Back to Blog

2025 Crypto Crime Report: Key Trends & On-Chain Data

Phalcon CompliancePhalcon SecurityMetaSleuth
February 27, 2026
3 min read
Key Insights

BlockSec has officially released the 2025 Crypto Crime Report.

This report looks at two key blockchain networks: Ethereum and Tron. It analyzes six main types of cryptocurrency-related crime.

  • Scams

  • Hacks and exploits

  • Terrorist financing

  • Human trafficking

  • Drug trafficking

  • Sanctions-related activity

Through quantitative assessment of illicit revenue, structural analysis of on-chain laundering pathways, and identification of risk concentration points, the report delivers a comprehensive examination of how cryptocurrency-enabled crime evolved in 2025.

By combining empirical on-chain data, case studies, and enforcement observations, the report provides professional reference material for:

  • Industry compliance teams

  • Regulators and law enforcement agencies

  • Exchanges and payment institutions

  • Research and consulting organizations

In a global environment characterized by tightening regulation and expanding on-chain transaction volume, the report seeks to answer three core questions:

  1. How has the scale of illicit funds changed?
  2. How have laundering pathways evolved?
  3. Where are the structural enforcement leverage points?

Core Research Findings of the Report

In 2025, transaction volume linked to sanctions jumped by almost $100 billion compared to the previous year. The main factor was the $70 billion transaction volume of the ruble-denominated stablecoin A7A5. This stablecoin aims to bypass traditional financial channels.

2. The $1.5 Billion Lazarus Strike & Layered Laundering

The Lazarus Group remains the most sophisticated threat actor, highlighted by their $1.5 billion exploit of Bybit in 2025. Their laundering strategy has become complex and tool-driven on Ethereum. Now, 20.1% of illicit funds are hidden through mixers like Tornado Cash.

3. Stablecoins: The $100B+ Enforceable Infrastructure

Stablecoins have moved from passive tools to active regulatory interfaces. In 2025, the scale of freezing activity reached a structural turning point. For example, adding entities like Huione Group to sanctions lists boosted traceable illicit flows by billions. This shows that stablecoin issuers can enforce rules at the contract level now.

4. Southeast Asia’s Industrialized Scam Economy

The scam ecosystem in Southeast Asia has become a fully industrialized "human supply chain." Huione Group made up about 2.73% of all scam-related funds on the TRON network. It acted as a key laundering node for organized crime.

5. The Financialization of Drug Trafficking on TRON

Drug trafficking has moved to on-chain networks. Most of this activity is on TRON because it has low transaction costs. These networks now use professional laundering methods that look like real financial services. They move money away from cash smuggling and toward stablecoin systems.

6. Identifying the 80% Concentration Leverage

Risk is not evenly distributed; it is highly concentrated. On the TRON network, over 80% of scam proceeds ultimately flow into a small number of centralized exchanges. This shows a big enforcement chance. By limiting key liquidity hubs, authorities can disrupt most illegal money-making.

Report Overview

This 36-page report is based on data analysis and on-chain evidence. It also includes breakdowns of common real-world cases. It shows the big picture of cryptocurrency crime in 2025. It covers the main features, structure, and trends in this field.

Target Audience:

  • Cryptocurrency Industry Professionals

  • Heads of Compliance and Risk Management

  • Exchanges and Payment Institutions

  • Regulatory and Law Enforcement Agencies

  • Research and Consulting Firms

The industry is facing stricter rules and more transparency. This report provides clear and useful research for all involved.

Fill out the form to download the full 2025 Crypto Crime Report (PDF).

Sign up for the latest updates
Newsletter - April 2026
Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly
Security Insights

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

This BlockSec weekly security report covers eight attack incidents detected between April 20 and April 26, 2026, across Ethereum, Avalanche, Sui, Base, HyperLiquid, and MegaETH, with total estimated losses of approximately $7.04M. The highlighted incident is the $1.3M GiddyDefi exploit, where the attacker did not break any cryptography or use a flash loan but simply replayed an existing on-chain EIP-712 signature with the unsigned `aggregator` and `fromToken` fields swapped out for a malicious contract, demonstrating how partial signature coverage turns any historical signature into a generic permit. Other incidents include a $3.5M Volo Vault operator key compromise on Sui, a $1.5M Purrlend privileged-role takeover, a $413K SingularityFinance oracle misconfiguration, a $142.7K Scallop cross-pool index injection, a $72.35K Kipseli Router decimal mismatch, a $50.7K REVLoans (Juicebox) accounting pollution, and a $64K Custom Rebalancer arbitrary-call exploit.

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Start Real-Time AML with Phalcon Compliance

Turn Phalcon Network alerts into actions with Phalcon Compliance. Use verified blockchain intelligence to screen wallets, monitor transactions and investigate risks. This helps you respond quickly and stay compliant in the digital assets ecosystem.

Phalcon Compliance

Get Real-Time Protection with Phalcon Security

Audits alone are not enough. Phalcon Security detects attacks in real time and blocks threats mid-flight.

phalcon security

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation