The age of the cloaked hacker stashing Bitcoin in shadowy wallets is a relic of the past.
By 2025, the focus of the illicit cryptocurrency economy dramatically shifted from the volatility of Bitcoin to a stable, dollar-linked underworld.
Recent Chainalysis insights revealed to CryptoSlate indicate that stablecoins comprised a staggering 84% of the illicit transaction volume, which totaled $154 billion last year, illustrating a marked transition towards a more programmed financial infrastructure.
This pivotal shift has enabled sophisticated money laundering networks, particularly those from China, to expand their “laundering-as-a-service” operations, while nation-states, including North Korea, Russia, and Iran, adeptly leveraged these mechanisms to sidestep Western financial restrictions.
Why Cybercriminals Abandoned Bitcoin
The most dominant revelation in the 2025 data is Bitcoin’s declining status as the primary medium for criminal transactions. For over a decade, Bitcoin was the emblematic currency for illicit activities, but its supremacy has waned since 2020.
As illustrated in the accompanying illicit activity chart from 2020 to 2025, Bitcoin’s share of criminal transactions has seen a significant drop, whereas the use of stablecoins has dramatically surged to engulf a substantial portion of the market.
This evolution isn’t merely coincidental; it reflects patterns within the wider legitimate cryptocurrency landscape, where stablecoins are becoming increasingly dominant thanks to their practical advantages: seamless cross-border transfer, diminished volatility compared to currencies like Bitcoin or Ethereum, and expanded utility within decentralized finance (DeFi) frameworks.
Yet, these same characteristics have transformed stablecoins into a favored vehicle for advanced criminal operations.
Thus, the abandonment of Bitcoin signifies a modernization of criminal finance.
By utilizing dollar-pegged assets, criminals are harnessing a shadow version of the conventional banking system—one that operates at internet speed, eluding immediate regulatory scrutiny from U.S. authorities.
This “dollarization” of illicit transactions allows cartels and state-sponsored actors to conduct payments in a stable monetary unit, thereby reducing their exposure to the unpredictable price fluctuations of the broader crypto market.
The Geopolitical Transition
While the decade from 2009 to 2019 was characterized as the “Early Days” of niche cybercriminals, and 2020 to 2024 represented the “Professionalization” phase, 2025 has ushered in “Wave 3”: the era of state-sponsored large-scale cyberactivity.
During this new chapter, geopolitics has integrated seamlessly with blockchain technology. Governments are now tapping into the robust service providers previously crafted for cybercriminals while concurrently establishing their own systems to effectively evade sanctions on a grand scale.
Russia notably exemplified the feasibility of utilizing state-backed digital currencies for sanctions evasion. After enacting relevant legislation in 2024, the nation launched its ruble-pegged A7A5 token in February 2025.
In less than a year, this token facilitated transactions exceeding $93.3 billion, enabling Russian entities to blossom outside the constraints of the global banking structure, effectively bypassing SWIFT and traditional Western counterparties.
Similarly, Iran has employed blockchain technology through its proxy networks, facilitating illicit financial operations.
Confirmed wallets tied to sanctions depict Iranian-aligned networks facilitating money laundering, illicit oil trades, and arms procurement, amassing over $2 billion.
Despite facing various military hurdles, networks associated with Iranian terrorist groups, which include Hezbollah and Hamas, are utilizing cryptocurrencies at an unprecedented scale.
Furthermore, North Korea has marked its most destructive year to date, as hackers linked to the country pilfered an astounding $2 billion in 2025, a figure primarily driven by a series of mega-hacks.
The most notable incident was the Bybit exploit in February, resulting in approximately $1.5 billion in losses—the largest digital robbery in cryptocurrency history.
The Industrialization of Money Laundering
This surge in illicit financial activity can be attributed to the emergence of Chinese money laundering networks (CMLNs), which are now a powerhouse in the on-chain criminal ecosystem. These networks have significantly diversified and professionalized their operations.
Building on frameworks established by past initiatives like Huione Guarantee, these networks have constructed comprehensive criminal enterprises.
They offer specialized “laundering-as-a-service” solutions that cater to a broad client demographic, spanning from individual fraudsters and scam operators to state-affiliated hackers and financiers of terrorism.
A defining trend in 2025 is the growing dependence of criminal entities and nation-states on service providers offering a complete suite of operational capabilities.
These providers have evolved from niche hosting companies to integrative service platforms delivering everything from domain registration to robust hosting, designed to withstand regulatory crackdowns.
By establishing a resilient technical framework, these service providers expand the reach of malicious cyber activities, allowing financially motivated criminals and state-linked actors to sustain their operations even as law enforcement strives to dismantle their networks.
The Convergence of Digital and Physical Threats
While discussions about crypto crime often center on digital theft and laundering, 2025 revealed alarming evidence of a growing intersection between on-chain activities and violent crimes in the real world.
Human trafficking syndicates have increasingly turned to cryptocurrencies for their financial operations, facilitating the movement of funds across borders with notable anonymity.
Even more concerning is the uptick in physical coercion incidents, where criminals forcibly compel victims to transfer assets, often coinciding with cryptocurrency price surges to maximize theft value.
Illicit Activities Still Less than 1% of the Crypto Economy
Despite these troubling developments, maintaining a broader perspective is crucial. The illicit volumes observed in 2025 represent less than 1% of the legitimate cryptocurrency landscape.
However, the nature of this 1% is what raises concerns among regulators and intelligence agencies. The intertwining of nation-states in the illicit supply chain via stablecoins significantly heightens the stakes for national security.
As regulatory authorities, law enforcement agencies, and crypto stakeholders look towards 2026, the challenge will be to disrupt a professionalized, state-sponsored shadow economy that has adeptly weaponized the efficiencies of modern finance.
Collaboration among law enforcement, regulatory agencies, and the crypto industry will be imperative, as the integrity of the ecosystem now tangibly impacts global geopolitical stability.
The post “Bitcoin is no longer the king of the dark web—here’s why it transformed into a $154 billion crypto nightmare” was originally published on CryptoSlate.
