Chainalysis 2026 Report Estimates $154 Billion in Illicit Crypto Flows in 2025
Report discovered via Awesome Annual Security Reports.
Summary
Chainalysis estimates illicit crypto addresses received at least $154 billion in 2025. Its annual report details growing impersonation scams, laundering networks and ransomware payments, with sanctions-related flows driving the overall increase.
Key points
- Chainalysis estimates illicit addresses received at least $154 billion in 2025, up 162% year over year, primarily driven by increased receipts by sanctioned entities. Illicit activity remained below 1% of attributed transaction volume.
- The estimates are lower bounds based on identified addresses and may rise as attribution improves; non-crypto-native criminal transactions generally remain excluded unless confirmed.
- Crypto scams received at least $14 billion in 2025, with the report projecting the total could exceed $17 billion as more addresses are identified. Impersonation scam inflows grew more than 1,400%.
- Scams with visible on-chain links to AI vendors averaged $3.2 million per operation versus $719,000 for those without such links. This comparison covers observable vendor associations, not all AI use.
- Chinese-language money laundering networks processed $16.1 billion in inflows, approximately 20% of known illicit laundering activity. Vendors migrated across platforms despite enforcement pressure.
- DPRK-linked hackers stole $2 billion in 2025, according to the report, including nearly $1.5 billion in the February Bybit exploit.
- The report estimates approximately $820 million in ransomware payments and at least $14 million paid to initial access brokers in 2025, highlighting shared access, hosting and laundering services as disruption targets.
Article Details
- Publisher
- Chainalysis
- Report Period
- 2025
- Scope
- Global cryptocurrency-enabled illicit activity, including laundering, scams, suspected human trafficking, darknet markets, ransomware, sanctions evasion, and terrorist financing.
- Key Statistics
- Identified illicit addresses received at least $154 billion in 2025, up 162% year-over-year; this is a lower-bound estimate subject to additional address attribution.
- Sanctioned entities received $104 billion in 2025, a 694% year-over-year increase.
- Identified Chinese-language money laundering networks processed $16.1 billion in 2025 across over 1,799 active on-chain wallets; guarantee services are excluded.
- Cryptocurrency scams received at least $14 billion on-chain in 2025; the figure may increase as additional illicit addresses are identified.
- Ransomware actors received over $820 million in identified on-chain payments in 2025, down 8% from the updated 2024 estimate, while leak-site victim claims increased 50%; claims may include reposted or illegitimate entries.
- Recommendations
- Target underlying illicit operators, vendors, initial access brokers, and shared infrastructure rather than advertising platforms or individual ransomware groups alone.
- Combine blockchain analysis with open-source and human-source intelligence to map laundering networks and connect operators to financial flows.
- Improve cross-border public-private intelligence sharing and coordination for rapid fund tracing, freezing, and infrastructure disruption.
- Adopt real-time fraud and mule detection systems and strengthen law enforcement cryptocurrency tracing and asset recovery capabilities.
- Monitor trafficking-related financial patterns, including large recurring labor-placement payments, cross-border transfers, guarantee-platform activity, and connections to Telegram recruitment channels.
MITRE ATT&CK
T1090.002 · External ProxyState-linked actors used commercial proxy services to obscure attribution; residential proxy networks supplied IP rotation and anonymization for malicious operations.T1199 · Trusted RelationshipThe reported Coinbase impersonation scheme obtained customer information through bribery of a customer service insider.T1566.002 · Spearphishing LinkThe E-ZPass impersonation operation distributed fraudulent SMS messages directing victims to phishing websites.T1583.001 · DomainsThe phishing ecosystem supplied domain setup capabilities, and the investment scam registered tickmilleas[dot]com to impersonate a financial services firm.T1589 · Gather Victim Identity InformationThe Lighthouse Enterprise included data brokers supplying targeted lists of potential victims.
People
Chen ZhiPrince Group chairman charged with allegedly overseeing forced-labor scam compounds; arrested in Cambodia and extradited to China in January 2026.Chris HughesInternet Watch Foundation Hotline Director; described reporting and sharing payment information to disrupt commercial CSAM distribution.Chris UrbenManaging Director at Nardello & Co; described laundering networks' transition to cryptocurrency and recommended integrated intelligence collection.Corsin CamichelFounder of eCrime.ch; discussed ransomware targeting, fragmentation, and shared infrastructure dependencies.Gary WarnerDirector of Intelligence at DarkTower; reported tracking eight major Chinese-language Crime-as-a-Service groups on Telegram.Ronald SpektorIndicted in December 2025 for allegedly orchestrating a Coinbase customer service impersonation scam involving nearly $16 million.Seng Hok LingReceived a nearly five-year prison term for laundering cryptocurrency in the Zhimin Qian case.Tom KeatingeDirector at Centre for Finance & Security at RUSI; discussed laundering-network growth and gaps in law enforcement cryptocurrency capabilities.Will LyneHead of Economic & Cybercrime at the Metropolitan Police; discussed cryptocurrency fraud and investigative capabilities.Zhimin QianAlso known as Yadi Zhang; convicted in a cryptocurrency money laundering case involving an investment fraud affecting over 128,000 people.
Threat Actors
764Sadistic online extremism group described as targeting minors through sextortion, with resulting content monetized through cryptocurrency.Charming KittenIran-linked espionage and influence actor described as relying on commercial hosting, proxies, and compromised infrastructure.Cl0pReportedly exploited an Oracle E-Business Suite zero-day in enterprise extortion campaigns affecting hundreds of organizations.cvltSadistic online extremism group discussed in connection with sextortion of minors and overlap with CSAM subscription services.LockBitRansomware actor associated with hosting provider Zservers, which was sanctioned in February 2025.Prince GroupTransnational criminal organization sanctioned for cryptocurrency scams, laundering, and forced labor at scam compounds; prosecutors alleged industrial-scale fraud operations.Scattered SpiderThe report attributes the Marks & Spencer breach and resulting operational outages to this ransomware group.Smishing TriadReported alias of Darcula; Google's lawsuit alleged use of Lighthouse phishing software for government and toll-agency impersonation.Taihe GongChinese-speaking scamming group suspected of fraudulent cyber activity, including phishing-kit sales; purchased Lighthouse kits.
Malware
Aisurufacilitated botnets including Aisuru and Kimwolf, and how its infrastructure was leveraged by threat actorsKimwolffacilitated botnets including Aisuru and Kimwolf, and how its infrastructure was leveraged by threat actorsLumma Stealer● Microsoft’s disruption of the Russia-centric Lumma Stealer ecosystem further illustrates thisVolkLocker● In some cases, the introduction of strains like VolkLocker, notable for a cryptographic weakness
Vendors
Aeza Groupexample, OFAC sanctions in July against AEZA Group, a BPH provider linked to high-volume abuse,Chainalysisenforcement with off-chain information can still investigate these crimes using Chainalysis solutions. In cases where we're able toFunnull Technologyproviders Zservers, AEZA, and Yalishanda and IP infrastructure provider Funnull Technology demonstrate aIPIDEAOne notable case involved IPIDEA, a China-based residential proxy service advertising millions of proxyLighthouse“Lighthouse,” a Chinese-language vendor that offers cybercriminals "phishing for dummies," with hundredsMedia Land● In 2025, authorities sanctioned Media Land, LLC, also known as Yalishanda, a Russia-basedZserversransomware and related attacks. Likewise, the sanctioning in February of Zservers, a provider associated
Products
Chainalysis Alteryamule detection systems such as Chainalysis Alterya by financial institutions and cryptocurrencyChainalysis ReactorAs illustrated in the Chainalysis Reactor graph below, running point brokers function as routingOracle E-Business Suiteexample, Cl0p leveraged a zero-day exploit in Oracle E-Business Suite to orchestrate widespread
Tools
Countries
Cambodiacrime, Chen was arrested in Cambodia in January 2026 after his Cambodian citizenship was revoked inCanadaCanada, Europe, and elsewhere, and Chinese-language laundering services based in Southeast Asia.Chinathey are an unforeseen consequence of the imposition of capital controls in China. Wealthy individualsGermanyBelgium, Czechia, Germany, the Netherlands, Poland, and Spain shut down 24 industrial-scale “superlabs,”IranMeanwhile, over the past several years Iran's proxy networks have continued to facilitate moneyNorth KoreaNation-state threats drive record volumes: North Korea stealsRussiamore than ever, and Russia's A7A5 token facilitates large-scaleUnited KingdomTreasury in the UK, the Financial Crimes Enforcement Network (FinCEN)'s Final Rule designating HuioneUnited StatesDecember, and was subsequently extradited to China for investigation rather than to the United StatesVenezuelain Venezuela
Industries
Critical infrastructurevendors themselves, in addition to their advertising venues. These networks form the critical infrastructurefinance/professional servicesManufacturing and finance/professional services were the most heavily compromised in most of theseGovernmentcybercriminals and organized crime groups, government agencies and compliance and security teamsHealthcare● Healthcare providers remained lucrative targets. For example, kidney dialysis company DaVita Inc.Manufacturingpersists, and synthetic drug manufacturing remains a profitable alternative to agriculturally cultivatedRetailreal time. As adoption accelerates across both retail and institutional markets, the ability to interpret thatsupply chains and logisticsClaimed victims from critical infrastructure, supply chains and logistics, and government increased YoY by