Illicit cryptocurrency activity hit a record $158 billion in 2025, driven largely by a Russia-linked ruble‑pegged stablecoin. According to a TRM Labs report, the surge reflected widespread sanctions evasion using that token.
Stablecoins made up about 95% of inflows to sanctioned entities and jurisdictions in 2025. Roughly 77% of illicit stablecoin volume—over $72 billion—was tied to A7A5 alone.
This marks a shift from dollar‑pegged tokens like Tether‘s USDT, which remained widely used. Still, A7A5 emerged as the dominant vector for sanctions evasion last year.
Ari Redbord, a former U.S. Treasury official and TRM Labs‘ global head of policy, said “A7A5 shows how pressure creates specialization, and how bad actors will build new rails when old ones become harder to use.” “A7A5 was arguably the biggest crypto crime story of the year because it was not trying to be global,” he added, “It was designed to move value where mainstream channels were being shut off.”
Stablecoin flows to sanctioned actors fell nearly 30% on exchanges with KYC controls, the report found. Flows rose by more than 200% on decentralized services lacking KYC standards.
Usage patterns varied by country; Tether remained especially popular in Venezuela. Iran’s illicit crypto activity was overwhelmingly concentrated in Tether transactions on Tron, associated with Justin Sun.
