Russia-aligned crypto activity has increased even as illicit transactions have fallen to just 1.2% of total on-chain volume in 2025.
Illicit cryptocurrency activity rebounded sharply in 2025, driven primarily by Russia-related sanctions and improved attribution. A new report from TRM Labs estimates that fraudulent wallets received approximately $158 billion in value over the year, marking the highest level recorded in the past five years.
This increase represents a dramatic reversal from 2024, when illicit inflows fell to $64.5 billion, following a steady decline over several years, from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023.
Sanctions, Stablecoins and State Strategy
TRM Labs attributed the 2025 surge not only to intensifying enforcement measures, but also to increased use of cryptocurrency by state actors and technological advancements that have enabled the identification of previously unattributed illicit volumes. The most significant change focused on sanctions-related activities, largely linked to Russia, as volumes associated with sanctioned entities and jurisdictions increased sharply.
The A7A5 token alone represented an estimated $72 billion in inbound value, followed by $39 billion tied to the A7 wallet cluster, with the majority of this activity tied to Russia-linked players including Garantex, Grinex, and A7.
The blockchain intelligence firm said this increase reflects not just the growth of sanctions evasion, but rather the combination of new sanctions designations targeting large entities and better allocation of cryptocurrency addresses to actors who had already been sanctioned.
Among these, the A7 emerged as a central node and functioned as a centrally coordinated sanctions evasion architecture linked to Russian state interests. On-chain activity analyzed by TRM indicates that A7 functions as a hub connecting Russia-aligned players with counterparties across China, Southeast Asia, and Iran-linked networks, in a major pivot toward crypto-based, state-aligned financial infrastructure.
While the A7 wallet cluster is closely associated with sanctions evasion activities, the A7A5 token supports a broader initiative to reduce reliance on dollar-based financial systems through the expansion of a ruble-pegged stablecoin. As a result, the high transaction volumes linked to A7A5 do not exclusively represent sanctions evasion, but sanctioned activity more broadly, including state-aligned economic flows.
You might also like:
Fraudulent cryptography is growing
Moving away from sanctions-related activity, the company also revealed that overall illicit crypto flows reached an all-time high in 2025, even though this activity represented a smaller share of the crypto ecosystem. Measured as a proportion of total on-chain assigned volume, illicit activity declined slightly to 1.2% in 2025, compared to 1.3% in 2024, and remained well below the 2.4% peak recorded in 2023.
A similar trend was observed when illicit activity was assessed against inbound liquidity, as illicit entities received 2.7% of inbound VASP flows in 2025, compared to 2.9% in 2024 and 6.0% in 2023. TRM Labs said these measures indicate that while some illicit categories have grown significantly in absolute terms, illicit actors have absorbed a smaller proportion of new capital entering the the crypto ecosystem.
SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to sign up and unlock $1,500 in exclusive BingX Exchange rewards (limited time offer).
