Illicit financial activity related to cryptocurrencies last year was dominated by sanctions evasion, with state actors such as Russia, Iran and North Korea driving a surge in activity, Chainaanalysis said in a report on Thursday.
Sanctioned entities received at least $104 billion in cryptocurrency, an almost eight-fold increase from 2024, pushing total illicit on-chain transaction volume to a record $154 billion. The findings show how countries under severe sanctions are integrating cryptocurrencies into national financial strategies to bypass traditional banking systems.
Chainaanalysis’ report follows a similar study by TRM Labs, which said in February that illegal entities received $141 billion in stablecoins, the highest level in five years. TRM said sanctions-related activity accounted for 86% of traffic, with the majority being stablecoins. About 50% of that ($72 billion) is tied to Kyrgyzstan-registered A7A5 tokens, a ruble-pegged stablecoin.
Chainaanalysis’s 88-page report also named A7A5 as a major player, saying it processed $93.3 billion in transactions in less than a year and served as a settlement conduit for cross-border trade by sanctioned Russian companies. The token is linked to the Grinex and Meer exchanges, which processed billions of dollars in transactions before being sanctioned by the United States and the European Union.
Chainaanalysis identified an “A7A5 Instant Swapper” service that converts tokens into mainstream USD-pegged stablecoins with little or no know-your-customer (KYC) checks. To date, the service has processed over $2.2 billion, effectively allowing sanctioned entities to integrate into the broader crypto economy.
“These statements by Chainaanalysis are not new to us. They are politically motivated by Western countries,” Oleg Ogienko, director of regulatory and overseas affairs at A7A5, told Coindesk via Telegram. “We mainly provide a wide range of payment channels for Russian import and export businesses. This is absolutely legal and in line with the legislation of Russia, Kyrgyzstan, and Russia’s other trading partner countries.”
He said A7A5 has state-of-the-art KYC and anti-money laundering (AML) controls and processes that comply with regulatory requirements. Additionally, ruble-pegged stablecoins are not mentioned in any global Financial Action Task Force (FATF) report.
Iran has also expanded its use of cryptocurrencies. By the end of 2025, addresses associated with the Islamic Revolutionary Guard Corps (IRGC), which is designated a terrorist organization by the United States, the European Union and other jurisdictions, accounted for more than 50% of the value received for services in Iran, with more than $3 billion associated with regional agency financing, oil trading and procurement networks.
North Korea remains the most prolific actor of cyber theft, stealing more than $2 billion in cryptocurrency in 2025, including $1.5 billion from the Bybit hack, the largest digital asset theft in history, according to Chainaanalysis.
The report also highlights tectonic shifts in cryptocurrency crime. Stablecoins currently account for approximately 84% of illicit trading volume, reflecting sanctioned players’ increasing reliance on liquid, dollar-pegged assets to move funds across borders.
