Sanctions evasion dominated illicit cryptocurrency-related finance last year, with state actors such as Russia, Iran and North Korea driving a surge in activity, Chainalysis said in a Thursday report.
Sanctioned entities received at least $104 billion in cryptocurrency, a nearly eight-fold increase from 2024, bringing total illicit on-chain volume to a record $154 billion. The findings show how heavily sanctioned states are integrating cryptocurrencies into national financial strategies to bypass traditional banking systems.
The Chainalysis report follows a similar study by TRM Labs, which in February said illicit entities received $141 billion in stablecoins, the highest level seen in five years. Sanctions-related activity accounted for 86% of flows, primarily in stablecoins, TRM said. About 50% of the total, $72 billion, was pegged to the Kyrgyzstan-registered A7A5 token, a stablecoin pegged to the ruble.
Chainalysis’ 88-page report also named A7A5 as a major player, saying it processed $93.3 billion in transactions in less than a year, serving as a settlement avenue for sanctioned Russian companies to conduct cross-border trade. The token is linked to exchanges Grinex and Meer, which handled billions in transactions before being sanctioned by the United States and the European Union.
Chainalysis identified a “A7A5 Instant Swapper” service that converts the token into dollar-pegged stablecoins with little to no know-your-customer (KYC) verifications. The service has processed more than $2.2 billion so far, effectively allowing sanctioned entities to connect to the broader crypto economy, he said.
“These statements from Chainalysis are not new to us. They are politically motivated by Western countries,” Oleg Ogienko, director of regulatory and external affairs at A7A5, told Coindesk via Telegram. “We mainly provide payment methods for Russian export and import operations. It is absolutely legal and complies with the legislation of Russia, Kyrgyzstan and the legislation of other countries that are trading partners of Russia.”
A7A5 has state-of-the-art KYC and anti-money laundering (AML) controls and processes, meeting regulatory requirements, it said. Furthermore, the ruble-pegged stablecoin is not mentioned in any of the Financial Action Task Force (FATF) global reports.
Iran also expanded its use of cryptocurrencies. Addresses linked to the Islamic Revolutionary Guard Corps (IRGC), designated a terrorist organization by the United States, the EU and other jurisdictions, accounted for more than 50% of the value received by Iranian services by the end of 2025, moving more than $3 billion linked to regional networks of indirect financing, oil trading and procurement.
North Korea remained the most prolific cyber theft actor, according to Chainalysis, stealing more than $2 billion in cryptocurrency in 2025, including $1.5 billion from a Bybit hack, the largest digital asset theft ever recorded.
The report also highlights a structural change in cryptocrime. Stablecoins now account for approximately 84% of illicit transaction volume, reflecting how sanctioned actors increasingly rely on liquid dollar-pegged assets to move funds across borders.
