Stablecoins have overtaken Bitcoin for illicit activities on the dark web – and the cause is a $154 billion crisis.

The time of the hooded hacker accumulating Bitcoin in a hidden web wallet has come to an end.

By 2025, the focus of the illicit cryptocurrency economy has decisively shifted from the unpredictability of the original cryptocurrency to a more stable, dollar-linked underground system.

New data from Chainalysis, shared with CryptoSlate, indicates that stablecoins constituted 84% of the $154 billion in illicit transactions last year, clearly signaling a shift in risk towards programmable dollars.

This structural change has allowed Chinese money laundering networks to expand their “laundering-as-a-service” operations, while nation-states such as North Korea, Russia, and Iran have also tapped into these same channels to circumvent Western regulations.

Reasons criminals abandoned Bitcoin

The most notable trend observed in the 2025 data is the replacement of Bitcoin as the main currency for crime. For more than ten years, Bitcoin was closely associated with illegal online activities, but its prevalence has diminished steadily since 2020.

The illicit activity chart below illustrates that Bitcoin’s share of illicit flows has decreased annually from 2020 to 2025, while stablecoins have surged to dominate the market.

Stablecoins Dominate Illicit Crypto Activities (Source: Chainalysis)

Related Reading

Cybercriminals abandon Bitcoin for stablecoins as illicit trades possibly exceeded $51 billion in 2024 – Chainalysis

Chainalysis’ analysis shows that stablecoins account for 63% of illicit cryptocurrency transactions, as criminals evade detection through the use of privacy assets and DeFi platforms.

Feb 27, 2025 · Assad Jafri

This transition is not coincidental. It reflects trends within the broader legitimate cryptocurrency economy, where stablecoins are gaining prominence due to their practical advantages: easy cross-border transfers, lower volatility compared to assets like Bitcoin or Ethereum, and greater utility in decentralized finance (DeFi) applications.

However, these same characteristics have rendered stablecoins the preferred option for advanced criminal enterprises.

Thus, the pivot away from Bitcoin signifies a modernization of financial crime.

By utilizing assets tied to the US dollar, criminal entities effectively exploit a shadow version of the conventional banking system, one that operates at internet speed and exists beyond the immediate reach of US regulators.

This “dollarization” of crime enables cartels and state actors to conduct transactions in a stable unit of account without being subject to the severe price fluctuations that define the rest of the cryptocurrency market.

The geopolitical shift

If the timeframe from 2009 to 2019 was considered the “Early Days” of rogue niche cybercriminals, and 2020 to 2024 represented the “Professionalization” era, 2025 heralded the emergence of “Wave 3”: large-scale nation-state involvement.

In this new stage, geopolitics has moved onto the blockchain. Governments are now leveraging the professionalized service providers initially established for cybercriminals while simultaneously developing their own tailored infrastructure to evade sanctions on a large scale.

Russia, in particular, illustrated the feasibility of state-supported digital assets for sanction evasion. Following the introduction of legislation in 2024 to facilitate such operations, the country launched its ruble-backed A7A5 token in February 2025.

In less than a year, this token processed over $93.3 billion, enabling Russian entities to bypass the global banking infrastructure and transfer value across borders without relying on SWIFT or Western correspondent banks.

Likewise, Iran’s proxy networks have continued to exploit blockchain technology for illicit financing.

Related Reading

US sanctions claim Iran’s oil-for-crypto network transferred $100M from 2023 to 2025

The Treasury Department states that two individuals utilized layered fronts to route funds, placing any US-affiliated counterparties at immediate risk of substantial penalties.

Sep 17, 2025 · Oluwapelumi Adejumo

Confirmed wallets identified in sanctions designations reveal that Iranian-aligned networks facilitated money laundering, illegal oil sales, and the procurement of arms and commodities amounting to over $2 billion.

Despite various military challenges, Iran-aligned terrorist groups, including Lebanese Hezbollah, Hamas, and the Houthis, are employing cryptocurrency on a scale never previously observed.

North Korea also experienced its most destructive year to date. DPRK-linked hackers stole $2 billion in 2025, a figure driven by extensive mega-hacks.

The most significant of these was the February Bybit exploit, which resulted in losses nearing $1.5 billion, marking the largest digital theft in cryptocurrency history.

Industrialization of money laundering

This increase in volume is bolstered by the rise of Chinese money laundering networks (CMLNs) as a key player in the illicit on-chain ecosystem. These networks have significantly expanded the diversification and professionalization of cryptocurrency crime.

Building on frameworks established by operations like Huione Guarantee, these networks have developed comprehensive criminal enterprises.

They provide specialized “laundering-as-a-service” options, catering to a varied clientele that includes fraudsters, scam operators, North Korean state-backed hackers, and terrorist financiers.

Related Reading

North Korean IT workers earned $17M this year with some funds originating from Circle accounts

North Korean IT workers breach crypto security, highlighting US exchanges and stablecoin utilization.

Jul 2, 2025 · Oluwapelumi Adejumo

A significant trend identified in 2025 is the growing dependency of both illicit actors and nation-states on infrastructure providers that offer a comprehensive range of services.

These providers, which are also visible on-chain, have evolved from niche hosting resellers into integrated infrastructure platforms. They offer domain registration, bulletproof hosting, and various technical services specifically designed to endure takedowns, abuse complaints, and sanctions enforcement.

By delivering a robust technical foundation, these providers enhance the reach of malicious cyber activities. They enable financially motivated criminals and state-aligned actors to sustain operations even as law enforcement agencies strive to dismantle their networks.

Convergence of digital and physical threats

While the narrative surrounding crypto crime often emphasizes digital theft and laundering, 2025 provided clear evidence that on-chain activities are increasingly intertwining with violent crime in the physical realm.

Human trafficking operations have increasingly utilized cryptocurrency for financial logistics, facilitating the movement of proceeds across borders with a degree of anonymity.

Even more alarming is the reported increase in physical coercion attacks. Criminals are increasingly resorting to violence to compel victims to transfer assets, often timing these assaults to coincide with spikes in cryptocurrency prices to maximize the value of the theft.

Illicit activity remains under 1% of the crypto economy

Despite these concerning trends, it is essential to maintain perspective. The illicit volumes tracked in 2025 still account for less than 1% of the legitimate cryptocurrency economy.

However, the qualitative change within that 1% is what alarms regulators and intelligence agencies. The involvement of nation-states in the illicit supply chain through stablecoins heightens the stakes for national security.

As government agencies, compliance teams, and security professionals look ahead to 2026, the challenge will be dismantling a professionalized, state-sponsored shadow economy that has effectively weaponized the efficiency of modern finance.

Collaboration among law enforcement, regulatory bodies, and cryptocurrency businesses will be vital, as the integrity of the ecosystem now directly intersects with global geopolitical stability.

The post Stablecoins just replaced Bitcoin for crime on the dark web – and the reason why is a $154 billion nightmare appeared first on CryptoSlate.