Crypto crime has entered a professionalized era dominated by AI-driven scams, stablecoin laundering and efficient cyber syndicates, the 2025 “Crypto Crime Report” by Chainalysis reveals, with the past year witnessing a staggering $51 billion in illicit transaction volume — shattering previous records and assumptions.
Initial estimates suggested a decline in crypto crime for 2024. Deeper analysis now suggests otherwise: Criminals have adopted advanced money laundering techniques, hinging on stablecoins, decentralized finance (DeFi) and AI-powered deception, which created the illusion of decreased crime.
Gone are the days of lone hackers and shady darknet markets. The report paints a grim picture of hyper-professionalized cybercrime networks, where fraud cartels, nation-state hackers and AI-powered scams dominate the landscape.
Ransomware payments dropped 35% year-over-year (YoY), yet the battle is far from won. Cybercriminals are abandoning Bitcoin (BTC) in favor of stablecoins, Monero (XMR) and DeFi exploits.
Total cryptocurrency value received by illicit addresses 2020–2024. Source: Chainalysis
Stablecoins are the new kingpin of illicit crypto activity
Bitcoin was the currency of choice for cybercriminals for years, but this changed in 2022. The 2025 Chainalysis report shows a seismic shift to stablecoins that now account for 63% of all illicit crypto transactions.
Criminals are abandoning Bitcoin in favor of stablecoins because they offer speed, liquidity and regulatory blind spots that make illicit transactions easier to execute and harder to trace. Unlike Bitcoin, which can experience longer confirmation times, stablecoins provide near-instantaneous transactions and US dollar-pegged stability.
This makes stablecoins ideal for laundering large sums of money without worrying about price fluctuations and makes tracking transactions harder due to faster shifts through mixers, crosschain bridges and DeFi protocols to obscure transaction origins and evade detection. This pivot shows a growing preference for more efficient financial tools in the evolving landscape of crypto crime.
Stablecoins have overtaken BTC for illicit activity for the third year. Source: Chainalysis
Yet stablecoin issuers are fighting back. Tether, for instance, has frozen hundreds of addresses tied to illicit activity, forcing criminals to seek alternatives. Some have turned to Monero, privacy wallets and DeFi-based laundering schemes.
Ransomware payments drop 35%, but cybercrime adapts
At first glance, ransomware attacks appear to have declined. In 2024, payments declined by 35%, suggesting that victims and regulators are finally gaining the upper hand. However, this number masks a deeper transformation.
Rather than disappearing, ransomware groups have rebranded, diversified and adapted. Following the takedown of LockBit, smaller ransomware-as-a-service groups like RansomHub have absorbed displaced operators, demonstrating how cybercriminal networks swiftly adapt to enforcement actions.
Another sector of crypto crime continues to thrive in plain sight through simple market manipulation. Decentralized exchanges (DEXs) remain fertile ground for wash trading, where fraudsters orchestrate schemes that inflate trading volumes and deceive investors. The crypto firm CLS Global just pleaded guilty to wash-trading a token made by the US Federal Bureau of Investigation (FBI) for a cyber sting operation.
The crypto market remains plagued by wash trading, fake volume and pump-and-dump schemes. The 2025 Chainalysis report estimates that $2.57 billion in illicit trading volume was artificially generated in 2024.
These methods rely on creating an illusion of demand, often through automated trading bots that rapidly buy and sell tokens to inflate prices artificially. This fabricated activity tricks new investors into believing a project has real momentum. A fast-growing green candle and seemingly organic volume draw in new investors with the promise of quick gains.
Once enough unsuspecting buyers enter the market, insiders dump their holdings, crashing the price and leaving retail investors holding worthless tokens. This cycle, known as the classic “pump-and-dump,” continues to plague DEXs, undermining trust in crypto markets.
In 2024, 3.59% of all new tokens minted displayed classic rug-pull behavior.
Looking ahead at cat-and-mouse crypto crime
Chainalysis’s 135-page report also covers the rise of laundering-as-a-service platforms, the decline of darknet market revenues, and the growing role of AI in crypto scams. It examines how North Korean hackers stole a record $1.34 billion, the fall of major ransomware groups like LockBit and the SEC’s crackdown on $2.57 billion in market manipulation schemes. The report shows the evolution of crime and the escalating global response with detailed case studies and forensic insights.
There is a cat-and-mouse game with regulators and criminals locked in an escalating arms race. Stablecoin regulations are expected to tighten as governments respond to their growing role in money laundering.
At the same time, AI-powered fraud will expand exponentially, with deepfake scams, synthetic identities and automated phishing attacks becoming harder to detect. Ransomware tactics will continue to evolve, shifting focus from ransom payments to data theft and extortion.
Cybercriminals will find new ways to pressure victims, and as law enforcement steps up its efforts, the battle between regulators and illicit actors will only intensify, shaping the future of crypto’s role in global finance.
The government has published witness statements submitted by a senior official connected to the collapse of a trial involving two men accused of spying for China.
Here are three big questions that flow from them:
1. Why weren’t these statements enough for the Crown Prosecution Service (CPS) to carry on with the trial?
For this prosecution to go ahead, the CPS needed evidence that China was a “threat to national security”.
The deputy national security adviser Matthew Collins doesn’t explicitly use this form of words in his evidence. But he comes pretty close.
In the February 2025 witness statement, he calls China “the biggest state-based threat to the UK’s economic security”.
More on China
Related Topics:
Six months later, he says China’s espionage operations “harm the interests and security of the UK”.
Yes, he does quote the language of the Tory government at the time of the alleged offences, naming China as an “epoch-defining and systemic challenge”.
But he also provides examples of malicious cyber activity and the targeting of individuals in government during the two-year period that the alleged Chinese spies are said to have been operating.
Please use Chrome browser for a more accessible video player
3:55
Witness statements published in China spy trial
In short, you can see why some MPs and ex-security chiefs are wondering why this wasn’t enough.
Former MI6 head Sir Richard Dearlove told Sky News this morning that “it seems to be there was enough” and added that the CPS could have called other witnesses – such as sitting intelligence directors – to back up the claim that China was a threat.
Expect the current director of public prosecutions (DPP) Stephen Parkinson to be called before MPs to answer all these questions.
2. Why didn’t the government give the CPS the extra evidence it needed?
The DPP, Stephen Parkinson, spoke to senior MPs yesterday and apparently told them he had 95% of the evidence he needed to bring the case.
The government has said it’s for the DPP to explain what that extra 5% was.
He’s already said the missing link was that he needed evidence to show China was a “threat to national security”, and the government did not give him that.
Please use Chrome browser for a more accessible video player
3:07
What does China spy row involve?
The newly published witness statements show they came close.
But if what was needed was that explicit form of words, why was the government reticent to jump through that hoop?
The defence from ministers is that the previous Conservative administration defined China as a “challenge”, rather than a “threat” (despite the numerous examples from the time of China being a threat).
The attack from the Tories is that Labour is seeking closer economic ties with China and so didn’t want to brand them an explicit threat.
Please use Chrome browser for a more accessible video player
2:40
Is China an enemy to the UK?
3. Why do these statements contain current Labour policy?
Sir Keir Starmer says the key reason for the collapse of this trial is the position held by the previous Tory government on China.
But the witness statements from Matthew Collins do contain explicit references to current Labour policy. The most eye-catching is the final paragraph of the third witness statement provided by the Deputy National Security Adviser, where he quotes directly from Labour’s 2024 manifesto.
He writes: “It is important for me to emphasise… the government’s position is that we will co-operate where we can; compete where we need to; and challenge where we must, including on issues of national security.”
Please use Chrome browser for a more accessible video player
11:52
In full: Starmer and Badenoch clash over China spy trial
Did these warmer words towards China influence the DPP’s decision to drop the case?
Why did Matthew Collins feel it so important to include this statement?
Was he simply covering his back by inserting the current government’s approach, or was he instructed to put this section in?
A complicated relationship
Everyone agrees that the UK-China relationship is a complicated one.
There is ample evidence to suggest that China poses a threat to the UK’s national security. But that doesn’t mean the government here shouldn’t try and work with the country economically and on issues like climate change.
It appears the multi-faceted nature of these links struggled to fit the legal specificity required to bring a successful prosecution.
But there are still plenty of questions about why the government and the CPS weren’t able or willing to do more to square these circles.
SEC Chair Paul Atkins said the US is a decade behind on crypto and that building a regulatory framework to attract innovation is “job one” for the agency.