The Shift from Bitcoin to Stablecoins
I think what’s happening here is pretty significant. For years, everyone associated Bitcoin with shady online activities—the dark web, ransomware, all that. But that’s changed. According to Chainalysis data from 2025, stablecoins now make up 84% of the $154 billion in illicit cryptocurrency transactions. That’s a huge shift.
Bitcoin’s share has been dropping steadily since 2020. It makes sense when you think about it. Criminals want stability too. They don’t want their stolen funds to lose half their value overnight because of Bitcoin’s volatility. Stablecoins give them that dollar peg, that predictability.
What’s interesting is how this mirrors legitimate crypto trends. Regular users and businesses are also moving toward stablecoins for similar reasons—easier cross-border transfers, less price risk, better utility in DeFi applications. The same features that make them useful for normal commerce also make them attractive for illicit activities.
Nation-States Enter the Picture
This isn’t just about individual criminals anymore. The 2025 data shows something more concerning: nation-states are getting involved. Russia, North Korea, Iran—they’re all using these systems now.
Russia launched its ruble-backed A7A5 token in February 2025. In less than a year, it moved over $93.3 billion. That’s not small change. It’s a way to bypass traditional banking systems, to avoid sanctions, to move money without using SWIFT.
North Korean hackers had their biggest year yet—$2 billion stolen in 2025. The Bybit exploit alone was nearly $1.5 billion. That’s the largest digital heist ever recorded.
Iran’s proxy networks are using crypto at unprecedented scales too. Hezbollah, Hamas, the Houthis—they’re all leveraging these systems now.
Professional Money Laundering Networks
What supports all this volume? Chinese money laundering networks, mostly. They’ve created what you might call “laundering-as-a-service” operations. Full-service criminal enterprises that cater to everyone from fraudsters to state-backed hackers.
These networks offer specialized services. They’re professional about it. They’ve built infrastructure designed to withstand takedowns, abuse complaints, sanctions enforcement. Bulletproof hosting, domain registration, the whole technical stack.
It’s become industrialized. What used to be niche operations are now integrated platforms. They amplify malicious activity by providing resilient technical backbones that law enforcement struggles to dismantle.
Physical World Connections
Perhaps the most disturbing trend is how this digital activity connects to physical violence. Human trafficking operations use crypto for financial logistics. That’s bad enough.
But there are reports of physical coercion attacks increasing. Criminals using violence to force victims to transfer assets. They time these attacks to coincide with cryptocurrency price peaks to maximize their take. That’s a whole different level of threat.
Context Matters
Despite all this, it’s important to keep perspective. Illicit activity still represents less than 1% of the total crypto economy. Most cryptocurrency transactions are legitimate.
But that 1% has changed qualitatively. It’s not just about digital theft anymore. It’s about nation-states, sanctions evasion, and connections to physical violence. That’s what worries regulators and intelligence agencies.
Looking ahead to 2026, the challenge will be disrupting this professionalized, state-sponsored shadow economy. Cooperation between law enforcement, regulators, and crypto businesses will be crucial. The integrity of the crypto ecosystem now intersects directly with global geopolitical stability.
It’s a complex problem. The efficiency of modern finance has been weaponized. Stablecoins, designed to bring stability to crypto markets, have become the preferred vehicle for sophisticated criminal and state-sponsored operations. That’s the paradox we’re dealing with now.
