Sanctions evasion dominated crypto-related illicit finance last year, with state actors including Russia, Iran and North Korea driving a surge in activity, Chainalysis said in a Thursday report.

Sanctioned entities received at least $104 billion in cryptocurrency, an almost eightfold increase on 2024, pushing total illicit onchain volume to a record $154 billion. The findings show how heavily sanctioned states are integrating cryptocurrency into national financial strategies to bypass traditional banking systems.

Chainalysis’ report follows a similar study by TRM Labs, which in February said illicit entities received $141 billion in stablecoins, the highest level observed in five years. Sanctions-related activity accounted for 86% of the flows, mostly in stablecoins, TRM said. About 50% of the total, $72 billion, was linked to the Kyrgyzstan-registered A7A5 token, a ruble-pegged stablecoin.

Chainalysis’ 88-page report also named A7A5 as a major participant, saying it processed $93.3 billion in transactions in less than a year, functioning as a settlement rail for sanctioned Russian businesses to conduct cross-border trade. The token is linked to exchanges Grinex and Meer, which handled billions in transactions before being sanctioned by the U.S. and European Union.

Chainalysis identified an “A7A5 Instant Swapper” service that converts the token into mainstream dollar-pegged stablecoins with few or no know-your-customer (KYC) checks. The service has processed more than $2.2 billion so far, effectively allowing sanctioned entities to bridge into the broader crypto economy, it said.

“These Chainalysis statements are not new for us. They are politically motivated by Western countries,” Oleg Ogienko, A7A5’s director for regulatory and overseas affairs, told Coindesk via Telegram. “We mainly provide payment rails extensively for Russian export and import operations. It is absolutely legal and compliant with the legislation of Russia, Kyrgyzstan and the legislation of other countries who are trade partners of Russia.”

A7A5 has state-of-the-art KYC and anti-money laundering (AML) controls and processes in place, complying with regulatory requirements, he said. Moreover, the ruble-pegged stablecoin is not mentioned in any of the global Financial Action Task Force (FATF) reports.

Iran also expanded its crypto use. Addresses tied to the Islamic Revolutionary Guard Corps (IRGC), designated a terrorist organization by the U.S, EU and other jurisdictions, accounted for more than 50% of value received by Iranian services by late 2025, moving over $3 billion tied to regional proxy financing, oil trade and procurement networks.

North Korea remained the most prolific cyber-theft actor, according to Chainalysis, stealing more than $2 billion in cryptocurrency in 2025, including $1.5 billion from a hack of Bybit, the largest digital asset theft ever recorded.

The report also highlights a structural shift in crypto crime. Stablecoins now account for roughly 84% of illicit transaction volume, reflecting how sanctioned actors increasingly rely on liquid, dollar-pegged assets to move funds across borders.