Sanctions evasion dominated crypto-related illicit financing last year, with state actors including Russia, Iran and North Korea driving a surge in activity, Chainalysis said in a Thursday report.
Sanctioned entities received at least $104 billion in cryptocurrency, a nearly eightfold increase over 2024, pushing the total illicit onchain volume to a record $154 billion. The findings show how heavily sanctioned states are integrating cryptocurrency into national financial strategies to bypass traditional banking systems.
Chainalysis’ report follows a similar study by TRM Labs, which said in February that illicit entities received $141 billion in stablecoins, the highest level observed in five years. Sanctions-related activity accounted for 86% of flows, mostly in stablecoins, TRM said. About 50% of the total, $72 billion, was tied to the Kyrgyzstan-registered A7A5 token, a ruble-pegged stablecoin.
Chainalysis’ 88-page report also named A7A5 as a key participant, saying it processed $93.3 billion in transactions in less than a year, acting as a clearinghouse for sanctioned Russian companies to conduct cross-border trade. The token is linked to exchanges Grinex and Meer, which handled billions in transactions before being sanctioned by the US and EU.
Chainalysis identified an “A7A5 Instant Swapper” service that converts the token into regular dollar-denominated stablecoins with little or no know-your-customer (KYC) checks. The service has processed more than $2.2 billion so far, effectively allowing sanctioned entities to bridge into the wider crypto-economy, it said.
“These Chainalysis statements are not new to us. They are politically motivated by Western countries,” Oleg Ogienko, A7A5’s director of regulatory and overseas affairs, told Coindesk via Telegram. “We primarily supply toll rails to a large extent for Russian export and import operations. It is absolutely legal and in accordance with the laws of Russia, Kyrgyzstan and the laws of other countries that are trading partners of Russia.”
A7A5 has state-of-the-art KYC and anti-money laundering (AML) controls and processes in place that comply with regulatory requirements, he said. Furthermore, the ruble-pegged stablecoin is not mentioned in any of the global Financial Action Task Force (FATF) reports.
Iran also expanded its crypto usage. Addresses linked to the Islamic Revolutionary Guard Corps (IRGC), designated a terrorist organization by the US, EU and other jurisdictions, accounted for more than 50% of the value received by Iranian services at the end of 2025, moving over $3 billion linked to regional proxy financing, oil trading and procurement networks.
According to Chainalysis, North Korea remained the most prolific cyber theft actor, stealing more than $2 billion in cryptocurrency in 2025, including $1.5 billion from a hack of Bybit, the largest digital theft ever recorded.
The report also highlights a structural shift in crypto-crime. Stablecoins now account for around 84% of illicit transaction volume, reflecting how sanctioned actors increasingly rely on liquid, dollar-pegged assets to move money across borders.
