Table of Contents
Stablecoins have moved from the margins of the crypto sector to the center of the digital economy, carrying both mainstream payments and some of the most illicit forms of financial crime.
New analysis from TRM Labs shows monthly stablecoin transaction volumes topped $1 trillion several times in 2025, underscoring their emergence as foundational payment and settlement rails. At the same time, illicit actors received about $141 billion via stablecoin wallets, with activity heavily concentrated in sanctions evasion and large-scale money laundering instead of being spread evenly across all forms of crypto crime.
Trillion-dollar flows show structural shift
The research shows that stablecoin activity climbed steadily through early 2025 before accelerating sharply in the second half of the year, with monthly transaction volumes repeatedly exceeding $1 trillion, and even after brief pullbacks late in the year, monthly volumes remained well above 2023 and most of 2024 levels, signaling that the expansion is not simply another trading cycle.
The pattern points to stablecoins being used as durable financial infrastructure, a way to move value quickly, cheaply, and without price volatility across exchanges, payment platforms, and cross-border networks.
A7 and A7A5 Drive 86% of Illicit Stablecoin Flows
TRM data indicates that stablecoins accounted for 86% of all illicit crypto flows in 2025 and 42% of all illicit transaction volumes once activity related to the A7A5 token is excluded, with dominance anchored in a relatively narrow but high-impact set of sanctions-linked networks and professional money movers.
Of the $141 billion received by illicit entities via stablecoins in 2025, $72 billion was tied specifically to A7A5, a ruble-pegged token whose activity is concentrated in sanctioned ecosystems, where it primarily services Russian exchanges, such as Garantex and other designated platforms for customer-facing payments and internal settlement between affiliated entities.
The TRM examination of Russian crypto flows since the start of the war in Ukraine shows sanctions evasion consolidating into more institutional structures, with activity increasingly accumulating around the A7 cross-border payment network, where a leak of internal communications helped map a web of addresses handling at least $83 billion in direct volume, alongside further flows routed through shell companies and foreign trade partners.
Illicit markets show uneven stablecoin adoption
Outside sanctions, stablecoin reliance varies sharply by crime type, with scams and investment fraud showing high usage, as fraudsters often solicit payments in volatile assets during speculative booms and then convert them into stablecoins during the laundering phase, while ransomware and hacking operations likewise tend to begin with Bitcoin or other assets before shifting into stablecoins to manage risk and cash out.
Guarantee and Escrow Services Move Up to $17 Billion a Quarter in Stablecoins
A significant share of illicit goods and services volume is not classic dark market commerce but financial intermediation, with activity channeled through informal over-the-counter desks, hybrid brokers, and other facilitators that sit between exchanges and marketplaces, and many of the large laundering wallets identified by the T3 Financial Crime Unit, a joint effort by TRON, Tether, and TRM, fall into this category, where stablecoins serve as the main rail for moving funds at scale.
Guarantee and escrow services show an even sharper dependence, with TRM finding that roughly 99% of their volume is in stablecoins, with activity rising from well under $1 billion per quarter in 2022 to above $17 billion per quarter at peaks before a sharp drop in late 2025 following enforcement action against Huione and the Huione-backed Haowang Guarantee, as these platforms were functioning as laundering, settlement, and cash-out infrastructure downstream of scams and other predicate crimes, using stablecoins to support high-frequency, large-value flows.
Regulators Target Sanctions Networks, Laundering Hubs and New Fiat-Pegged Tokens
The data suggests that stablecoins will remain central to both legitimate crypto markets and major forms of illicit activity, shifting the question for regulators, banks, and law enforcement from whether they matter to where they function as critical rails rather than incidental tools.
TRM concludes by highlighting three areas to watch, the growing institutionalization of sanctions evasion networks, the use of stablecoins in industrialized laundering through guarantee and over-the-counter facilitators, and the rise of new fiat-pegged tokens in constrained markets.
