Stablecoins at Scale: Broad Adoption and Highly Concentrated Illicit Networks

Key takeaways

• Stablecoin activity exceeded USD 1 trillion in monthly transaction volume multiple times in 2025, reinforcing their role as core payment and settlement infrastructure rather than speculative trading instruments.
  
• In 2025, illicit entities received approximately USD 141 billion via stablecoin wallets, with the majority of this activity concentrated in financial crimes such as sanctions evasion and large-scale money laundering.
  
• Sanctions-related activity accounted for 86% of all illicit crypto flows in 2025, driven largely by sanctioned wallets, exchanges, and networked payment platforms relying heavily on stablecoins.
  
• Stablecoin usage varies sharply by illicit category, with near-total adoption in illicit goods and services and laundering networks, compared to more selective use in scams, fraud, ransomware and other opportunistic crime types.
  
• Professional facilitators and networked intermediaries — including guarantee services and front-company exchanges where up to 99% of volume is denominated in stablecoins — represent the primary locus of stablecoin-related illicit risk.

‍

{{horizontal-line}}

‍

In light of the recent crypto market downturn, jurisdictions are debating the future role of stablecoins. In the United States, policymakers and industry participants are considering the role of interest-bearing stablecoin accounts, while in China, there has been renewed discussion about the future of stablecoins. 

Examining stablecoin volumes and their role across different types of crypto-enabled crime provides a clearer picture of why these instruments have become central to the global crypto economy — and why they now sit at the center of regulatory and enforcement debates.

The rise of stablecoins as financial infrastructure

Stablecoin activity has accelerated sharply over the past year, with 2025 marking a clear inflection point. Monthly volumes climbed steadily through early 2025 before surging in the second half of the year, repeatedly exceeding USD 1 trillion in monthly transaction value. This growth stands out not just for its scale but for its consistency, suggesting that stablecoins are increasingly being used as foundational payment and settlement infrastructure rather than as a byproduct of speculative trading cycles. Even after brief pullbacks late in the year, volumes remained far above levels seen in 2023 and most of 2024.

Illicit stablecoin use is fragmenting by crime type

There is increasing focus on the role of stablecoins in enabling illicit activity, with critics often treating stablecoins as a uniform risk across all forms of crypto-enabled crime. The data, however, tells a more nuanced story. 

Stablecoins do not support all illicit activity equally. Their impact depends heavily on the type of crime involved. Sanctions evasion and large-scale money laundering are deeply reliant on stablecoins, which offer speed, liquidity, and insulation from volatility. By contrast, scams, ransomware, and hacking activity make more selective use of stablecoins, often favoring bitcoin or other assets at the point of offense before turning to stablecoins later in the laundering process. Understanding these distinctions is critical to interpreting stablecoin risk and designing effective policy responses.

Sanctions-linked networks anchor illicit stablecoin usage

In 2025, illicit entities received USD 141 billion via stablecoin wallets, with USD 72 billion linked specifically to the A7A5 token. This was the highest level observed in the past five years. Rather than reflecting broad-based growth across all crypto-enabled crime, the 2025 increase points to deeper reliance on stablecoins within specific activity types where they offer clear operational advantages, particularly sanctions-linked networks and large-scale money movement services. 

The growth in illicit stablecoin usage is increasingly shaped by sanctions-related activity, but that category is influenced by multiple dynamics. 

By 2025, stablecoins accounted for 86% of all illicit crypto flows and 42% of all volumes when removing A7A5 volumes. This figure is driven in large part by activity associated with sanctioned wallets and networks. Any transactions involving wallets designated by OFAC are, by definition, considered sanctions-related, and many of these designated services — including Russian exchanges such as Garantex — have historically operated primarily using stablecoins. In 2025, this pattern expanded further with the emergence of A7A5, a ruble-pegged stablecoin whose activity is almost entirely concentrated within sanctions-linked ecosystems.

Available evidence suggests that within networks such as A7, stablecoins including USDT and A7A5 function not only as direct payment instruments, but also as internal settlement rails used to reconcile activity across affiliated entities and intermediaries, sometimes alongside parallel fiat operations. This layered role helps explain the scale and persistence of stablecoin usage within sanctions evasion networks, which increasingly operate as cross-border financial systems rather than isolated actors. These networks also intersect with other state-linked ecosystems, including entities tied to China, Iran, North Korea, and Venezuela, underscoring how stablecoins have become a connective infrastructure for sanctioned actors seeking to move value outside traditional financial controls.

Beyond individually sanctioned entities, sanctions evasion has increasingly consolidated into structured networks. TRM Labs’ analysis of Russia’s crypto activity since the invasion of Ukraine shows that by 2025, sanctions evasion had become more institutionalized, coalescing around the A7 network, a cross-border payment platform that scaled and centralized functions previously handled by smaller, fragmented actors. A leak of internal A7 communications enabled attribution of a large group of addresses associated with at least USD 83 billion in direct volume, with additional flows routed through intermediary wallets linked to shell companies and foreign trade partners across the planet. On-chain evidence reveals significant bidirectional exposure between A7, sanctioned Russian exchanges such as Garantex and Grinex, and affiliated entities registered in jurisdictions like Kyrgyzstan. These networks rely heavily on stablecoins to move value across borders while avoiding volatility and banking restrictions, helping explain why stablecoin usage within sanctions-related activity has remained elevated even as other illicit categories fluctuate.

Beyond sanctions, stablecoin adoption varies sharply by illicit category, reflecting different operational needs. Scam and investment fraud activity shows high stablecoin usage but not universal reliance, consistent with fraud schemes that still target volatile assets during speculative cycles before converting into stablecoins for laundering. By contrast, categories such as illicit goods and services and human trafficking show near-total stablecoin usage, suggesting these markets prioritize payment certainty and liquidity over price appreciation. Banned or controlled substances sit closer to the middle, reflecting a mix of legacy crypto payment norms and growing stablecoin adoption, while child sexual abuse material (CSAM) vendors show much lower stablecoin usage, likely due to reliance on alternative payment methods and more fragmented transaction structures.

Illicit goods and services: Stablecoins as the preferred payment rail

The illicit goods and services category in particular appears structurally predisposed toward stablecoins. Much of the activity in this category is driven not by traditional goods markets, but by money-mover services such as informal OTC desks and hybrid financial facilitators that do not fit cleanly into exchange or marketplace classifications. This category also captures a large share of activity identified through the T3 Financial Crime Unit, a collaboration between TRON, Tether, and TRM — where wallets associated with large-scale laundering networks are labeled as illicit goods and services where possible. For actors transacting in illicit goods and services, stablecoins offer speed, reliability, and low transaction costs, making them the preferred rail for moving funds at scale. As a result, high stablecoin penetration in this category reflects not just criminal preference, but the industrialization of illicit financial services themselves.

Guarantee and escrow services: Stablecoins as laundering infrastructure

The finding that illicit financial services rely on stablecoins is consistent with TRM prior research on guarantee services, which also heavily prioritize stablecoins for transactions. Activity tied to these entities expanded rapidly from 2022 through mid-2025, rising from well under USD 1 billion per quarter to peaks above USD 17 billion, before a sharp decline in late 2025. The fact that roughly 99% of this volume is denominated in stablecoins reinforces the role these services play as laundering infrastructure, not speculative venues. Guarantee services function primarily as money movement and settlement layers, and stablecoins offer the speed, price stability, and low transaction costs required to support large-scale high-frequency laundering, escrow, and cash-out operations. 

Prior TRM research similarly indicated that these platforms sit downstream of scams and other predicate crimes, absorbing proceeds and redistributing them through OTC brokers, wallets, and informal exchanges, with stablecoins serving as the dominant rail. The sustained growth through 2024 and into 2025 underscores how deeply embedded stablecoins have become in industrialized laundering ecosystems, even as enforcement pressure increases. The late 2025 decline was due to the crack down affecting Huione and the Huione-backed Haowang Guarantee in October 2025.

Zedcex and Zedxion: Stablecoins as the operating rail for front-company exchanges

On-chain analysis of Zedcex and Zedxion illustrates how stablecoins function as the core operating rail for exchange services structured as front companies rather than conventional trading platforms, including networks linked to Iranian financial facilitators. Although both entities presented themselves as UK-based digital asset exchanges, their activity patterns were highly concentrated and inconsistent with broad retail exchange usage. Transaction flows show a heavy reliance on stablecoins, particularly Tether, which dominated the value moving through these services.

In January 2026, the US Treasury’s Office of Foreign Assets Control designated Zedcex and Zedxion in the first-ever sanctions targeting digital asset exchanges for operating in Iran’s financial sector and processing funds tied to Iran’s Islamic Revolutionary Guard Corps, underscoring how stablecoin-based exchange infrastructure was used to support sanctioned Iranian networks.

Between 2024 and 2025, roughly 83% of total incoming volume to Zedcex and Zedxion, was denominated in USDT. This concentration, illustrated in the accompanying pie chart, underscores that these platforms were not facilitating diversified crypto trading, but instead operating primarily as value-transfer intermediaries. Stablecoins provided the liquidity, price stability, and transactional efficiency required to move funds at scale, reinforcing TRM’s broader finding that front-company exchanges and high-risk financial facilitators overwhelmingly rely on stablecoins as settlement infrastructure rather than as speculative assets.

Looking ahead: Stablecoins, risk, and regulatory focus

Looking ahead, the data suggest that stablecoins will remain central to both legitimate crypto activity and the most consequential forms of crypto-enabled crime — making them a critical focus for regulators, financial institutions, and law enforcement. 

Overall, stablecoin usage has matured into core financial infrastructure, with sustained growth across multiple chains and clear evidence of real-world payment and settlement use. On the illicit side, adoption is increasingly uneven and shaped by operational needs: sanctions-linked networks, laundering facilitators, and front-company exchanges rely heavily on stablecoins, while other crime types use them more selectively. 

At TRM, we are closely monitoring the continued institutionalization of sanctions evasion networks, the role of stablecoins in industrialized laundering services such as guarantee and OTC facilitators, and the emergence of new fiat-pegged instruments designed to serve constrained ecosystems. Understanding where stablecoins function as systemic rails rather than incidental tools will be essential to anticipating risk, targeting enforcement, and shaping effective policy responses in the years ahead.