The Dark Web's New Currency: Why Stablecoins Are Surpassing Bitcoin in Illicit Activity
For years, Bitcoin was synonymous with the dark web and illicit transactions. The image of a hooded hacker hoarding Bitcoin in a digital wallet was a common trope. However, that era is rapidly fading. In 2025, a significant shift occurred in the cryptocurrency crime landscape. The volatility of Bitcoin has given way to a more stable, dollar-linked shadow system, with stablecoins becoming the preferred currency for illegal activities. New data from Chainalysis reveals that stablecoins accounted for a staggering 84% of the $154 billion in illicit transaction volume last year, marking a clear and concerning trend towards programmable dollars. This evolution isn't just a change in preference; it's a fundamental restructuring of financial crime, enabling sophisticated networks and even nation-states to evade traditional controls.
Why Criminals Are Ditching Bitcoin
The most striking development in 2025 is the decline of Bitcoin as the primary currency for criminal activity. For over a decade, Bitcoin held this position, but its dominance has steadily eroded since 2020. The shift is visually represented in the illicit activity chart (see below), demonstrating a consistent year-over-year decrease in Bitcoin’s share of illicit flows, while stablecoins have surged to capture the vast majority of the market.
This migration isn't accidental. It mirrors trends in the legitimate crypto economy, where stablecoins are increasingly dominant due to their practical benefits: easy cross-border transferability, lower volatility compared to assets like Bitcoin or Ethereum, and broader utility in decentralized finance (DeFi) applications. However, these very features have made stablecoins the ideal vehicle for sophisticated criminal enterprises.
Essentially, the move away from Bitcoin represents a modernization of financial crime. By leveraging assets pegged to the US dollar, criminal actors are effectively utilizing a shadow version of the traditional banking system – one that operates at the speed of the internet and remains largely outside the immediate reach of US regulators. This “dollarization” of crime allows cartels and state actors to settle payments in a stable unit of account, avoiding the wild price swings that characterize other cryptocurrencies.
The Geopolitical Pivot: Nation-State Involvement
The period from 2009 to 2019 can be considered the “Early Days” of niche cybercriminals. From 2020 to 2024, we saw an era of “Professionalization.” But 2025 marked the arrival of “Wave 3”: large-scale nation-state activity. Geopolitics has now moved on-chain.
Governments are now tapping into the professionalized service providers originally built for cybercriminals, while simultaneously developing their own infrastructure to evade sanctions at scale. Russia, in particular, has demonstrated the viability of state-backed digital assets for sanctions evasion. Following legislation introduced in 2024, Russia launched its ruble-backed A7A5 token in February 2025. Within a year, the token transacted over $93.3 billion, allowing Russian entities to bypass the global banking system and move value across borders without relying on SWIFT or Western correspondent banks.
Similarly, Iran’s proxy networks continue to leverage the blockchain for illicit finance. US sanctions have revealed that Iranian-aligned networks facilitated money laundering, illicit oil sales, and the procurement of arms and commodities to the tune of more than $2 billion. Even amidst military setbacks, Iran-aligned terrorist organizations, including Lebanese Hezbollah, Hamas, and the Houthis, are utilizing cryptocurrency at unprecedented scales.
North Korea also recorded its most destructive year to date in 2025, with DPRK-linked hackers stealing a staggering $2 billion. The February Bybit exploit, resulting in losses of nearly $1.5 billion, was the largest digital heist in cryptocurrency history.
The Industrialization of Money Laundering
This surge in volume is fueled by the emergence of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These networks have dramatically expanded the diversification and professionalization of crypto crime. Building on frameworks established by operations such as Huione Guarantee, they have created full-service criminal enterprises.
These networks offer specialized “laundering-as-a-service” capabilities, supporting a diverse client base ranging from fraudsters and scam operators to North Korean state-backed hackers and terrorist financiers. A key trend in 2025 is the increasing reliance of both illicit actors and nation-states on infrastructure providers offering a “full stack” of services.
These providers, visible on-chain, have evolved from niche hosting resellers into integrated infrastructure platforms. They provide domain registration, bulletproof hosting, and other technical services specifically designed to withstand takedowns, abuse complaints, and sanctions enforcement. By offering a resilient technical backbone, these providers amplify the reach of malicious cyber activity, allowing financially motivated criminals and state-aligned actors to maintain operations even as law enforcement agencies attempt to dismantle their networks.
Convergence of Digital and Physical Threats
While the narrative of crypto crime often focuses on digital theft and laundering, 2025 provided stark evidence that on-chain activity is increasingly intersecting with violent crime in the physical world. Human trafficking operations are increasingly leveraging cryptocurrency for financial logistics, moving proceeds across borders with relative anonymity.
More disturbingly, there’s been a reported rise in physical coercion attacks. Criminals are increasingly using violence to force victims to transfer assets, often timing these assaults to coincide with cryptocurrency price peaks to maximize the value of the theft.
The Bigger Picture: Illicit Activity Remains a Small Percentage
Despite these alarming trends, it’s important to maintain perspective. The illicit volumes tracked in 2025 still represent less than 1% of the legitimate crypto economy. However, the qualitative shift within that 1% is what concerns regulators and intelligence agencies. The integration of nation-states into the illicit supply chain via stablecoins raises the stakes for national security.
As government agencies, compliance teams, and crypto businesses look toward 2026, the challenge will be disrupting a professionalized, state-sponsored shadow economy that has successfully weaponized the efficiency of modern finance. Cooperation among law enforcement, regulatory bodies, and crypto businesses will be crucial, as the integrity of the ecosystem now directly intersects with global geopolitical stability.
Keywords: Dark Web, Stablecoins, Bitcoin, Cryptocurrency, Illicit Activity, Money Laundering, Nation-State Actors, Chainalysis, Crypto Crime, Sanctions Evasion.