Russia-Linked Crypto Activity Drove Illicit Wallet Inflows to a 5-Year High in 2025: TRM Labs

Russia-aligned crypto activity surged even as illicit transactions fell to just 1.2% of total on-chain volume in 2025.

Illicit cryptocurrency activity rebounded sharply in 2025, driven primarily by Russia-linked sanctions designations and improved attribution. A new report by TRM Labs estimates that fraudulent wallets received approximately $158 billion in incoming value during the year, which is the highest level recorded over the past five years.

The increase is a dramatic reversal from 2024, when illicit inflows fell to $64.5 billion, following a steady multi-year decline from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023.

Sanctions, Stablecoins, and State Strategy

TRM Labs attributed the 2025 surge not only to intensified enforcement actions but also to expanded use of cryptocurrency by nation-state actors and technological advances that enabled the identification of previously unattributed illicit volumes. The most significant shift was concentrated in sanctions-linked activity tied overwhelmingly to Russia, as volumes associated with sanctioned entities and jurisdictions rose sharply.

The A7A5 token alone accounted for an estimated $72 billion in incoming value, followed by $39 billion linked to the A7 wallet cluster, with the majority of this activity connected to Russia-linked actors, including Garantex, Grinex, and A7.

The blockchain intelligence firm stated that the increase does not reflect sanctions evasion growth alone, but rather the combination of new sanctions designations targeting large entities and improved attribution of cryptocurrency addresses to actors that had already been sanctioned.

Among these, A7 emerged as a central node and functioned as a centrally coordinated sanctions evasion architecture tied to Russian state interests. On-chain activity analyzed by TRM indicates that A7 operates as a hub linking Russia-aligned actors with counterparties across China, Southeast Asia, and Iran-linked networks, in a major pivot toward crypto-enabled, state-aligned financial infrastructure.

While the A7 wallet cluster is closely associated with sanctions evasion activity, the A7A5 token supports a wider push to reduce reliance on USD-based financial systems through the expansion of a ruble-pegged stablecoin. As a result, the high transaction volumes linked to A7A5 do not exclusively represent sanctions evasion, but sanctioned activity more broadly, including state-aligned economic flows.

You may also like:

• North Korea, Russia, and Stablecoins Fuel $154B Illicit Crypto Surge: Chainalysis
• Report: How Nations Are Reshaping Global Finance with Crypto
• Russia Targets Underground Crypto Miners With Draft Law Introducing Jail Terms

Fraudulent Crypto Grows

Zooming out from sanctions-related activity, the firm also revealed that overall illicit crypto inflows rose to an all-time high in 2025, even as such activity accounted for a smaller share of the crypto ecosystem. Measured as a proportion of total attributed on-chain volume, illicit activity declined slightly to 1.2% in 2025 from 1.3% in 2024, and remained well below the 2.4% peak recorded in 2023.

A similar pattern was observed when illicit activity was assessed relative to incoming liquidity, as illicit entities received 2.7% of incoming VASP flows in 2025, compared with 2.9% in 2024 and 6.0% in 2023. TRM Labs said these metrics indicate that while certain illicit categories expanded significantly in absolute terms, illicit actors absorbed a smaller proportion of new capital entering the crypto ecosystem.