Loading story…
Blockchain intelligence reporting indicated illicit cryptocurrency flows hit a record $158B in 2025, a sharp increase attributed largely to sanctions-linked activity (notably Russia-associated networks and stablecoin usage), broader state and state-aligned adoption of crypto for financial infrastructure (including Russia, Iran, and Venezuela), and improved attribution/intelligence sharing that surfaced previously unattributed flows. The same reporting highlighted continued criminal monetization via crypto, including $2.87B stolen across 150 hacks in 2025 (with the largest share concentrated in a small number of incidents) and roughly $35B sent to scam schemes, dominated by investment-style fraud.
Belgian authorities separately reported escalating investment fraud losses in H2 2025, with more than €10.5M lost via fraudulent trading platforms often marketed as crypto-related, and an additional €9.5M+ tied to “exclusive” investment advice pushed through WhatsApp groups. In response, Belgium’s CCB/partners promoted public reporting and expanded disruption via the Belgian Anti-Phishing Shield (BAPS), with the FSMA able to submit suspected fraudulent sites for blocking/redirection to warning pages to reduce victimization.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
The CCB and FSMA said they were using the Belgian Anti-Phishing Shield to block access to fraudulent investment websites and redirect users to a warning page. This was described as part of their response to rising investment fraud.
TRM Labs observed elevated ransomware inflows in 2025, a record number of victims listed on extortion portals, and signs that more victims were refusing to pay. The firm also documented ecosystem fragmentation, with 161 active strains and 93 new variants, alongside a shift in laundering from mixers to bridges and cross-chain routing.
According to TRM Labs, roughly $35 billion was sent to scam operations in 2025, with investment scams such as romance baiting, Ponzi schemes, and fake task scams dominating. The report said these schemes appeared increasingly professional, potentially aided by AI tools.
TRM Labs reported that illegal cryptocurrency flows reached a record $158 billion in 2025, up 145% from 2024 and reversing a three-year decline. The firm attributed the increase mainly to sanctions-linked activity, expanded nation-state use of crypto, and improved attribution of previously unattributed flows.
TRM Labs reported that 150 hacking incidents in 2025 caused $2.87 billion in losses. The total included the Bybit breach as the dominant event of the year.
FSMA figures for the second half of 2025 showed more than €10.5 million lost through fraudulent trading platforms and more than €9.5 million through WhatsApp-based 'exclusive' investment advice schemes. The scams were largely tied to purported cryptocurrency investments and represented nearly half of fraud reports received by the FSMA.
During October 2025, reports of fraudulent investment platforms increased in Belgium. Authorities interpreted the rise as a sign of improved public awareness and reporting during the campaign period.
The Belgian Cyber Security Centre (CCB) and partners launched the Safeonweb investment-fraud awareness campaign in 2025 to address growing investment fraud. Later figures were presented as validating the need for this campaign.
A February 2025 breach of Bybit resulted in about $1.46 billion in losses. TRM Labs attributed the incident to North Korean hackers, making it the largest single hack cited in its 2025 illicit crypto analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourceccb.belgium.be
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Illicit cryptocurrency activity reached unprecedented levels in 2025, with at least $154 billion in crypto flowing to addresses linked to criminal activity, according to Chainalysis. This surge was primarily driven by a dramatic increase in transactions involving sanctioned entities, which saw a 694% year-over-year rise. Nation-states have become increasingly involved, leveraging both established criminal infrastructure and developing their own on-chain systems to evade sanctions at scale. The professionalization of the illicit crypto ecosystem now enables transnational criminal networks and governments to launder funds and procure goods and services more efficiently, raising the stakes for both consumer protection and national security. Concurrently, global fraud has evolved into a strategic tool for both organized crime and hostile states, integrating advanced technical tactics such as bot farms, malware, and cryptocurrencies. Governments and private sector organizations are responding by forming international task forces to address the industrialization of fraud, which now rivals the GDP of major economies. North Korea and other pariah states are specifically cited for weaponizing cyber-enabled fraud networks to circumvent sanctions and generate revenue, further blurring the lines between traditional financial crime and cyberwarfare. The convergence of nation-state actors and criminal syndicates in the crypto space underscores the urgent need for coordinated global action to counter these threats.
Jun 29, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026
INTERPOL and industry reporting warn that transnational fraud networks are becoming more sophisticated and more profitable by combining **AI-enabled deception**, crypto abuse, and organized scam-center operations. INTERPOL’s 2026 Global Financial Fraud Threat Assessment says AI-enhanced fraud is **4.5 times** more profitable than traditional methods and links financial fraud to broader criminal ecosystems including cybercrime, human trafficking, and terrorist financing. Researchers and investigators described tools such as **ProKYC** that can forge identity documents, generate deepfaked liveness checks, create selfie-with-ID images, and tailor verification artifacts to defeat KYC controls, while a cybercrime forum vendor separately advertised fraudulently verified accounts on exchanges including `Bitget`, `Bitvavo`, and `Kraken` with European IBAN and SEPA capabilities, underscoring how criminals are abusing rather than breaching financial platforms. Authorities are responding with wider enforcement actions against the infrastructure behind these scams. In India, Goa police arrested seven suspects, questioned 24 others, raided more than 40 locations across 11 states, and identified **313 suspected mule accounts** in an investigation spanning investment scams, sextortion, parcel fraud, fake hotel bookings, and so-called digital arrest schemes. In Cambodia, officials said raids across at least five provinces led to more than **1,000 arrests** tied to cybercrime and online scam compounds, part of a broader regional crackdown on an industry the UN says generates billions of dollars annually and has been linked to trafficked workers and abuse. INTERPOL said fraud-related Notices and Diffusions have risen **54% since 2024**, with support in more than **1,500** transnational fraud cases involving **$1.1 billion** in losses, and it is launching **Operation Shadow Storm** to target scam-centre-linked fraud, cybercrime, and human trafficking.
Aug 5, 2026