Stablecoins have become both core crypto “plumbing” and a key rail for the most consequential forms of crypto-enabled crime, with illicit activity increasingly concentrated in a handful of large, sanctions-linked networks, TRM Labs said Tuesday. 

In new analysis, TRM reported that stablecoin transaction value surged through 2025, repeatedly topping $1 trillion in monthly volume in the second half of the year. The trend suggests stablecoins are being used as durable payment and settlement vehicles rather than as a means for speculative trading, according to the analytics firm.

But sanctions evasion and large-scale money laundering have become “deeply reliant” on stablecoins because currency-pegged virtual currencies offer speed, liquidity, and protection from volatility, the company said. 

Illicit actors received $141 billion via stablecoin wallets in 2025, including $72 billion linked to A7A5, a ruble-pegged stablecoin whose activity it described as overwhelmingly concentrated in sanctions-linked ecosystems. Excluding A7A5, TRM said stablecoins still represented 42% of illicit volume, and 86% of illicit crypto flows overall, TRM found.

The analysis described sanctions evasion as increasingly institutionalized around networked “financial systems,” pointing to the A7 network as a cross-border platform that scaled functions once handled by smaller actors. 

TRM said a leak of internal A7 communications enabled attribution of a large address cluster with at least $83 billion in direct volume, with additional flows routed through intermediaries tied to shell companies and foreign trade partners. TRM also reported on-chain exposure between A7 and sanctioned Russian exchanges such as Garantex and Grinex, including links to affiliated entities registered in places such as Kyrgyzstan.

Read more at TRM Labs