BlockSec: Sanctions and Scams Drove Crypto Crime in 2025

BlockSec has released its 2025 Crypto Crime Report, focusing on activity across Ethereum and TRON and analyzing six major categories of crypto-enabled crime, from scams and hacks to sanctions-linked flows.

The report’s headline takeaway is uncomfortable but actionable: illicit activity is growing in specific corridors—and it’s highly concentrated, creating clear intervention points for stablecoin issuers, exchanges, and enforcement.

A report built around Ethereum and TRON crime lanes

BlockSec says the 36-page report examines scams, hacks/exploits, terrorist financing, human trafficking, drug trafficking, and sanctions-related activity on Ethereum and TRON. It combines quantitative estimates of illicit revenue with on-chain laundering pathway analysis and “risk concentration points.”

The stated goal is to answer three operational questions: how illicit scale changed, how laundering evolved, and where structural leverage points exist for disruption.

Sanctions-linked volume surged—driven by A7A5

BlockSec’s first major finding: sanctions-related transaction volume jumped by nearly $100 billion in 2025 versus the prior year. It attributes the bulk of that increase to the ruble-denominated stablecoin A7A5, which it says accounted for $70 billion in transaction volume and is designed to bypass traditional channels.

This framing matters because it treats sanctions activity not as scattered “bad wallets,” but as a system-level flow pattern where a single instrument can dominate volume.

Lazarus and the “layered laundering” playbook

BlockSec highlights Lazarus Group as the most sophisticated threat actor in its dataset, pointing to a $1.5 billion Bybit exploit in 2025 and describing an increasingly tool-driven laundering strategy on Ethereum.

One specific signal BlockSec calls out: 20.1% of illicit funds are “hidden through mixers like Tornado Cash.”

Stablecoins are turning into enforceable compliance rails

BlockSec argues stablecoins have shifted from passive transfer tools into “active regulatory interfaces.” It says freezing activity reached a structural turning point in 2025, and points to how sanctions listings (it cites Huione Group as an example) can increase “traceable illicit flows” by billions.

The practical implication in BlockSec’s wording: stablecoin issuers can increasingly enforce rules at the contract layer—meaning compliance outcomes can change quickly when blacklists and enforcement actions hit key nodes.

Southeast Asia scams and TRON’s low-fee laundering economy

BlockSec describes Southeast Asia’s scam ecosystem as an industrialized “human supply chain,” and says Huione Group represented ~2.73% of all scam-related funds on TRON, acting as a key laundering node.

It also flags a separate trend: drug trafficking activity shifting on-chain, with TRON as the primary venue due to low transaction costs, and laundering methods starting to resemble professional financial services rather than informal cash movement.

The “80% concentration” enforcement lever

The report’s most operational conclusion is about concentration risk: BlockSec says illicit proceeds are not evenly distributed. On TRON, it estimates over 80% of scam proceeds ultimately flow into a small number of centralized exchanges, calling this a major opportunity for enforcement and risk controls.

Simply put: if compliance teams and regulators pressure the right liquidity choke points, disruption can be disproportionate to effort.

Why it matters for crypto

• Sanctions-linked stablecoin volume is becoming systemically meaningful, not a niche edge case.
• Lazarus-style laundering is evolving into layered, tool-driven workflows—raising the bar for monitoring on Ethereum.
• Stablecoin freezes and sanctions designations are increasingly “market structure” events for illicit flows.
• TRON remains a focal network for scams and trafficking flows due to cost and liquidity characteristics.
• Concentration at a small set of exchanges suggests enforcement and compliance can be targeted rather than diffuse.

What to watch next

• Whether exchanges identified as major liquidity hubs tighten TRON-related screening and cash-out controls.
• More sanctions actions tied to stablecoin corridors like A7A5 and entities BlockSec flags as key nodes.
• Changes in mixer usage (BlockSec’s 20.1% figure) as enforcement pressure shifts.
• Stablecoin issuer policy moves—freezes, risk scoring, and contract-level enforcement escalation.
• Follow-up case studies BlockSec said it will publish to detail attack paths and laundering structures.

Source: BlockSec – blog post announcing the 2025 Crypto Crime Report