Crypto fraud and theft in 2025: what the major reports show

Two of the industry's leading blockchain analytics firms, Chainalysis and TRM Labs, each published an annual crypto crime report in early 2026 covering calendar year 2025. Both describe a record dollar total for illicit activity, both point to sanctions evasion and stablecoins as the biggest drivers, and both put the figure above $150 billion, though the two totals don't match exactly because the firms measure illicit activity differently.

What the two reports found

Figures are drawn from reporting on each firm's 2026 report (Chainalysis coverage, The Block; TRM Labs coverage, The Block; Decrypt). Where coverage of the same report gave different numbers, we've noted the range rather than picking one.

Reading the two reports side by side

Neither report is more "correct" than the other; they're built from different proprietary datasets, different address-attribution methods and, in places, different definitions of what counts as illicit at all. Chainalysis's figures lean on its own long-running blockchain attribution database and tend to be cited most often by regulators and exchanges; TRM Labs' figures, including its newer liquidity-based metric measuring illicit actors' share of available market liquidity rather than raw transaction volume, offer a different lens on the same underlying activity. Reading both, rather than picking one as definitive, gives a more complete picture than either report alone, which is why this piece cites both throughout rather than defaulting to a single source.

Sanctions evasion is now the single biggest driver

Chainalysis found that sanctioned entities moved roughly $104 billion through crypto in 2025, an increase of 694% year over year, making it by far the largest contributor to the overall illicit total. That's a different kind of activity to the fraud and theft that affects individual crypto holders directly, but it matters for the same reason: it's the clearest sign yet that sanctioned states and entities are treating crypto, and especially stablecoins, as a working channel for moving value at scale, not a marginal one.

What the 2025 figures don't capture

Both reports measure what can be observed and attributed on-chain, which means both likely undercount the true total. Funds never reported, fraud victims who never file a report, and sophisticated laundering that successfully obscures its own origin all fall outside what any blockchain analytics firm can count, however good its methodology. That's not a criticism of either report; it's a structural limit of measuring activity on a public ledger using known patterns and known bad actors, and it's worth remembering when a headline figure is presented as a precise, complete total rather than a well-evidenced floor.

Theft: still dominated by one actor

Both firms' theft figures point to the same pattern: North Korea-linked groups account for most of the crypto stolen through hacks. Chainalysis attributed roughly 59% of 2025's $3.4 billion in theft to North Korea, consistent with a separate earlier figure it reported of about $2 billion stolen by North Korean hackers in 2025, including the $1.5 billion Bybit breach. North Korea and the rise of state-sponsored crypto theft covers this pattern across several major incidents, including the Bybit and Ronin Bridge hacks and the recent Binance breach.

Fraud: investment fraud dominates

TRM Labs' $35 billion fraud-inflow figure is the larger of the two, and its breakdown is telling: investment fraud, including pig butchering, and Ponzi schemes together made up about 62% of that total. TRM also described these operations as increasingly organised, with the specialisation and business-like structure of a professional enterprise rather than a single opportunist. Pig butchering by the numbers goes further into this category specifically, including how it connects to the fake withdrawal-fee pattern our own investigators see.

Why stablecoins dominate both measures

Both firms converge on roughly the same figure from two different angles: Chainalysis found stablecoins made up 84% of all illicit transaction volume, and TRM found the same 84% share of fraud inflows specifically. Why USDT shows up in almost every fraud case we trace explains why: price stability and liquidity across exchanges make stablecoins the practical choice for both operators moving stolen funds and fraud victims being told to pay in crypto.

Money laundering is growing faster than any single category

Underneath the headline totals, Chainalysis also tracked the broader laundering ecosystem that moves illicit funds, from any source, into usable form. That ecosystem grew from roughly $10 billion in 2020 to more than $82 billion in 2025, an eightfold increase in five years. Chinese-language money laundering networks are reported as a central part of that growth, though the exact figure attributed to them specifically varies across coverage of the same report, with one source citing $16.1 billion for Chinese-language networks and another describing them as tied to the full $82 billion figure; we'd treat the larger figure as covering laundering broadly and the $16.1 billion as a narrower slice within it, though neither Chainalysis's own report language nor the secondary coverage fully resolves the discrepancy.

This laundering growth matters beyond the headline sanctions and fraud numbers because it describes the infrastructure, the networks, services and routes, that both state actors and ordinary fraud operators rely on to turn stolen or fraud-derived crypto into something they can actually use. A bigger laundering ecosystem means more capacity and more routes available to any given fraud operation, not just the largest state-backed ones.

Beyond fraud and theft: violence and trafficking

Chainalysis's 2026 research also pointed to crypto crime spilling into physical harm in ways that go beyond on-chain fraud. A mid-2026 Chainalysis blog post found that violent "wrench attack" crypto robberies, where someone is physically coerced into handing over wallet access, topped $30 million in the first half of 2026 alone, with France emerging as a particular hotspot. Separately, a Chainalysis-sourced analysis found crypto flows tied to suspected human trafficking rose 85% year over year. Neither figure is part of the headline $154 billion illicit-volume total, but both are a reminder that the consequences of crypto crime aren't purely financial, and that the same tracing techniques used to follow fraud proceeds are also being applied to these categories.

Why two respected firms don't agree exactly

It's worth being upfront about why Chainalysis's $154 billion and TRM Labs' $158 billion don't match, rather than treating the gap as an error in either report. The two firms use different methodologies for classifying which wallets and transactions count as illicit, different data sources for identifying sanctioned or criminal addresses, and in some cases different definitions of what counts as "fraud" versus "fraud-adjacent" activity versus theft. TRM's $35 billion fraud-inflow figure, for instance, is measuring something broader than Chainalysis's $17 billion fraud-loss figure, which is part of why the two numbers differ by a factor of two rather than being a simple rounding difference. Treating both figures as directionally consistent, rather than precisely reconcilable, is the more honest way to read them.

A record year that's still a small share

It's worth holding both facts at once: 2025 was a record dollar year for illicit crypto activity by both firms' counts, and illicit activity remained a small fraction of total crypto activity, under 1% by Chainalysis's measure and 1.2% by TRM's. TRM specifically noted that this share actually fell slightly from 1.3% in 2024, because legitimate crypto use grew faster than illicit use did. Scale and share can move in opposite directions at the same time, and both numbers matter for understanding what's actually happening.

What this means if you're reading the headlines

Headlines built from reports like these tend to lead with the biggest single number, which in 2025 was driven mostly by sanctions evasion, a category that has little to do with the individual fraud cases most people searching for this kind of information have actually experienced. If you've lost crypto to a fake investment platform or a withdrawal-fee demand, the more relevant figures are the fraud-specific ones: TRM's $35 billion fraud-inflow total, the 62% share from investment fraud and Ponzi schemes, and the consistent 84% stablecoin involvement across both firms' measures. Pig butchering by the numbers and why USDT shows up in almost every fraud case we trace go deeper into exactly those two figures.

Key takeaways

• Both major 2026 annual reports put 2025 illicit crypto volume above $150 billion, a record, though the two totals differ because the firms measure illicit activity differently.
• Sanctions evasion, not theft or fraud, was the single largest driver of the increase.
• The broader money-laundering ecosystem grew roughly eightfold between 2020 and 2025.
• Investment-type fraud, including pig butchering, made up the majority of fraud losses specifically.
• Stablecoins were involved in roughly 84% of illicit volume by both firms' measures.
• Illicit activity's share of total crypto activity stayed under 1.5%, and by one measure it actually declined slightly.

Further reading

• North Korea and the rise of state-sponsored crypto theft
• Pig butchering by the numbers
• Why USDT shows up in almost every fraud case we trace
• Inside the Binance hack: what's confirmed so far
• How tracing works
• Start a free assessment if you believe you've lost funds to any of the patterns described here.