TRM Labs Reports 86% of Illicit Stablecoin Transactions Linked to Sanctions Evasion, 2026/02/20 09:25:57

Over the past year, the monthly transaction volume in stablecoins has frequently surpassed $1 trillion, according to analysts from TRM Labs. Wallets linked to illicit activities received $141 billion in stable tokens.

A significant portion of illegal crypto transactions is associated with financial crimes, primarily involving sanctions evasion and large-scale money laundering, experts indicate. The majority—86%—pertains to operations linked to sanctions. Wallets, exchanges, and payment platforms under restrictions play a crucial role in this context.

The extent and nature of stablecoin usage significantly vary depending on the type of crime, the study notes. The Kyrgyz network A7 and its associated entities, including the Russian exchanges Garantex and Grinex, utilize stablecoins not only for direct payments but also as an internal settlement infrastructure among affiliated parties. These networks intersect with ecosystems linked to China, Iran, North Korea, and Venezuela.

In the realm of illegal goods and services, as well as human trafficking, stablecoins exhibit almost complete dominance. In cases of fraud, ransomware attacks, and hacking incidents, they are used selectively: Bitcoin or other assets are more commonly employed in the initial stages, while stablecoins are integrated during the money laundering phase.

In the segment of prohibited substances, the use of stablecoins remains moderate: here, traditional crypto payments are combined with the increasing adoption of stable tokens. Conversely, in the circulation of illegal content involving minors, the share of stablecoins is minimal—alternative payment methods or fragmented transaction schemes prevail.

The primary channels for illicit fund transfers and money laundering are escrow and guarantee services: up to 99% of transactions there are denominated in stablecoins, analysts report. This pertains to platforms like the British Zedcex and Zedxion, which facilitate quick transfers and low fees. Approximately 83% of incoming volumes in 2024–2025 are expected to be attributed to USDT.

In January 2026, the U.S. Office of Foreign Assets Control (OFAC) imposed sanctions on these services for facilitating Iranian financial networks, including the Islamic Revolutionary Guard Corps. 

Of the $141 billion, around $72 billion was associated with the A7A5 token, pegged to the ruble, TRM Labs reported. Its activity is almost entirely concentrated within ecosystems that assist in circumventing restrictions.