Crypto Crime Hit $154 Billion: Chainalysis Says Hacks Are No Longer the Real Risk

Sanctions evasion, not hacks, dominated 2025 crypto crime

Crypto crime is no longer mainly a "hack risk." $154 billion moved through illicit addresses in 2025, and the bigger shift was who was using the system: value received by sanctioned entities surged 694%. Chainalysis says that surge helped drive record illicit volume as nation-state actors integrated crypto into broader financial operations. The takeaway is straightforward: the dominant problem is no longer just exploit code, but states, sanctioned businesses, and large fraud networks using blockchain rails for real-world finance.

Why off-ledger crime still matters to markets

Bulls can argue that violent theft and fraud are a smaller share of total illicit volume than sanctions evasion. Even so, those categories remain large and relevant. Chainalysis estimates about $17 billion was stolen in scams in 2025, while violent crime has become more direct: 37% of 2026 violent incidents were home invasions.

That matters because the cost of misreading crypto flows is no longer theoretical. Sanctioned transfer volume is already massive, fraud is becoming more automated, and physical coercion is hitting retail holders directly. If regulators tighten the rails, the first assets and venues at risk will be the ones still viewing crypto mainly through a hack-risk lens.

Fraud, ransomware, and state-linked rails are reshaping the threat mix

The broader pattern is a shift from flashy protocol exploits to human-driven fraud, state-supported sanctions workarounds, and more concentrated criminal infrastructure.

Scams are growing through impersonation and automation

Scams were an estimated $17 billion stolen in 2025. More important than the headline number is how fraud scaled: impersonation tactics exploded 1,400% year over year, while AI-enabled scams were 4.5 times more profitable than traditional scams. This looks less like opportunistic crime and more like industrialized demand generation.

The market risk is not limited to smart-contract bugs. Scammers do not need to break a protocol when they can convince users to send funds voluntarily. Average scam payments increased from $782 in 2024 to $2,764 in 2025, and Chainalysis linked major scam operations to professional money laundering networks. Bulls may say fraud is off-ledger and therefore outside protocol risk. But if users start viewing crypto as a one-way wallet, liquidity quality can still suffer.

Ransomware is smaller, but each attack is getting costlier

Ransomware is no longer the top-line leader. Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025. But the economics became more aggressive: claimed attacks rose 50%, and the median ransom payment grew 368% year-over-year to nearly $60,000.

Fewer payouts, bigger ransoms. Chainalysis describes ransomware as an interconnected marketplace of access, infrastructure, and monetization services. In that setup, the risk is not just whether an attack happens, but how much damage a successful one can extract. That can raise incident-response, insurance, and counterparty-risk costs even when headline theft numbers cool.

State-linked activity is now the biggest flow

The largest flow is coming from sanctioned infrastructure. In addition to value received by sanctioned entities surged 694%, Chainalysis said the Islamic Revolutionary Guard Corps (IRGC) and its proxy networks accounted for over 50% of value received in Q4 2025. It also said the ruble-backed A7A5 stablecoin processed $93.3 billion in less than a year.

That is the key rerating variable. Once crypto becomes part of state-enabled trade and sanctions workarounds, the issue stops being niche hack risk and becomes a question of which venues, tokens, and counterparties get pressured first.

Investors should watch stablecoin rails, exchange quality, and compliance exposure

The portfolio question is no longer which bridge gets exploited. It is which stablecoin rail, gateway, or exchange gets treated as a choke point first. After the 694% surge in sanctioned-entity volume, the market needs a liquidity map more than another hack-risk checklist.

Stablecoin circulation can become a compliance signal

Watch the rails that can move large sanctioned or semi-sanctioned volume quickly. The clearest example is the ruble-backed A7A5 stablecoin processed $93.3 billion in less than a year. Chainalysis also said Grinex and Meer were sanctioned in part for facilitating the ruble-backed stablecoin activity.

Bulls argue most stablecoin flow is ordinary and these are fringe pathways. Bears argue the opposite: if a rail is fast enough for sanctions workarounds, regulators and banks can quarantine it quickly. The market impact may not be just reputational; it could show up as wider peg pressure, thinner order books, and faster counterparty de-risking.

What would change this read?

There is a real bull case: enforcement is still active. Chainalysis highlighted the 61,000 bitcoin recovery in the UK and a $15 billion seizure linked to the Prince Group criminal organization.

That matters because this thesis weakens if regulatory pressure shrinks dirty-volume throughput without damaging clean stablecoin circulation and exchange liquidity. If clean flow keeps moving and tagged rails stay isolated, the market may be overreacting to the headline risk.