BlockSec Releases the 2025 Crypto Crime Report

BlockSec Releases the 2025 Crypto Crime Report

BlockSec has officially released the 2025 Crypto Crime Report.

This report looks at two key blockchain networks: Ethereum and Tron. It analyzes six main types of cryptocurrency-related crime.

  • Scams

  • Hacks and exploits

  • Terrorist financing

  • Human trafficking

  • Drug trafficking

  • Sanctions-related activity

Through quantitative assessment of illicit revenue, structural analysis of on-chain laundering pathways, and identification of risk concentration points, the report delivers a comprehensive examination of how cryptocurrency-enabled crime evolved in 2025.

By combining empirical on-chain data, case studies, and enforcement observations, the report provides professional reference material for:

  • Industry compliance teams

  • Regulators and law enforcement agencies

  • Exchanges and payment institutions

  • Research and consulting organizations

In a global environment characterized by tightening regulation and expanding on-chain transaction volume, the report seeks to answer three core questions:

  1. How has the scale of illicit funds changed?
  2. How have laundering pathways evolved?
  3. Where are the structural enforcement leverage points?

Core Research Findings of the Report

1. A $100 Billion Surge in Sanctions-Related Activity

In 2025, transaction volume linked to sanctions jumped by almost $100 billion compared to the previous year. The main factor was the $70 billion transaction volume of the ruble-denominated stablecoin A7A5. This stablecoin aims to bypass traditional financial channels.

2. The $1.5 Billion Lazarus Strike & Layered Laundering

The Lazarus Group remains the most sophisticated threat actor, highlighted by their $1.5 billion exploit of Bybit in 2025. Their laundering strategy has become complex and tool-driven on Ethereum. Now, 20.1% of illicit funds are hidden through mixers like Tornado Cash.

3. Stablecoins: The $100B+ Enforceable Infrastructure

Stablecoins have moved from passive tools to active regulatory interfaces. In 2025, the scale of freezing activity reached a structural turning point. For example, adding entities like Huione Group to sanctions lists boosted traceable illicit flows by billions. This shows that stablecoin issuers can enforce rules at the contract level now.

4. Southeast Asia’s Industrialized Scam Economy

The scam ecosystem in Southeast Asia has become a fully industrialized "human supply chain." Huione Group made up about 2.73% of all scam-related funds on the TRON network. It acted as a key laundering node for organized crime.

5. The Financialization of Drug Trafficking on TRON

Drug trafficking has moved to on-chain networks. Most of this activity is on TRON because it has low transaction costs. These networks now use professional laundering methods that look like real financial services. They move money away from cash smuggling and toward stablecoin systems.

6. Identifying the 80% Concentration Leverage

Risk is not evenly distributed; it is highly concentrated. On the TRON network, over 80% of scam proceeds ultimately flow into a small number of centralized exchanges. This shows a big enforcement chance. By limiting key liquidity hubs, authorities can disrupt most illegal money-making.

Report Overview

This 36-page report is based on data analysis and on-chain evidence. It also includes breakdowns of common real-world cases. It shows the big picture of cryptocurrency crime in 2025. It covers the main features, structure, and trends in this field.

Target Audience:

  • Cryptocurrency Industry Professionals

  • Heads of Compliance and Risk Management

  • Exchanges and Payment Institutions

  • Regulatory and Law Enforcement Agencies

  • Research and Consulting Firms

The industry is facing stricter rules and more transparency. This report provides clear and useful research for all involved.

Fill out the form to download the full 2025 Crypto Crime Report (PDF).

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Mar 2 – Mar 8, 2026

Weekly Web3 Security Incident Roundup | Mar 2 – Mar 8, 2026

During the week of March 2 to March 8, 2026, seven blockchain security incidents were reported with total losses of ~$3.25M. The incidents occurred across Base, BNB Chain, and Ethereum, exposing critical vulnerabilities in smart contract business logic, token deflationary mechanics, and asset price manipulation. The primary causes included a double-minting logic flaw during full token deposits that allowed an attacker to exponentially inflate their balances through repeated burn-and-mint cycles, a price manipulation vulnerability in an AMM-based lending market where artificially inflated vault shares created divergent price anchors to incorrectly force healthy positions into liquidation, and a flawed access control implementation relying on trivially spoofed contract interfaces that enabled attackers to bypass authorization to batch-mint and dump arbitrary tokens.

Weekly Web3 Security Incident Roundup | Feb 23 – Mar 1, 2026

Weekly Web3 Security Incident Roundup | Feb 23 – Mar 1, 2026

During the week of February 23 to March 1, 2026, seven blockchain security incidents were reported with total losses of ~$13M. The incidents affected multiple protocols, exposing critical weaknesses in oracle design/configuration, cryptographic verification, and core business logic. The primary drivers included oracle manipulation/misconfiguration that led to the largest loss at YieldBloxDAO (~$10M), a crypto-proof verification flaw that enabled the FOOMCASH (~$2.26M) exploit, and additional token design and logic errors impacting Ploutos, LAXO, STO, HedgePay, and an unknown contract, underscoring the need for rigorous audits and continuous monitoring across all protocol layers.

Newsletter -  February 2026

Newsletter - February 2026

February 2026 saw three major DeFi security incidents: YieldBlox DAO lost ~$10M due to oracle price manipulation, IoTeX’s ioTube bridge suffered ~$4.4M from a private key compromise, and CrossCurve incurred ~$2.8M after a cross-chain validation bypass.