BlockSec Releases the 2025 Crypto Crime Report

BlockSec Releases the 2025 Crypto Crime Report

BlockSec has officially released the 2025 Crypto Crime Report.

This report looks at two key blockchain networks: Ethereum and Tron. It analyzes six main types of cryptocurrency-related crime.

  • Scams

  • Hacks and exploits

  • Terrorist financing

  • Human trafficking

  • Drug trafficking

  • Sanctions-related activity

Through quantitative assessment of illicit revenue, structural analysis of on-chain laundering pathways, and identification of risk concentration points, the report delivers a comprehensive examination of how cryptocurrency-enabled crime evolved in 2025.

By combining empirical on-chain data, case studies, and enforcement observations, the report provides professional reference material for:

  • Industry compliance teams

  • Regulators and law enforcement agencies

  • Exchanges and payment institutions

  • Research and consulting organizations

In a global environment characterized by tightening regulation and expanding on-chain transaction volume, the report seeks to answer three core questions:

  1. How has the scale of illicit funds changed?
  2. How have laundering pathways evolved?
  3. Where are the structural enforcement leverage points?

Core Research Findings of the Report

1. A $100 Billion Surge in Sanctions-Related Activity

In 2025, transaction volume linked to sanctions jumped by almost $100 billion compared to the previous year. The main factor was the $70 billion transaction volume of the ruble-denominated stablecoin A7A5. This stablecoin aims to bypass traditional financial channels.

2. The $1.5 Billion Lazarus Strike & Layered Laundering

The Lazarus Group remains the most sophisticated threat actor, highlighted by their $1.5 billion exploit of Bybit in 2025. Their laundering strategy has become complex and tool-driven on Ethereum. Now, 20.1% of illicit funds are hidden through mixers like Tornado Cash.

3. Stablecoins: The $100B+ Enforceable Infrastructure

Stablecoins have moved from passive tools to active regulatory interfaces. In 2025, the scale of freezing activity reached a structural turning point. For example, adding entities like Huione Group to sanctions lists boosted traceable illicit flows by billions. This shows that stablecoin issuers can enforce rules at the contract level now.

4. Southeast Asia’s Industrialized Scam Economy

The scam ecosystem in Southeast Asia has become a fully industrialized "human supply chain." Huione Group made up about 2.73% of all scam-related funds on the TRON network. It acted as a key laundering node for organized crime.

5. The Financialization of Drug Trafficking on TRON

Drug trafficking has moved to on-chain networks. Most of this activity is on TRON because it has low transaction costs. These networks now use professional laundering methods that look like real financial services. They move money away from cash smuggling and toward stablecoin systems.

6. Identifying the 80% Concentration Leverage

Risk is not evenly distributed; it is highly concentrated. On the TRON network, over 80% of scam proceeds ultimately flow into a small number of centralized exchanges. This shows a big enforcement chance. By limiting key liquidity hubs, authorities can disrupt most illegal money-making.

Report Overview

This 36-page report is based on data analysis and on-chain evidence. It also includes breakdowns of common real-world cases. It shows the big picture of cryptocurrency crime in 2025. It covers the main features, structure, and trends in this field.

Target Audience:

  • Cryptocurrency Industry Professionals

  • Heads of Compliance and Risk Management

  • Exchanges and Payment Institutions

  • Regulatory and Law Enforcement Agencies

  • Research and Consulting Firms

The industry is facing stricter rules and more transparency. This report provides clear and useful research for all involved.

Fill out the form to download the full 2025 Crypto Crime Report (PDF).

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

During the week of February 9 to February 15, 2026, three blockchain security incidents were reported with total losses of ~$657K. All incidents occurred on the BNB Smart Chain and involved flawed business logic in DeFi token contracts. The primary causes included an unchecked balance withdrawal from an intermediary contract that allowed donation-based inflation of a liquidity addition targeted by a sandwich attack, a post-swap deflationary clawback that returned sold tokens to the caller while draining pool reserves to create a repeatable price-manipulation primitive, and a token transfer override that burned tokens directly from a Uniswap V2 pair's balance and force-synced reserves within the same transaction to artificially inflate the token price.

Top 10 "Awesome" Security Incidents in 2025

Top 10 "Awesome" Security Incidents in 2025

To help the community learn from what happened, BlockSec selected ten incidents that stood out most this year. These cases were chosen not only for the scale of loss, but also for the distinct techniques involved, the unexpected twists in execution, and the new or underexplored attack surfaces they revealed.

#9 1inch Incident: From Calldata Corruption to Forged Settlement: Binary Exploitation Goes On-Chain

#9 1inch Incident: From Calldata Corruption to Forged Settlement: Binary Exploitation Goes On-Chain

On March 5, 2025, a third-party resolver integrated with 1inch Fusion V1 was exploited for over $5M after an unsafe calldata reconstruction in the settlement flow allowed attacker-controlled interaction lengths to trigger a pointer underflow and inject forged settlement data. The impact was amplified by a broken trust boundary, where resolver contracts treated forwarded calldata as authoritative based only on msg.sender, letting attacker-crafted payloads inherit settlement-level privileges while still passing access control.