Cryptomonedas 2025: 15 billion in illicit and the geopolitical turn that redefines the crime map

The cryptomonedas again entered the focus of financial crime in 2025 in a way that surprises their contradiction: on the one hand, the absolute amounts linked to illicit activities reached a new historical peak; on the other, the proportion of these flows to the total chain volume was slightly reduced. According to the intelligence analysis blockchain of TRM Labs the illicit transfers $15 billion in 2025, a figure that reversed the downward trend that had been observed between 2021 and 2024.

To understand the apparent paradox it is important to separate two variables: the absolute size of the funds moved by illicit actors and the relative weight of those movements on the enormous and growing global activity in lockchain. TRM documents that, although the total volume labelled as illicit has grown 145% As regards 2024, its participation in the total on-chain traffic experienced a slight fall, passing from 1.3% to 1.2%. In other words, the chain continues to expand at high speed and, although the proportion decreases, the dollar value that crossed into questionable hands was much higher.

Behind that dollar jump are concrete and intertwined factors. TRM points to a marked increase in activity related to international sanctions, focusing on networks linked to Russia and instruments such as certain stablecoins associated with these ecosystems. This phenomenon not only reflects new punitive designations, but also improvements in the attribution of already sanctioned addresses and entities, which has led to the identification of movements that were previously left in the shadow. The fact that state or state-aligned actors - mentioned in the report - are using cryptoforeign exchange as part of their financial infrastructure radically alters the map: when important value blocks are moved by geopolitical motivations, total statistics are fired.

The presence of states or state actors in the critical flows is not an isolated development, but 2025 showed an intensification that raises questions about how sanctions are implemented and enforced in a decentralized environment. Sanctions and international economic policy have already incorporated tools and designations specific to digital assets; however, the TRM report stresses that the combination of complex scrow networks linked to China, state actors and alternative liquidation routes can facilitate large-scale movements that escape traditional scrutiny. For context and background on how sanctions affect digital assets, the US Treasury Department documentation is available. United States on financial sanctions: U.S. Treasury - Financial Sanctions.

In the chapter on classic crimes within the critical ecosystem, attacks on exchanges and protocols remain a central vector. TRM reports $2.870 billion in losses resulting from 150 hacks during 2025, with the typical concentration that the ten largest gaps explain about 81% of the total removed. The most relevant case of the year, according to the report, was the intrusion to Bybit in February 2025, attributed to North Korean actors and with an impact close to $1,460 million. These episodes recall that, in addition to ensuring public networks, the operational resilience of custodians and exchanges remains a determining factor for the security of the system as a whole.

If massive robberies capture headlines, individual scams and fraud amount to even greater amounts by volume and dispersion. TRM estimates that approximately $35 billion were sent to fraudulent schemes in 2025, dominated by investment scams - from Ponzi and false tasks to sentimental deception - that concentrated about 62% of the flows to fraud. A new and worrying element is the adoption of artificial intelligence tools by criminals: more persuasive content, more personalized messages and automated campaigns that can imitate voices or identities more effectively are increasing the professionalism and scope of these mos.

As for the Ransomware, 2025 did not return the highest peaks of previous exercises, but maintained sustained activity. The report identified a growth in ecosystem fragmentation: 161 active families and 93 variants new in a single year. This dynamism is also reflected in the techniques for whitening bailouts: the traditional use of mixers was reduced by 37%, while the routing through inter-chain bridges and other cross-chain techniques increased by 66%. Technological developments and the proliferation of decentralized services offer criminals new routes to try to hide sources and fund destinations, which complicates research and requires constant adaptations in the on-chain analysis tools.

In the face of this scenario, detection and response no longer depend only on the supervision of a company: collaboration between blockchain intelligence providers, regulatory agencies, law enforcement and exchange platforms is critical. TRM highlights how a faster exchange of intelligence and better attribution capacities have led to flows that were previously unidentified; this collaboration is complemented by public and judicial actions that occasionally end up in seizures or closures of illicit forums. Agencies such as Europol and INTERPOL have been strengthening operations against markets and services linked to cryptoactive washing, and their releases show that the response must be multidimensional. For more information on international operations against digital crime, see the Europol Press Room: Europol - Newsroom and the INTERPOL website: INTERPOL - News and Events.

What does all this mean for users, companies and policy makers? First, the need for investment in compliance controls and on-chain analysis capabilities: it is not enough with paper rules if platforms cannot detect complex obfuscation patterns or inter-chain routes. Secondly, the importance of international cooperation to ensure that sanctions and measures against laundering are effective in an environment that transcends borders. Finally, a reading for individual users: the caution against offers that promise rapid returns and the verification of counterparties are simple but effective defenses against much of the damage caused by fraud.

TRM data for 2025 draw a complicated image: cryptomonedas continue to transform markets and payment systems, but this transformation brings with it actors who seek to exploit the anonymity, speed and interoperability of the networks. The technological and regulatory response will have to be accelerated at the same rate if the increase in illicit flows is to be contained without stopping the legitimate innovation that also moves billions each year. For a detailed analysis and full data, see the original TRM Labs report: TRM Labs - 2026 Crypto Crime Report.