Quick Breakdown
- Illicit cryptocurrency volumes reached an all-time high of $158 billion in 2025, a 145% increase from the previous year, primarily driven by sanctions evasion and professionalised fraud.
- Use of Large Language Models (LLMs) in crypto scams increased fivefold, making fraudulent outreach more convincing and enabling attackers to bypass cultural and language barriers at scale.
- Despite the record nominal value, the share of illicit activity as a proportion of total on-chain volume fell to 1.2%, suggesting that legitimate adoption is outpacing criminal growth.
Illicit cryptocurrency activity surged to a record $158 billion in 2025, fueled by a 500% explosion in AI-enabled scams and massive sanctions evasion. According to the TRM Labs 2026 Crypto Crime Report, this total represents a 145% increase from the $64.5 billion recorded in 2024, reversing three years of steady decline.
The sharp rise was driven by a professionalised “industrial” approach to cybercrime, where attackers leveraged artificial intelligence to launch highly convincing impersonation campaigns and manage thousands of victims simultaneously. Despite the record-breaking dollar value, the report highlights that criminal activity remains a minority of the ecosystem, as the illicit share of total on-chain volume actually dropped from 1.3% to 1.2% year-over-year.
AI and stablecoins drive industrialised fraud
The integration of Large Language Models (LLMs) has transformed the scam landscape, allowing fraudsters to create deepfake videos, clone voices, and generate realistic personas that are nearly indistinguishable from genuine entities. These AI-enabled operations proved to be 4.5 times more profitable than traditional methods, extracting an average of $3.2 million per operation. TRM Labs observed that roughly $35 billion was sent to fraud schemes in 2025 alone, with stablecoins remaining the primary vehicle for these transactions, accounting for 84% of verified fraud inflows.
“Large language models (LLMs) enable scams to cross language and cultural contexts with less friction, while AI-generated images, voice cloning, and deepfake videos reduce the cost of creating convincing personas,” TRM Labs stated.
Geopolitics and sanctions move on-chain
Beyond individual fraud, 2025 marked a pivotal shift where crypto transitioned into durable infrastructure for sanctioned economies. Sanctions-related activity grew by over 400% year-over-year, dominated by Russia-linked flows through entities like the ruble-pegged stablecoin A7A5. TRM Labs identified that Russia, Iran, and Venezuela are increasingly relying on crypto rails for state-aligned financial settlement and sanctions-pressured payments. A7-associated addresses were also linked to high-risk networks including the IRGC and Hamas, highlighting the overlapping nature of modern illicit financial hubs.
“Wrench attacks,” or physical violence to extort crypto assets, are rising, with a correlation noted between increasing market prices and criminal activity. Targets have broadened from executives to middle-class investors. The shift from digital hacking to physical security concerns necessitates advocating for greater wealth privacy and using sophisticated wallet setups to deter criminals.
If you would like to read more articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
