New data from blockchain analytics firm TRM Labs shows illicit actors moved roughly $141 billion through stablecoins in 2025—the highest annual tally in five years. The report, issued this week, cautions that the uptick does not signal a broad acceleration in crypto-enabled crime, but rather a deeper reliance on stablecoins for activity where speed, liquidity, and cross-border movement offer clear operational advantages. The analysis highlights sanctions-linked networks and large-money-movement services as the dominant channels for these flows, underscoring how stablecoins have become a preferred rails for moving value outside traditional financial controls.

According to the TRM study, sanctions-related activity accounted for a staggering 86% of all illicit crypto flows in 2025. Of the $141 billion in stablecoin activity, roughly half—about $72 billion—was tied specifically to a ruble-pegged token known as A7A5, whose operations are almost entirely concentrated within sanctioned ecosystems. The institutional emphasis on these tokens points to a striking trend: stablecoins are not merely a tool for everyday commerce but a specialized infrastructure supporting state-linked evasion and enforcement-evading finance.

Beyond the A7A5 concentration, the report notes that Russian-linked networks intersect with other state-backed ecosystems, including actors connected to China, Iran, North Korea, and Venezuela. In TRM’s words, these findings illuminate how stablecoins have evolved into connective infrastructure for sanctioned actors seeking to move value outside conventional financial controls. This interlocking web raises questions for regulators and financial institutions about how to monitor cross-border flows that ride the rails of stablecoins—even when the majority of legitimate activity remains robust and mainstream.

On the demand side, the report draws attention to the way illicit marketplaces deploy stablecoins in perimeter markets. While scams, ransomware, and hacking still occur, those activities tend to stage their crypto use in multiple steps, often beginning with Bitcoin (CRYPTO: BTC) or other crypto assets, before shifting to stablecoins later in the laundering sequence. The research also identifies categories such as illicit goods and services and human trafficking as showing “near-total stablecoin usage,” suggesting operators prioritize payment certainty and liquidity over potential price appreciation. In practical terms, this means stablecoins provide predictable settlement rails that are less sensitive to price volatility, a feature that illicit networks value highly when moving funds across jurisdictions.

Volume in guarantee marketplaces—digital platforms that facilitate risk-sharing or settlement for illicit services—surged to more than $17 billion by late 2025, with most activity denominated in stablecoins. TRM argues that because roughly 99% of this volume is settled in stablecoins, these platforms function more as laundering infrastructure than speculative venues. The implication is that stablecoins have become a preferred vehicle for moving large sums with speed and liquidity, even if much of the activity occurs outside legitimate markets. The report also notes that the role of stablecoins in such ecosystems is not a sign of crypto’s inherent criminality, but rather a signal about the ways illicit actors adapt to enforcement regimes and capital controls.

Corroborating the broader picture, Chainalysis has previously highlighted a rise in crypto flows to suspected human trafficking networks, reporting an 85% year-over-year increase in 2025. In that analysis, international escort services and prostitution networks were noted to operate almost entirely on stablecoins, reflecting demand for payment certainty in illicit networks as well as a preference for cross-border liquidity. These findings reinforce the TRM Labs assessment that stablecoins serve as the backbone of value transfer for several high-risk activities, even as the sector as a whole remains far larger and more diverse than illicit use patterns would suggest.

From the perspective of scale, TRM Labs observed that total stablecoin activity exceeded $1 trillion in monthly transaction volume on multiple occasions in 2025. By extrapolating from these monthly bursts, the study estimates approximately $12 trillion in annual stablecoin activity, implying illicit use accounts for around 1% of the total. That proportion stands alongside global estimates from the United Nations Office on Drugs and Crime, which place money laundering at roughly 2% to 5% of global GDP—an amount roughly in the $800 billion to $2 trillion range. The juxtaposition of these figures underscores a persistent tension: stablecoins are pervasive in legitimate finance while simultaneously enabling sophisticated illicit networks that regulators continue to scrutinize. The findings come amid ongoing policy discussions about how best to balance innovation with robust compliance and risk controls, particularly as sanctions regimes evolve and enforcement benchmarks tighten.

In context, the TRM report adds momentum to a broader industry debate about how to enforce sanctions and combat illicit finance without stifling legitimate use. The intertwining of sanctioned actors with state-linked and non-state networks, as described by TRM, points to the need for enhanced on-chain analytics, cross-border collaboration, and more granular controls on stablecoin issuance and settlement. While the vast majority of stablecoin activity remains legitimate, the visibility of the illicit segment—especially in high-value sanctions-related flows—signals that both policymakers and market participants should pay closer attention to the liquidity and settlement rails that crypto ecosystems have become. The report’s findings are a reminder that, for good or bad, stablecoins occupy a central role in modern finance, shaping how value moves across borders even as regulators adapt to a rapidly evolving digital landscape.

Why it matters

The TRM Labs findings illuminate a nuanced reality for crypto markets and policymakers. Stablecoins have matured into a core settlement layer that supports everyday commerce but also serves as a critical infrastructure for illicit finance during sanctions crises. For cryptocurrency exchanges, wallet providers, and fintechs, the report underscores the importance of implementing robust sanctions screening and address-level risk assessments, especially for counterparties with ties to sanctioned economies or gray-market corridors. The concentration of illicit activity in a handful of stablecoins also highlights the need for precise tagging, traceability, and real-time monitoring to deter misuse while preserving legitimate liquidity and cross-border payments.

For regulators, the data underscore the limits of traditional financial controls when confronted with borderless digital rails. The stability and speed of stablecoins offer undeniable advantages for legitimate commerce, remittances, and cross-border trade, but they also create friction for enforcement. The TRM analysis reinforces calls for clearer stablecoin‑related disclosure, standardized compliance frameworks, and international cooperation to address sanctions evasion without inadvertently curbing innovation. Investors and builders can glean that the risk landscape remains dynamic: reputational and regulatory risk around stablecoins can shift rapidly as enforcement priorities evolve and new tools emerge to monitor on-chain behavior.

For users and the broader market, the message is twofold. First, illicit use represents a relatively small share of overall stablecoin activity, but its visibility matters because it intersects with sanctions policy and macroeconomic stability. Second, the events of 2025 demonstrate how quickly stablecoin liquidity can be redirected toward restricted channels when governance gaps or enforcement actions fail to keep pace with innovation. The ongoing dialogue between analytics firms, policymakers, and industry participants will shape how stablecoins evolve—from mere payment rails to potential risk vectors requiring more rigorous risk management and governance standards.

What to watch next

• Further methodology updates and breakdowns from TRM Labs detailing which stablecoins and sanction-related corridors dominate illicit flows.
• Regulatory responses and enforcement actions tied to sanctioned networks identified in the report, including cross-border cooperation and sanctions-compliance initiatives.
• Monitoring of stablecoin issuance and circulation patterns as policymakers consider stricter controls or new compliance requirements for issuers and custodians.
• Ongoing research from Chainalysis and other firms on the role of stablecoins in human trafficking networks to assess whether new tracking tools reduce illicit activity over time.
• Regulatory developments related to sanctions packages and related crypto-exposure rules in jurisdictions highlighted by the report.

Sources & verification

• TRM Labs, Stablecoins at Scale: Broad Adoption and Highly Concentrated Illicit Networks (official blog)
• Sanctions-related activity accounted for 86% of illicit crypto flows in 2025 (Cointelegraph article)
• Russia-linked networks and the EU sanctions package context (Cointelegraph article)
• Tether challenges report on illicit activity involving USDT (Cointelegraph article)
• Chainalysis report on crypto use in human trafficking networks
• UNODC money laundering overview

Illicit stablecoins: sanctions networks and laundering rails

Illicit actors moved an estimated $141 billion through stablecoins in 2025, reflecting a shift in how sanctioned operations leverage digital rails to bypass traditional financial controls. In the study’s framing, sanctions-related activity dominates the illicit crypto landscape, signaling that enforcement regimes are shaping the channels through which criminal actors move funds. The data show a pronounced concentration around a ruble-pegged stablecoin known as A7A5, with about $72 billion of the total tied to this single asset. This clustering hints at a specialized ecosystem where asset choice aligns with the operational requirements of sanctioned networks, rather than with speculative profit-seeking behavior.

Within this ecosystem, the report highlights networks that blur geographic boundaries—Russia-linked actors intersecting with spheres connected to China, Iran, North Korea, and Venezuela. The analysis underscores how stablecoins have become connective fabric for sanctioned actors seeking to move value beyond conventional controls, reinforcing stability in cross-border transfers while complicating enforcement. In parallel, the data point to a broader pattern: illicit activity in the realm of sanctions and large-scale money movement dominates the illicit use of stablecoins, even as other categories rely increasingly on these digital rails for liquidity and certainty of settlement.

On legitimate terms, stablecoins continue to support a wide range of uses, including remittance and cross-border payments, with total stablecoin activity surpassing $1 trillion in monthly volume on multiple occasions in 2025. If one projects the annual scale, the figure nears $12 trillion, of which the illicit portion—ranging around 1%—belongs to highly regulated, high-risk activity tied to sanctions and related networks. The United Nations Office on Drugs and Crime’s own estimates place global money laundering at 2%–5% of GDP, which aligns with the broader recognition that illicit finance persists at scale despite improvements in detection and policing. These numbers collectively illustrate a crypto environment that is large, interconnected, and continually adjusting to enforcement pressures and policy shifts.

The picture is nuanced: the same rails that power legitimate payments and global commerce also offer resilience and speed that illicit actors have learned to exploit. As policymakers and market participants absorb these insights, the path forward involves targeted improvements in monitoring, reporting, and cross-border information sharing to mitigate risk without stifling the legitimate benefits of stablecoins. The ongoing dialogue among analytics firms, regulators, and the crypto industry will shape the contours of stablecoin adoption in the years ahead, balancing innovation with the imperative of robust AML/CFT controls.