The era of the masked hacker hoarding Bitcoin in a dark web wallet is over. In 2025, the focus of the illicit cryptocurrency economy shifted decisively away from the volatility of the original cryptocurrency and towards a dense shadow system pegged to the dollar. According to new Chainalysis data, stablecoins accounted for 84% of the $154 billion in illicit transaction volume last year, representing a clear risk shift toward programmable dollars.
This structural shift has allowed Chinese money laundering networks to expand laundering-as-a-service operations, while nation-states like North Korea, Russia, and Iran have joined the same tracks to evade Western controls. The most striking trend in the 2025 data is the displacement of Bitcoin as the main crime currency. For over a decade, Bitcoin was synonymous with illegal online activity, but its dominance has steadily declined since 2020.
Why Criminals Abandoned Bitcoin
As shown in the illicit activity chart, Bitcoin’s share of dirty flows has fallen year after year, while stablecoins have surged and captured most of the market. Stablecoins dominate illegal crypto activity (Source: Chainalysis). This migration is no coincidence. It reflects trends in the broader, legitimate crypto economy, where stablecoins are becoming increasingly dominant due to their practical advantages: easy cross-border transferability, lower volatility than assets like Bitcoin or Ethereum, and broader utility in decentralized finance (DeFi) applications.
However, these same characteristics have made stablecoins the vehicle of choice for sophisticated criminal enterprises. The move away from Bitcoin represents a modernization of financial crime. By leveraging assets pegged to the U.S. dollar, criminal actors are effectively exploiting a shadow version of the traditional banking system, one that moves at the speed of the Internet and operates beyond the immediate reach of U.S. regulators.
The Geopolitical Pivot
If the period from 2009 to 2019 was the “beginnings” of renegade niche cybercriminals, and 2020 to 2024 was the era of “professionalization,” 2025 marked the beginning of “Wave 3”: large-scale nation-state activities. In this new phase, geopolitics has moved up the chain. Governments are now turning to the professionalized service providers originally designed for cybercriminals while building their own tailored infrastructure to evade sanctions at scale.
Russia in particular has shown that state-backed digital assets are suitable for circumventing sanctions. Following legislation introduced in 2024 to facilitate such activities, the country launched its ruble-backed A7A5 token in February 2025. In less than a year, over $93.3 billion was transacted using the token, allowing Russian companies to bypass the global banking system and move value across borders without relying on SWIFT or Western correspondent banks.
Industrialization of Money Laundering
This increase in volume is supported by the emergence of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These networks have dramatically advanced the diversification and professionalization of cryptocrime. Building on frameworks created by companies like Huione Guarantee, these networks have created full-service criminal enterprises.
They offer specialized “laundering-as-a-service” features and support a diverse customer base ranging from fraudsters and scammers to state-backed North Korean hackers and terrorist financiers. A key trend identified in 2025 is the increasing reliance of both illicit actors and nation-states on infrastructure providers that offer a “full spectrum” of services.
Convergence of Digital and Physical Threats
While the cryptocrime narrative often focuses on digital theft and money laundering, 2025 provided clear evidence that on-chain activity is increasingly intersecting with violent crime in the physical world. Human trafficking operations are increasingly using cryptocurrencies for financial logistics and moving proceeds across borders in relative anonymity.
Even more concerning is the reported increase in physical coercion. Criminals are increasingly using violence to force their victims to transfer assets. They often time these attacks to coincide with cryptocurrency price spikes to maximize the value of the theft. Despite these alarming trends, the broader context remains important. The illicit volumes recorded in 2025 still represent less than 1% of the legitimate crypto economy.
Illicit Activity Still Accounts for Less Than 1% of the Crypto Economy
However, the qualitative shift around that 1% is what worries regulators and intelligence agencies. Integrating nation-states into the illicit supply chain via stablecoins raises the stakes for national security. As government agencies, compliance teams, and security experts look ahead to 2026, the challenge will be to disrupt a professionalized, state-sponsored shadow economy that has successfully weaponized the efficiency of modern finance.
Collaboration between law enforcement, regulators, and crypto companies will be critical as the integrity of the ecosystem is now directly linked to global geopolitical stability. For more information, visit https://cryptoslate.com/stablecoins-dominate-illicit-crypto-activities-eclipsing-bitcoin/
