Back to Blog

BlockSec Releases the 2025 Crypto Crime Report

Phalcon CompliancePhalcon SecurityMetaSleuth
February 27, 2026

BlockSec has officially released the 2025 Crypto Crime Report.

This report looks at two key blockchain networks: Ethereum and Tron. It analyzes six main types of cryptocurrency-related crime.

  • Scams

  • Hacks and exploits

  • Terrorist financing

  • Human trafficking

  • Drug trafficking

  • Sanctions-related activity

Through quantitative assessment of illicit revenue, structural analysis of on-chain laundering pathways, and identification of risk concentration points, the report delivers a comprehensive examination of how cryptocurrency-enabled crime evolved in 2025.

By combining empirical on-chain data, case studies, and enforcement observations, the report provides professional reference material for:

  • Industry compliance teams

  • Regulators and law enforcement agencies

  • Exchanges and payment institutions

  • Research and consulting organizations

In a global environment characterized by tightening regulation and expanding on-chain transaction volume, the report seeks to answer three core questions:

  1. How has the scale of illicit funds changed?
  2. How have laundering pathways evolved?
  3. Where are the structural enforcement leverage points?

Core Research Findings of the Report

1. A $100 Billion Surge in Sanctions-Related Activity

In 2025, transaction volume linked to sanctions jumped by almost $100 billion compared to the previous year. The main factor was the $70 billion transaction volume of the ruble-denominated stablecoin A7A5. This stablecoin aims to bypass traditional financial channels.

2. The $1.5 Billion Lazarus Strike & Layered Laundering

The Lazarus Group remains the most sophisticated threat actor, highlighted by their $1.5 billion exploit of Bybit in 2025. Their laundering strategy has become complex and tool-driven on Ethereum. Now, 20.1% of illicit funds are hidden through mixers like Tornado Cash.

3. Stablecoins: The $100B+ Enforceable Infrastructure

Stablecoins have moved from passive tools to active regulatory interfaces. In 2025, the scale of freezing activity reached a structural turning point. For example, adding entities like Huione Group to sanctions lists boosted traceable illicit flows by billions. This shows that stablecoin issuers can enforce rules at the contract level now.

4. Southeast Asia’s Industrialized Scam Economy

The scam ecosystem in Southeast Asia has become a fully industrialized "human supply chain." Huione Group made up about 2.73% of all scam-related funds on the TRON network. It acted as a key laundering node for organized crime.

5. The Financialization of Drug Trafficking on TRON

Drug trafficking has moved to on-chain networks. Most of this activity is on TRON because it has low transaction costs. These networks now use professional laundering methods that look like real financial services. They move money away from cash smuggling and toward stablecoin systems.

6. Identifying the 80% Concentration Leverage

Risk is not evenly distributed; it is highly concentrated. On the TRON network, over 80% of scam proceeds ultimately flow into a small number of centralized exchanges. This shows a big enforcement chance. By limiting key liquidity hubs, authorities can disrupt most illegal money-making.

Report Overview

This 36-page report is based on data analysis and on-chain evidence. It also includes breakdowns of common real-world cases. It shows the big picture of cryptocurrency crime in 2025. It covers the main features, structure, and trends in this field.

Target Audience:

  • Cryptocurrency Industry Professionals

  • Heads of Compliance and Risk Management

  • Exchanges and Payment Institutions

  • Regulatory and Law Enforcement Agencies

  • Research and Consulting Firms

The industry is facing stricter rules and more transparency. This report provides clear and useful research for all involved.

Fill out the form to download the full 2025 Crypto Crime Report (PDF).

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.

Weekly Web3 Security Incident Roundup | Mar 30 – Apr 5, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Mar 30 – Apr 5, 2026

This BlockSec weekly security report covers nine DeFi attack incidents detected between March 30 and April 5, 2026, across Solana, BNB Chain, Arbitrum, and Polygon, with total estimated losses of approximately $287M. The week was dominated by the $285.3M Drift Protocol exploit on Solana, where attackers combined multisig signer social engineering with Solana's durable nonce mechanism to bypass a zero-timelock 2-of-5 Security Council, alongside notable incidents including a $950K flash loan TWAP manipulation against the LML staking protocol, a $359K Silo Finance vault inflation via an external `wstUSR` market donation exploiting a depegged-asset oracle and `totalAssets()` accounting flaw, and an EIP-7702 delegated-code access control failure. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident, covering flawed business logic, access control, price manipulation, phishing, and misconfiguration attack types.

Tracing $1.6B in TRON USDT: Inside the VerilyHK Ponzi Infrastructure
Case Studies

Tracing $1.6B in TRON USDT: Inside the VerilyHK Ponzi Infrastructure

An on-chain investigation into VerilyHK, a fraudulent platform that moved $1.6B in TRON USDT through a multi-layered fund-routing infrastructure of rotating wallets, paired payout channels, and exchange exit funnels, with traced connections to the FinCEN-sanctioned Huione Group.

Start Real-Time AML with Phalcon Compliance

Turn Phalcon Network alerts into actions with Phalcon Compliance. Use verified blockchain intelligence to screen wallets, monitor transactions and investigate risks. This helps you respond quickly and stay compliant in the digital assets ecosystem.

Get Started with Phalcon Compliance
Contact Sales
Phalcon Compliance

Get Real-Time Protection with Phalcon Security

Audits alone are not enough. Phalcon Security detects attacks in real time and blocks threats mid-flight.

phalcon security

Go Deeper with MetaSleuth Investigation

Extend your crypto compliance capabilities with Blocksec's MetaSleuth Investigation, the first platform for tracing funds, mapping transaction networks and revealing hidden on-chain relationships.

Move from detection to resolution faster with clear visual insights and evidence-ready workflows across the digital assets ecosystem.

MetaSleuth Investigation