Dark Web "De-Bitcoinization"? $154 billion in illegal transactions now handled by stablecoins

Blockchain analysis firm Chainalysis’s latest data shows a structural shift in the illegal cryptocurrency trading landscape by 2025, with stablecoins fully replacing Bitcoin for the first time as the primary medium for dark web and illicit financial activities, accounting for an astonishing 84%.

The total illegal transaction volume reaches $154 billion annually. This “dollarization” trend marks a new phase of professionalization and industrialization in criminal activities, deeply intertwined with geopolitical factors. Although illegal transactions still account for less than 1% of the overall crypto economy, their evolving nature—from individual hackers to state actors and industrialized money laundering networks—poses a new challenge to global financial security and regulation.

Stablecoins Rise: The “Dollarization” Revolution in the Criminal World

For a long time, the classic narrative of hooded hackers hoarding Bitcoin in dark web wallets has become outdated. Data from 2025 reveals a decisive shift: the focus of illegal crypto economies has moved from the price volatility of original cryptocurrencies to a dense, efficient shadow system linked to the US dollar. According to Chainalysis, stablecoins contributed 84% of the total $154 billion in illegal transactions last year. This is not just a change in market share but a modernization upgrade of criminal infrastructure.

This migration is no coincidence; it essentially mirrors the trends in legitimate crypto markets. In mainstream finance, stablecoins are increasingly dominant due to their ease of cross-border transfer, significantly lower price volatility compared to assets like Bitcoin or Ethereum, and widespread use in decentralized finance (DeFi). However, these same features that bring efficiency to legitimate users also make stablecoins an ideal tool for complex criminal groups. The shift from Bitcoin to dollar-pegged assets means they are effectively using an internet-speed “shadow banking system” that operates outside direct US regulatory oversight.

This “dollarization” of crime provides key advantages for drug cartels and state actors: they can settle payments using stable accounting units without exposing themselves to the extreme price volatility typical of crypto markets. This reduces financial uncertainty during operations, enabling large-scale, long-term illegal fund transfers. From a regulatory perspective, enforcement efforts must shift from tracking volatile assets to tracing seemingly stable but actually more covert digital dollar instruments.

Key Data on the Evolution of Illegal Transaction Currencies from 2020 to 2025

To clearly illustrate this historic shift, the following key data outline the changes in illegal transaction mediums over the past six years:

• Bitcoin’s share declines: In 2020, Bitcoin accounted for over 60% of illegal transactions, but has steadily decreased since, falling to a secondary role by 2025.
• Stablecoin share surges: Contrary to Bitcoin’s trend, stablecoins’ share rose from less than 20% in 2020 to 84% in 2025, achieving complete dominance.
• Total transaction volume expands: Illegal transaction volume grew from hundreds of millions of dollars in 2020 to $154 billion in 2025, reflecting increased scale and sophistication.
• Ecosystem share remains stable: Despite the large absolute amount, the $154 billion still accounts for less than 1% of the total legitimate crypto economy, highlighting different risk profiles from macro and micro perspectives.

Geopolitical On-Chain: State Actors as New Main Players

If 2009-2019 was the era of “early” niche cybercriminals, and 2020-2024 the period of criminal “professionalization,” then 2025 marks the arrival of the “third wave”: large-scale state actor activity. In this new phase, geopolitics has truly “moved on-chain.” Governments are beginning to leverage specialized service providers initially built for cybercriminals, while establishing their own customized infrastructure to evade sanctions on a large scale.

Russia’s actions are particularly prominent, demonstrating the feasibility of state-supported digital assets to bypass sanctions. After laying the groundwork through relevant legislation in 2024, Russia launched the A7A5 token pegged to the ruble in February 2025. In less than a year, the trading volume of this token exceeded $93.3 billion, enabling Russian entities to bypass the global banking system and transfer value cross-border without relying on SWIFT or Western intermediary banks. This is not just a technological experiment but a strategic reconstruction of national financial channels.

Similarly, Iran’s proxy networks continue to utilize blockchain for illegal financing. According to wallet information confirmed on sanctions lists, networks allied with Iran have facilitated money laundering, illegal oil sales, and weapons and goods procurement, totaling over $2 billion. Despite military setbacks, Iran-aligned terrorist organizations such as Hezbollah, Hamas, and Houthi rebels are increasingly using cryptocurrencies on an unprecedented scale. North Korea, in 2025, experienced its most destructive year to date. Hackers linked to the regime stole $2 billion, driven by several devastating large-scale cyberattacks. The most notable was a February attack on a major CEX, resulting in nearly $1.5 billion in losses, marking the largest digital heist in crypto history. These events clearly demonstrate that cryptocurrencies have become a core tool in geopolitical games and evasion of the international financial system.

Industrialized Money Laundering: The Dark Ecosystem of “Laundry as a Service”

The surge in illegal transaction volume is backed by the rise of Chinese money laundering networks (CMLNs) as dominant players in the illicit on-chain ecosystem. These networks have greatly advanced the diversification and professionalization of crypto crime. Building on frameworks like “Huione Guarantee,” they have created comprehensive criminal enterprises offering “laundry as a service,” supporting a diverse client base from fraudsters and scam operators to North Korea-backed hackers and terrorist financiers.

A key trend identified in 2025 is that both illicit actors and state entities increasingly rely on infrastructure providers offering “full-stack” services. These providers are visible on-chain and have evolved from niche hosting resellers to integrated infrastructure platforms. They offer domain registration, anti-tampering hosting, and other technical services designed to resist shutdowns, abuse complaints, and sanctions enforcement. By providing resilient technical backbones, these providers expand the reach of malicious networks, enabling financially motivated criminals and state-supported actors to operate even when law enforcement attempts to dismantle their networks. This mature, division-of-labor ecosystem makes money laundering as efficient as a dark pipeline, with increased resilience against disruption.

Convergence of Digital and Physical Threats: A New Dimension of Violent Crime

While the narrative of crypto crime often centers on digital theft and money laundering, 2025 starkly proves that on-chain activity is increasingly intertwined with physical-world violent crimes. Human trafficking operations are increasingly using cryptocurrencies for financial logistics, transferring proceeds across borders with relative anonymity. More disturbingly, reports indicate an increase in physical coercion attacks. Criminals are more frequently using violence to force victims to transfer assets, often launching such assaults at crypto price peaks to maximize theft value.

This trend signals a dangerous escalation in criminal modus operandi. It blurs the line between cybercrime and traditional violent crime, posing new cross-sector challenges for law enforcement. Victims face not only property loss but also direct threats to personal safety. This requires investigators to possess not only blockchain analysis skills but also experience and networks in handling violent crimes and human trafficking cases. The “empowering” role of cryptocurrencies in such crimes means regulation and tracking are no longer purely financial compliance issues but are directly linked to personal safety and social stability.

In-Depth: The Global Battle over Stablecoin Regulation

In response to the central role stablecoins play in illicit finance, global regulators are stepping up efforts. Major jurisdictions like the US, EU, and Singapore have introduced or are developing dedicated regulatory frameworks for stablecoins, emphasizing strict issuer reserve audits, redemption guarantees, and comprehensive AML and KYC compliance. However, the challenge lies in balancing risk control with innovation. Overly strict rules may push activities into regulatory vacuums or fully anonymous alternatives, while insufficient regulation could amplify systemic risks. The key to this game is whether a global coordinated regulatory standard can be established to prevent regulatory arbitrage.

Background: From Silk Road to “Laundry as a Service”—A Brief History of Cybercrime Finance

To understand the current dominance of stablecoins, it is necessary to review the evolution of cybercrime financial tools. Early (2011-2017), dominated by Bitcoin, exemplified by the Silk Road dark web marketplace, characterized by tech-savvy operators and a single payment medium. The mid-phase (2018-2024) saw a hybrid era, with DeFi and complex on-chain ecosystems emerging, coexisting with Bitcoin, Ethereum, and early stablecoins. Mixing services and cross-chain bridges became widespread, and crime services professionalized. From 2025 onward, the era of stablecoins and industrialization has arrived, with mainstream stablecoins like USDT and USDC becoming dominant, deeply integrated with state-level money laundering networks and geopolitical evasion, forming a mature “laundry as a service” black industry. This history shows that criminal forms continuously adapt to the most efficient financial technologies.

Despite these concerning trends, in the broader context, illegal transaction volume tracked in 2025 remains below 1% of the legitimate crypto economy. However, this 1% is of a different nature—state actors integrating stablecoins into illegal supply chains—that alarms regulators and intelligence agencies, directly linking ecosystem integrity with global geopolitical stability. Looking ahead to 2026, governments, compliance teams, and security professionals will face the challenge of disrupting a highly professionalized, state-sponsored shadow economy that has weaponized modern financial efficiency. Cooperation among law enforcement, regulators, and crypto firms will be crucial, as the outcome of this battle will profoundly influence the future stability and security of the global financial system.