Published on: 2026-01-12

AI-powered OSINT brief from verified open sources. Automated NLP signal extraction with human verification. See our Methodology and Why WorldWideWatchers.

Intelligence Report: Illicit Crypto Activity Hits Record 158bn in 2025

1. BLUF (Bottom Line Up Front)

The illicit use of cryptocurrency reached an estimated $158 billion in 2025, driven by sanctions evasion and improved detection methods. Despite the increase in absolute terms, illicit activity as a percentage of total crypto flows has decreased. This trend suggests a complex but manageable threat landscape for national security and financial integrity. Overall confidence in this assessment is moderate due to methodological uncertainties and potential data revisions.

2. Competing Hypotheses

• Hypothesis A: The increase in illicit crypto activity is primarily due to heightened sanctions evasion by state actors such as Russia, Iran, and Venezuela. Supporting evidence includes a reported 400% increase in crypto linked to sanctions evasion. However, uncertainties remain regarding the full scope of state involvement and the accuracy of these estimates.
• Hypothesis B: The reported increase is largely a result of improved detection capabilities and changes in data collection methodologies. Evidence includes the use of the Beacon Network for better identification of illegal activities and historical revisions of previous estimates. Contradicting evidence is the substantial increase in illicit volumes that cannot be solely attributed to detection improvements.
• Assessment: Hypothesis A is currently better supported due to the significant role of geopolitical factors and sanctions evasion in driving illicit crypto activity. However, ongoing data revisions and improved detection capabilities could shift this assessment.

3. Key Assumptions and Red Flags

• Assumptions: The data provided by TRM Labs and Chainalysis is accurate and reflects actual trends; sanctions will continue to drive illicit crypto use; detection capabilities will improve over time.
• Information Gaps: Detailed breakdowns of specific illicit activities and their respective contributions to the total volume; comprehensive data on state actor involvement.
• Bias & Deception Risks: Potential bias in data interpretation due to reliance on proprietary methodologies; risk of underreporting or misclassification of illicit activities by blockchain analytics firms.

4. Implications and Strategic Risks

The increase in illicit crypto activity could lead to heightened regulatory scrutiny and international cooperation to combat financial crime. However, the decline in illicit activity as a share of total flows suggests potential stabilization.

• Political / Geopolitical: Increased tensions between sanction-imposing countries and those evading them, potentially leading to diplomatic conflicts.
• Security / Counter-Terrorism: Enhanced focus on monitoring crypto transactions linked to terrorism financing and organized crime.
• Cyber / Information Space: Potential for increased cyber operations targeting crypto exchanges and wallets, particularly by state-sponsored actors.
• Economic / Social: Potential impacts on the legitimacy and adoption of cryptocurrencies, affecting market stability and investor confidence.

5. Recommendations and Outlook

• Immediate Actions (0–30 days): Enhance monitoring of crypto transactions linked to high-risk jurisdictions; collaborate with blockchain analytics firms for real-time data sharing.
• Medium-Term Posture (1–12 months): Develop international partnerships to strengthen regulatory frameworks; invest in technology to improve detection and attribution of illicit activities.
• Scenario Outlook:
  • Best: Continued decline in illicit activity as a share of total flows due to effective regulation and enforcement.
  • Worst: Escalation of state-sponsored crypto crimes leading to financial instability and geopolitical tensions.
  • Most-Likely: Gradual improvement in detection and regulation, with illicit activity stabilizing at current levels.

6. Key Individuals and Entities

• TRM Labs
• Chainalysis
• Venezuela, Iran, Russia (state actors involved in sanctions evasion)
• North Korean actors (linked to Bybit hack)
• Tether (stablecoin issuer involved in enforcement)

7. Thematic Tags

regional conflicts, illicit finance, sanctions evasion, cryptocurrency regulation, blockchain analytics, cybercrime, state-sponsored activity, financial intelligence

Structured Analytic Techniques Applied

• Causal Layered Analysis (CLA): Analyze events across surface happenings, systems, worldviews, and myths.
• Cross-Impact Simulation: Model ripple effects across neighboring states, conflicts, or economic dependencies.
• Scenario Generation: Explore divergent futures under varying assumptions to identify plausible paths.
• Network Influence Mapping: Map influence relationships to assess actor impact.

Explore more:
Regional Conflicts Briefs ·
Daily Summary ·
Support us