume has increased dramatically while all manner of illegal activity has increased approximately 95% as measured against the established methodology. Legitimate usage of cryptocurrencies is continuing to exceed limited growth of illegal marketplaces, services and items, with fastest growing categories of lawbreaking services including shapeshifting, unorthodox or illegal items exceeding 20% growth for each category as a service. One hacking event represented approximately 50% of total<a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/" rel="noopener noreferrer" target="_blank">$2.98 Billion (approximately)</a> in illicit cryptocurrency due to vulnerabilities associated with such events which demonstrates extreme concentration of risk for significant hazardous events. The proportional loss of lawmakers' ability to create new legislation is due to the $158 billion in legal issues associated with the current crypto market structure versus the $158B in regulatory issues associated with the new crypto market structure under the CLARITY Act. Therefore, U.S. Senators must balance both issues as they create legislation regarding the creation or establishment of the new crypto market structure in relation to what constitutes illegal and legal use of cryptocurrencies and the illicit financial activity associated with cryptocurrencies. For example, the increase in Democratic politicians' call for legislation creating prohibitions on and law enforcement regarding the criminal use of cryptocurrencies is combined with the experience of law enforcement that the criminal use of cryptocurrencies may have grown to meet or exceed the amount of illicit money laundering occurring disassociatively through traditional financial institutions, as evidenced by the volume of global money laundering estimated to be between 2% and 5% or 2 to 5 million dollars (USD) of global GDP every year. According to Redbord, there has been substantial unauthorized and legally sanctioned professional growth in the illegal use of cryptocurrency, resulting, at present, in approximately<a href="https://www.coindesk.com/policy/2026/01/27/criminal-use-of-crypto-spikes-after-years-of-steady-decline-trm-report-says" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.coindesk.com/policy/2026/01/27/criminal-use-of-crypto-spikes-after-years-of-steady-decline-trm-report-says" rel="noopener noreferrer" target="_blank">4 trillion dollars' worth of stablecoins</a> being utilized for transactions in 2025. Consequently, the legal market of stablecoins is growing at a much faster pace than the illegal market of stablecoin transactions. At this time the evidence continues to indicate that the legal market is continuing to achieve more rapid and consistent growth than the illegal market and that the transparency provided by blockchain technology provides investigators a key benefit that does not exist in traditional financial markets.

Crypto crime hit record volume in 2025, but its share fell to 1.2%. Stablecoins and escrow marketplaces drive illicit activity, while enforcement shifts to infrastructure-level attribution.

Illicit Crypto Ecosystems: From Guarantee Marketplaces to Enforcement Adaptations

/media/contribution/car12d76d28ce524d1997b50f287ea62da3/sqx_0403085105746.stxt

How to spot a crypto scammer?

/media/contribution/car6b517213a1854f5e8a435eb6da3daeb5/hz5_0403091102299.stxt

Whale Withdraws 32,879 ETH (~$69M) from Kraken: A Quiet Shift Toward Self-Custody

/media/contribution/car832e7e2eaa8c4b838f483dc1d9f96003/d0j_0403090731196.stxt

How to Track Crypto Transactions Easily and Safely

/media/contribution/car9f512c61a1ce452c9d9deea76423bb14/9dx_0403081512819.stxt

Crypto Payments 101 for Ecommerce: A Beginner’s Guide to Accepting Cryptocurrency Online

/media/contribution/car5065cd53e79c4eb0953ae54b414d1341/k6s_0403074621320.stxt

Launchpads and Token Listings: The Process, Due Diligence, and Long-Term Impact on Project Success

/media/contribution/car43446d2901a64eb49d97f5f509ce0115/5ki_0403055136455.stxt