Every year, blockchain analytics firms attempt to quantify how much cryptocurrency moved through illicit channels, and every year, the honest answer comes with a caveat: these figures represent what has been identified and attributed at the time of publication, and they tend to rise over time as previously unlabeled wallet activity is later connected to known illicit actors. With that caveat in mind, the scale of activity documented by Chainalysis in its 2026 Crypto Crime Report is large enough to be worth understanding in detail, both for what it confirms and for what it suggests about where the industry is heading.
The big picture: $154 billion in illicit activity
Chainalysis estimated total illicit cryptocurrency activity at approximately one hundred fifty four billion dollars in 2025, a one hundred sixty two percent increase year over year. Even at that scale, the firm notes this still represents less than one percent of all attributed cryptocurrency transaction volume, a useful reminder that the overwhelming majority of on chain activity is not criminal, even as the absolute dollar figures associated with illicit activity continue to grow alongside the industry as a whole.
It is worth pausing on why a figure this large can coexist with such a small percentage share. Cryptocurrency's total transaction volume has grown enormously as the asset class has matured, institutional participation has expanded, and stablecoins have become a routine settlement rail for ordinary commercial activity. Illicit activity has grown alongside that expansion rather than shrinking as a proportion of it, which is a meaningfully different story than illicit activity becoming a larger share of a static or shrinking market, and it is the framing Chainalysis itself emphasizes when presenting the headline number each year.
Breaking down the categories
Sanctions evasion
The largest single category identified was activity flowing through sanctioned entities, estimated at roughly one hundred four billion dollars, an increase of nearly seven hundred percent year over year. This category reflects transactions with wallets and services that have been formally designated under sanctions programs, rather than theft specifically, but it represents the largest share of the total illicit figure by a wide margin.
Scams and fraud
Scams and fraud, covering everything from investment scams to romance based schemes, were estimated at approximately seventeen billion dollars. This category represents funds obtained through deception rather than through breaching a system or wallet directly, and it remains one of the largest sources of loss to individual victims specifically.
Stolen funds from hacks and exploits
Direct theft through hacks and exploits, the category covered throughout our guides on DeFi exploits and recent exchange hacks, was estimated at approximately three and a half billion dollars for the period measured. This is a smaller total than the sanctions or scam categories, but it is heavily concentrated in a comparatively small number of very large individual incidents, meaning any single major exchange or protocol breach can move the yearly total significantly.
Ransomware payments
Ransomware payments were estimated at approximately eight hundred twenty million dollars. While smaller in total dollar terms than the other categories, ransomware activity is notable for how directly it converts stolen access into cryptocurrency payment, often within a short window of the initial compromise.
Who is behind the theft
Within the stolen funds category specifically, North Korean linked actors accounted for a disproportionate share, with Chainalysis estimating approximately two billion dollars stolen by these groups in 2025 alone, a fifty one percent increase over the prior year. Our guide on state linked hacking groups covers what public reporting says about how this activity is organized and attributed.
A relatively small number of large, well resourced actors, rather than a broad base of independent opportunistic hackers, account for the majority of dollar value stolen through hacks and exploits each year.
Where the money goes
Chainalysis reporting on cross chain and cross asset activity found more than twenty one billion dollars in illicit funds moved through bridges and decentralized exchanges in a recent one year period, reflecting how central cross chain movement has become to modern laundering strategy. This figure covers laundering activity broadly, not just proceeds of theft, underscoring that cross chain movement is now a default step across most categories of illicit cryptocurrency activity, not a niche technique used only by the most sophisticated actors.
The rise in personal wallet compromise
One of the more concerning trends identified in recent Chainalysis reporting is a sharp rise in personal wallet compromise specifically, with roughly one hundred fifty eight thousand separate incidents identified in 2025, affecting at least eighty thousand unique victims. Unlike large, headline generating exchange or protocol breaches, this category represents individual users losing access to their own wallets, often through phishing, malware, or social engineering rather than a systemic platform failure, and it reflects a genuinely large number of separate people affected even when no single incident makes international news.
This distinction matters when reading crypto crime statistics as a whole. Coverage tends to focus on the handful of incidents large enough to move the yearly total by hundreds of millions of dollars, such as a single major exchange or protocol breach. The personal wallet compromise figures are a reminder that a much larger number of individual people are affected by smaller, individually less newsworthy losses every year, and that the aggregate statistics only tell part of the human story behind them.
How the numbers compare to recent years
The direction of these figures has been consistently upward for the past several years, though the composition of the total has shifted meaningfully. Stolen funds from hacks and exploits, once dominated almost entirely by DeFi protocol exploits during the peak years of decentralized finance growth, have increasingly been driven by a smaller number of very large centralized exchange breaches and state linked operations, even as overall DeFi security practices have matured. Sanctions evasion volume has grown especially sharply as more services and individuals have been formally designated, which itself is partly a function of expanding enforcement activity rather than growth in underlying criminal behavior alone. Reading a single year's total in isolation risks missing this kind of compositional shift, which is one reason serious analysis of the data tends to look at category level trends over multiple years rather than a single headline figure.
A note on seizures and recovery
The picture is not entirely one directional. Chainalysis has also published research specifically examining the landscape of seizable crypto assets, tracking how much illicit cryptocurrency has been identified as recoverable through law enforcement seizure processes. Growing exchange cooperation, improved cross chain tracing capability, and more consistent international law enforcement coordination have together made certain categories of theft, particularly those where funds pass through regulated exchanges at some point, meaningfully more likely to result in at least partial recovery than in previous years.
This matters because the headline theft figures alone can paint an overly bleak picture for a new victim trying to understand their own odds. A dollar amount stolen industry wide in a given year says very little about whether any particular case can be resolved. Case specific factors, including how quickly the theft was detected, whether the destination wallet has already touched a regulated exchange, and whether the method used matches a pattern investigators already understand well, matter far more to an individual outcome than the size of the aggregate statistic reported that year.
What the trend line suggests going forward
Total illicit cryptocurrency activity has grown substantially alongside the broader industry, and the concentration of theft among a small number of highly capable actors, combined with the continued reliance on cross chain movement and mixing to obscure proceeds, suggests that the core dynamics documented in 2025 are likely to persist through 2026 rather than reverse on their own. For any individual affected by theft, the statistics reinforce a practical point covered throughout our guides: speed of detection and reporting remains the single factor most within a victim's own control, since funds that reach a monitored exchange quickly are meaningfully more likely to be flagged or frozen than funds given time to move through multiple layers of laundering first.
Frequently asked questions
Chainalysis attributed approximately three and a half billion dollars to hacks and exploits specifically in 2025, within a much larger total illicit activity figure of roughly one hundred fifty four billion dollars that also includes sanctions evasion, scams, and ransomware payments as separate categories.
Blockchain analytics firms attribute wallet activity to specific actors and categories based on ongoing investigation, and new evidence linking previously unlabeled addresses to known illicit activity often surfaces well after an initial report is published, which is why total figures for a given year are sometimes revised upward in later reporting.
No. Even at approximately one hundred fifty four billion dollars, Chainalysis reporting notes that illicit activity represents less than one percent of total attributed cryptocurrency transaction volume, meaning the overwhelming majority of on chain activity is legitimate even as the absolute scale of illicit activity grows alongside the industry.
Scams and fraud, estimated at approximately seventeen billion dollars in 2025, directly affect a large number of individual victims through deception based schemes, distinguishing it from categories like sanctions evasion, which involve transaction volume with designated entities rather than direct victim losses in the same sense.
Sources and further reading
- Crypto Crime Hits $154B in 2026, Says Chainalysis Report · Live Bitcoin News
- 2025 Crypto Theft Reaches $3.4 Billion · Chainalysis
- The Landscape of Seizable Crypto Assets in 2025 · Chainalysis
- 2026 Crypto Crime Report Introduction · Chainalysis