Sanctions evasion dominated crypto-related illicit financing last year, with state actors such as Russia, Iran and North Korea driving an increase in activity, Chainalysis said in a report Thursday.
Sanctioned entities received at least $104 billion in cryptocurrency, a nearly eight-fold increase from 2024, bringing the chain’s total illicit volume to a record $154 billion. The results show the extent to which heavily sanctioned states are integrating cryptocurrency into their national financial strategies to bypass traditional banking systems.
Chainalysis’ report follows a similar study by TRM Labs, which said in February that illicit entities received $141 billion in stablecoins, the highest level seen in five years. Sanctions-related activities accounted for 86% of flows, mainly in stablecoins, TRM said. About 50% of the total, or $72 billion, was linked to the Kyrgyzstan-registered A7A5 token, a ruble-pegged stablecoin.
Chainalysis’ 88-page report also named A7A5 as a major participant, saying it processed $93.3 billion in transactions in less than a year, functioning as a settlement channel for sanctioned Russian companies to trade across borders. The token is linked to exchanges Grinex and Meer, which processed billions of transactions before being sanctioned by the United States and the European Union.
Chainalysis has identified an “A7A5 Instant Swapper” service that converts the token into mainstream dollar-pegged stablecoins with little to no know-your-customer (KYC) checks. The service has processed more than $2.2 billion so far, enabling sanctioned entities to connect to the broader crypto economy, it said.
“These statements by Chainalysis are not new to us. They are politically motivated by Western countries,” Oleg Ogienko, director of regulatory and foreign affairs at A7A5, told Coindesk via Telegram. “We mainly provide payment rails for Russian export and import operations. It is absolutely legal and complies with the legislation of Russia, Kyrgyzstan and the legislation of other trade partner countries of Russia.”
A7A5 has industry-leading KYC and anti-money laundering (AML) controls and processes in line with regulatory requirements, it said. Additionally, the ruble-pegged stablecoin is not mentioned in any of the global Financial Action Task Force (FATF) reports.
Iran has also expanded its use of cryptography. Addresses linked to the Islamic Revolutionary Guard Corps (IRGC), designated a terrorist organization by the US, EU and other jurisdictions, accounted for more than 50% of the value received by Iranian services at the end of 2025, moving more than $3 billion linked to regional proxy financing, oil trade and supply networks.
North Korea remained the most prolific cybertheft actor, according to Chainalysis, stealing more than $2 billion in cryptocurrency in 2025, including $1.5 billion through the Bybit hack, the largest theft of digital assets on record.
The report also highlights a structural shift in crypto crime. Stablecoins now account for approximately 84% of illicit transaction volume, reflecting how sanctioned actors increasingly rely on dollar-pegged liquid assets to move funds across borders.
