Illicit actors capture nearly 3% of crypto liquidity in 2025: TRM

Crypto security firm TRM Labs' latest report indicates that while illicit crypto volume surged to an all-time high of $158 billion in 2025 (a 145% increase year-over-year), the illicit volume as a proportion of total crypto volume actually fell to 1.2%. More significantly, using a new metric relative to deployable capital, TRM found that illicit actors captured 2.7% of available crypto liquidity in 2025, down from 2.9% in 2024. This suggests that while absolute illicit activity grew, it absorbed a smaller proportion of new capital entering the ecosystem.

The report highlights that geopolitical pressures are reshaping illicit activity, with state-aligned actors increasingly using crypto for sanctions evasion (Russian, Iranian, Venezuelan) and North Korean hacks. Sanction-related flows increased by about 400%, with entities like A7 standing out as a hub for Russian-linked evasion. Furthermore, activity linked to Chinese-language escrow and underground banking services, often tied to 'pig butchering' schemes, has grown substantially.

Regarding theft, TRM observed a structural shift: adversaries are increasingly targeting operational infrastructure (keys, wallets) rather than smart contract code. Infrastructure attacks drove $2.2 billion in losses, 76% of total stolen assets, even after accounting for the massive Bybit breach. While losses from scams dipped slightly, organized groups dominate, with stablecoins accounting for 84% of fraud inflows.

(Source：The Block)