Russia-Linked Crypto Sanctions Drive Illicit Activity to 5-Year High

The blockchain intelligence landscape witnessed a stark reversal in 2025, as illicit cryptocurrency activity rebounded sharply from a multi-year decline. According to a new report by TRM Labs, fraudulent wallets received approximately $158 billion in incoming value during the year, marking the highest level recorded over the past five years. This figure represents a dramatic surge from the $64.5 billion recorded in 2024, breaking a steady downward trend that saw illicit inflows fall from $85.9 billion in 2021 to $75.4 billion in 2022 and $73.3 billion in 2023.

TRM Labs attributed this significant increase not merely to a growth in criminal activity, but to a confluence of intensified enforcement actions and technological advances in attribution. The firm’s improved analytical capabilities enabled the identification of previously unattributed illicit volumes, bringing more activity into view. However, the most significant driver of the surge was concentrated in sanctions-linked activity, overwhelmingly tied to Russia.

The data reveals a central architecture underpinning the surge. The A7A5 token alone accounted for an estimated $72 billion in incoming value, followed by $39 billion linked to the A7 wallet cluster. TRM Labs’ analysis indicates that the majority of this activity is connected to Russia-linked actors, including entities like Garantex and Grinex. Crucially, the firm stated that the increase does not reflect sanctions evasion growth alone, but rather the combination of new sanctions designations targeting large entities and improved attribution of cryptocurrency addresses to actors that had already been sanctioned.

Among these, the A7 wallet cluster emerged as a central node, functioning as a coordinated sanctions evasion architecture tied to Russian state interests. On-chain activity analyzed by TRM indicates that A7 operates as a hub, linking Russia-aligned actors with counterparties across China, Southeast Asia, and Iran-linked networks. This represents a major strategic pivot toward crypto-enabled, state-aligned financial infrastructure, moving beyond mere evasion to building alternative systems.

While the A7 wallet cluster is closely associated with sanctions evasion, the A7A5 token supports a wider strategic push. It is part of an effort to reduce reliance on USD-based financial systems through the expansion of a ruble-pegged stablecoin. Consequently, the high transaction volumes linked to A7A5 do not exclusively represent sanctions evasion, but encompass broader state-aligned economic flows aimed at financial autonomy.

Despite the record-breaking absolute figures, the illicit sector’s footprint within the broader cryptocurrency ecosystem actually shrank in relative terms. Measured as a proportion of total attributed on-chain volume, illicit activity declined slightly to 1.2% in 2025 from 1.3% in 2024, and remained well below the 2.4% peak recorded in 2023. A similar pattern was observed when assessing illicit activity relative to incoming liquidity; illicit entities received 2.7% of incoming VASP (Virtual Asset Service Provider) flows in 2025, compared with 2.9% in 2024 and 6.0% in 2023.

TRM Labs said these metrics indicate that while certain illicit categories—particularly those linked to state-aligned actors—expanded significantly in absolute dollar terms, illicit actors absorbed a smaller proportion of the new capital entering the crypto ecosystem. This suggests the overall market is growing at a pace that outstrips even this sharp rise in illicit activity, though the concentration of that activity around specific, state-backed entities presents a distinct and complex challenge for global regulators and financial institutions.