Record illicit crypto wallet inflows in 2025 despite lower share of blockchain flows
Target Trend
Summary
Hide ▲
Show ▼
Illicit crypto wallets received an estimated $158bn in 2025, the highest level seen in five years, even as their share of total crypto activity fell. The increase reflects more sanctions-evading activity, better detection through Beacon Network, and large thefts including the Bybit raid by North Korean actors. The trend matters because it shows illicit flows are still expanding in absolute terms across the crypto ecosystem. At the same time, illicit share of on-chain volume slipped to 1.5% of total on-chain volume from 1.7% in 2024, and incoming VASP flows to illicit entities fell to 2.7% of incoming VASP flows from 2.9% the year before.
Related Happenings
Middle East hacktivist surge targets government, banking, aviation and telecom sectors
Target Trend
First: 02.03.2026 17:00
Last: 02.03.2026 17:00
Sources 1
About this happening:
**More than 150 hacktivist incidents** were recorded between **February 28 and March 1, 2026**, marking a sharp surge in **Middle East** targeting that raised spillover risk for o...
Middle East hacktivist surge targets government, banking, aviation and telecom sectors
Target TrendAbout this happening: **More than 150 hacktivist incidents** were recorded between **February 28 and March 1, 2026**, marking a sharp surge in **Middle East** targeting that raised spillover risk for o...
2025 Ransomware payments decline as victim counts surge
Target Trend
First: 02.03.2026 12:45
Last: 02.03.2026 12:45
Sources 1
About this happening:
**Ransomware victim counts** surged **50% YoY in 2025** even as total payments fell **8% to $820m**, showing that extortion volume rose while monetization weakened. The **payment...
2025 Ransomware payments decline as victim counts surge
Target TrendAbout this happening: **Ransomware victim counts** surged **50% YoY in 2025** even as total payments fell **8% to $820m**, showing that extortion volume rose while monetization weakened. The **payment...
Ransomware victim payment rates hit record low as claimed attacks surged
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates hit record low as claimed attacks surged
Target TrendAbout this happening: Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target TrendAbout this happening: Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor Meta
First: 16.02.2026 12:30
Last: 16.02.2026 12:30
Sources 1
About this happening:
**Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: **Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Timeline
-
12.01.2026 12:15 2 articles · 4mo ago
TRM Labs reports record illicit crypto wallet inflows in 2025
Campaign Scope UpdateTRM Labs estimates that illicit crypto wallets received $158bn in 2025, the highest level seen in five years, while illicit activity fell to 1.5% of total attributed on-chain volume and 2.7% of incoming VASP flows. The reported increase is linked to sanctions-evading activity by Venezuela, Iran and especially Russia, improved identification through the Beacon Network, large-scale hacks such as the Bybit raid by North Korean actors, and stronger blocklist enforcement by stablecoin issuers including Tether.
Show sources
- Illicit Crypto Activity Hits Record $158bn in 2025 — www.infosecurity-magazine.com — 12.01.2026 12:15
- Illicit Crypto Activity Hits Record $158bn in 2025 — www.infosecurity-magazine.com — 12.01.2026 12:15