Back to Blog

BlockSec Releases the 2025 Crypto Crime Report

Phalcon CompliancePhalcon SecurityMetaSleuth
February 27, 2026

BlockSec has officially released the 2025 Crypto Crime Report.

This report looks at two key blockchain networks: Ethereum and Tron. It analyzes six main types of cryptocurrency-related crime.

  • Scams

  • Hacks and exploits

  • Terrorist financing

  • Human trafficking

  • Drug trafficking

  • Sanctions-related activity

Through quantitative assessment of illicit revenue, structural analysis of on-chain laundering pathways, and identification of risk concentration points, the report delivers a comprehensive examination of how cryptocurrency-enabled crime evolved in 2025.

By combining empirical on-chain data, case studies, and enforcement observations, the report provides professional reference material for:

  • Industry compliance teams

  • Regulators and law enforcement agencies

  • Exchanges and payment institutions

  • Research and consulting organizations

In a global environment characterized by tightening regulation and expanding on-chain transaction volume, the report seeks to answer three core questions:

  1. How has the scale of illicit funds changed?
  2. How have laundering pathways evolved?
  3. Where are the structural enforcement leverage points?

Core Research Findings of the Report

In 2025, transaction volume linked to sanctions jumped by almost $100 billion compared to the previous year. The main factor was the $70 billion transaction volume of the ruble-denominated stablecoin A7A5. This stablecoin aims to bypass traditional financial channels.

2. The $1.5 Billion Lazarus Strike & Layered Laundering

The Lazarus Group remains the most sophisticated threat actor, highlighted by their $1.5 billion exploit of Bybit in 2025. Their laundering strategy has become complex and tool-driven on Ethereum. Now, 20.1% of illicit funds are hidden through mixers like Tornado Cash.

3. Stablecoins: The $100B+ Enforceable Infrastructure

Stablecoins have moved from passive tools to active regulatory interfaces. In 2025, the scale of freezing activity reached a structural turning point. For example, adding entities like Huione Group to sanctions lists boosted traceable illicit flows by billions. This shows that stablecoin issuers can enforce rules at the contract level now.

4. Southeast Asia’s Industrialized Scam Economy

The scam ecosystem in Southeast Asia has become a fully industrialized "human supply chain." Huione Group made up about 2.73% of all scam-related funds on the TRON network. It acted as a key laundering node for organized crime.

5. The Financialization of Drug Trafficking on TRON

Drug trafficking has moved to on-chain networks. Most of this activity is on TRON because it has low transaction costs. These networks now use professional laundering methods that look like real financial services. They move money away from cash smuggling and toward stablecoin systems.

6. Identifying the 80% Concentration Leverage

Risk is not evenly distributed; it is highly concentrated. On the TRON network, over 80% of scam proceeds ultimately flow into a small number of centralized exchanges. This shows a big enforcement chance. By limiting key liquidity hubs, authorities can disrupt most illegal money-making.

Report Overview

This 36-page report is based on data analysis and on-chain evidence. It also includes breakdowns of common real-world cases. It shows the big picture of cryptocurrency crime in 2025. It covers the main features, structure, and trends in this field.

Target Audience:

  • Cryptocurrency Industry Professionals

  • Heads of Compliance and Risk Management

  • Exchanges and Payment Institutions

  • Regulatory and Law Enforcement Agencies

  • Research and Consulting Firms

The industry is facing stricter rules and more transparency. This report provides clear and useful research for all involved.

Fill out the form to download the full 2025 Crypto Crime Report (PDF).

Sign up for the latest updates
FATF’s New Stablecoin Report Signals a Shift to Secondary-Market Compliance
Knowledge

FATF’s New Stablecoin Report Signals a Shift to Secondary-Market Compliance

BlockSec interprets FATF’s March 2026 report on stablecoins and unhosted wallets, explains why supervision is shifting toward secondary-market P2P activity, breaks down the report’s main recommendations and red flags, and shows how on-chain monitoring, screening, and cross-chain tracing can help issuers and VASPs respond with stronger, more effective compliance controls.

Weekly Web3 Security Incident Roundup | Mar 16 – Mar 22, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Mar 16 – Mar 22, 2026

This BlockSec weekly security report covers seven DeFi attack incidents detected between March 16 and March 22, 2026, across Ethereum, BNB Chain, Polygon, and Polygon zkEVM, with total estimated losses of approximately $82.7M. The most significant event was the Resolv stablecoin protocol's infrastructure-key compromise, which led to over $80M in unauthorized USR minting and cross-protocol contagion across lending markets. Other incidents include a $2.15M donation attack combined with market manipulation on Venus Protocol, a $257K empty-market exploit on dTRINITY (Aave V3 fork), access control vulnerabilities in Fun.xyz and ShiMama, a weak-randomness exploit in BlindBox, and a redemption accounting flaw in Keom.

Weekly Web3 Security Incident Roundup | Mar 9 – Mar 15, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Mar 9 – Mar 15, 2026

This BlockSec weekly security report covers eight DeFi attack incidents detected between March 9 and March 15, 2026, across Ethereum and BNB Chain, with total estimated losses of approximately $1.66M. Incidents include a $1.01M AAVE incorrect liquidation caused by oracle misconfiguration, a $242K exploit on the deflationary token MT due to flawed trading restrictions, a $149K exploit on the burn-to-earn protocol DBXen from `_msgSender()` and `msg.sender` inconsistency, and a $131K attack on AM Token exploiting a flawed delayed-burn mechanism. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.

Start Real-Time AML with Phalcon Compliance

Turn Phalcon Network alerts into actions with Phalcon Compliance. Use verified blockchain intelligence to screen wallets, monitor transactions and investigate risks. This helps you respond quickly and stay compliant in the digital assets ecosystem.

Phalcon Compliance

Get Real-Time Protection with Phalcon Security

Audits alone are not enough. Phalcon Security detects attacks in real time and blocks threats mid-flight.

phalcon security

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation