Chainalysis Crypto Crime Report 2026: $154B Explained

Chainalysis's crypto crime report 2026 puts illicit on-chain volume at roughly $154 billion for 2025, a 162% jump from the prior year that has already spawned a wave of "crypto crime is exploding" headlines since the report's early-March publication. It isn't wrong on the math. It is wrong on the framing. Almost the entire increase comes from one mechanism: sanctions-evasion value received by designated entities rose 694% year over year, and a single ruble-backed stablecoin called A7A5 accounts for $93.3 billion of the $104 billion sanctions-evasion total. Strip that out and the picture underneath — hacking, ransomware, everyday fraud — looks far less dramatic than the headline number implies.

A7A5 launched in February 2025 as a ruble-pegged token designed to let sanctioned Russian businesses settle cross-border trade outside the SWIFT and dollar-clearing systems. In under a year it processed that $93.3 billion figure, moving mostly through two exchanges, Grinex and Meer — Grinex has since been sanctioned by both the US and EU, Meer by the EU and UK. This is not retail crime scaling up. It's a state-adjacent settlement rail substituting for banking infrastructure that sanctions closed off, built on public blockchains because they're faster and cheaper to stand up than a shadow banking network. Iran's pattern reinforces the read: Chainalysis found the IRGC now drives more than half of all Iranian crypto value in the fourth quarter of 2025, up sharply from prior periods. Two sanctioned states, the same playbook, in the same year — that's a policy story, not a crime wave.

Not in the way the $154 billion headline suggests. Hacking losses came in around $3.4 billion for 2025, driven heavily by North Korea ($2.02 billion, up 51% year over year and $6.75 billion cumulative) and by Bybit's record $1.5 billion theft in February — serious, but a shrinking share of the total now that sanctions evasion dwarfs everything else. Ransomware actually fell: aggregate payments dropped 8% year over year to about $820 million even as the number of claimed attacks rose roughly 50%, because attackers are hitting fewer, higher-value targets — the median ransom payment jumped 368% to around $60,000. That's a shift in tactics, not a growing wave. The one category that is genuinely climbing on its own merits is scams and fraud: Chainalysis estimates roughly $17 billion, while the FBI separately logged $11.36 billion in reported crypto fraud losses, up 22% year over year, with investment scams ($7.23 billion) the single largest sub-category. AI-enabled scam operations are now roughly 4.5 times more profitable than traditional schemes, which is the one organic crime trend in this report worth taking seriously.

The mechanical enabler running through nearly every category is stablecoins. Their share of total illicit crypto volume jumped from 63% to 84% in a single year — the fastest structural shift in the report. Criminals and sanctioned states are following the same logic as everyone else moving money on-chain: stablecoins are cheap to transfer across borders and don't carry the volatility risk of holding Bitcoin or Ether during a payment window. That's precisely the infrastructure that made A7A5's scale possible, and it's why regulators are now treating stablecoin rails, not exchanges, as the primary chokepoint. It also means the 2026 report's headline number is less a verdict on "crypto" broadly than a verdict on how quickly stablecoin infrastructure got repurposed for state settlement once sanctions cut off the conventional alternative.

The likely near-term outcome is more designations, not more legislation. US, EU and UK regulators have already sanctioned Grinex and Meer, the two exchanges that processed most of the A7A5 flow, and that precedent points toward further action against stablecoin issuers, exchanges and on/off ramps found facilitating sanctioned-entity settlement. That pressure lands directly on the compliance timeline for the GENIUS Act, the US stablecoin framework, whose transaction-monitoring requirements take full effect in January 2027 — a deadline this report's 84% stablecoin-illicit-share finding makes politically easier to enforce. Separately, Chainalysis's mid-2026 update flagged physical "wrench attack" crypto theft on pace for a record year; that's a distinct category already covered on its own and shouldn't be folded into this figure.

The base case is that 2025 looks like a step-change concentrated in one country's response to sanctions pressure, not the start of a compounding trend. If Grinex, Meer and the broader A7A5 rail get squeezed the way this year's designations suggest, the sanctions-evasion line item could fall sharply in next year's report even if scams keep climbing. That would break the "crime wave" framing outright, since scams and fraud, while real and worth taking seriously, are a fraction of the $104 billion sanctions figure. The case against that reading is that other sanctioned regimes — Iran already shows the pattern via the IRGC — could replicate the A7A5 model with their own state-backed stablecoins, in which case the total keeps climbing for genuinely new reasons rather than base effects rolling off. Either way, it's worth remembering the report's own caveat: illicit activity is still under 1% of total on-chain volume. The risk this data actually points to is regulatory and geopolitical, concentrated in stablecoin rails and sanctioned states, not a rising threat to ordinary crypto users.