Stablecoins Just Overtook Bitcoin for Dark Web Crime – And the $154 Billion Reason Behind It Is a Nightmare

Forget Bitcoin—the dark web’s new currency of choice is stablecoins. A seismic shift in underground finance is underway, and the implications are staggering.

The $154 Billion Anonymity Problem

Stablecoins now dominate illicit transactions not because criminals love price stability, but because they’ve mastered anonymity at scale. The very feature that made Bitcoin traceable—its public ledger—is being bypassed by dollar-pegged tokens moving through privacy mixers and cross-chain bridges. Law enforcement’s old playbook is obsolete overnight.

Regulators Scramble as Architecture Evolves

Traditional monitoring tools falter when transactions hop between chains or vanish into algorithmic pools. The irony? This $154 billion shadow economy thrives on tokens explicitly designed for regulatory compliance. It’s the ultimate financial satire—governments champion stablecoins for mainstream adoption, only to watch them become the underworld’s perfect vehicle.

Privacy Tech Outpaces Surveillance

Zero-knowledge proofs, stealth addresses, and decentralized tumblers aren’t theoretical anymore. They’re operational, turning stablecoins into near-cash equivalents with global reach and plausible deniability. The dark web didn’t abandon Bitcoin—it upgraded.

The Compliance Paradox

Every banking-style KYC rule applied to stablecoin issuers inadvertently fuels demand for harder-to-trace alternatives. A cynical take? The regulatory push for "safe" digital dollars created the monster they feared—a system where crime pays in tokens backed by Treasury bills.

This isn’t a blip. It’s the new reality—a nightmare unfolding inside the very infrastructure meant to sanitize crypto. The dark web just modernized its treasury, and everyone’s playing catch-up.

Why criminals ditched Bitcoin

The most striking trend in the 2025 data is the displacement of bitcoin as the primary currency of crime. For over a decade, Bitcoin was synonymous with illicit online activity, but its dominance has eroded steadily since 2020.

As shown in the illicit activity chart below from 2020 to 2025, Bitcoin's share of dirty flows has plummeted year after year, while stablecoins have surged to capture the vast majority of the market.

Cybercriminals ditch Bitcoin for stablecoins as illicit trades potentially surpassed $51 billion in 2024 – Chainalysis

Chainalysis' analysis reveals stablecoins account for 63% of illicit crypto transactions as criminals evade detection using privacy assets and DeFi platforms.

This migration is not accidental. It mirrors trends in the broader, legitimate crypto economy, where stablecoins are increasingly dominant due to their practical benefits: easy cross-border transferability, lower volatility than assets like Bitcoin or Ethereum, and broader utility in decentralized finance (DeFi) applications.

However, these same features have made stablecoins the preferred vehicle for sophisticated criminal enterprises.

So, the shift away from Bitcoin represents a modernization of financial crime.

By leveraging assets pegged to the US dollar, criminal actors effectively utilize a shadow version of the traditional banking system, one that moves at the speed of the internet and operates outside the immediate reach of US regulators.

This “dollarization” of crime allows cartels and state actors to settle payments in a stable unit of account without exposure to the wild price swings that characterize the rest of the crypto market.

The geopolitical pivot

If the period from 2009 to 2019 was the “Early Days” of rogue niche cybercriminals, and 2020 to 2024 was the era of “Professionalization,” 2025 marked the arrival of “Wave 3”: Large-scale nation-state activity.

In this new phase, geopolitics has moved on-chain. Governments are now tapping into the professionalized service providers originally built for cybercriminals while simultaneously standing up their own bespoke infrastructure to evade sanctions at scale.

Russia, in particular, demonstrated the viability of state-backed digital assets for sanctions evasion. Following legislation introduced in 2024 to facilitate such activities, the country launched its ruble-backed A7A5 token in February 2025.

In less than one year, the token transacted over $93.3 billion, allowing Russian entities to bypass the global banking system and MOVE value across borders without relying on SWIFT or Western correspondent banks.

Similarly, Iran’s proxy networks have continued to leverage the blockchain for illicit finance.

US sanctions say Iran’s oil for crypto web pushed $100M through 2023 to 2025

Treasury says two men used layered fronts to route funds, putting any US-touch counterparties at immediate risk of sweeping penalties.

Confirmed wallets identified in sanctions designations show that Iranian-aligned networks facilitated money laundering, illicit oil sales, and the procurement of arms and commodities to the tune of more than $2 billion.

Despite various military setbacks, Iran-aligned terrorist organizations, including Lebanese Hezbollah, Hamas, and the Houthis, are utilizing cryptocurrency at scales never before observed.

North Korea also recorded its most destructive year to date. DPRK-linked hackers stole $2 billion in 2025, a figure driven by devastating mega-hacks.

The most notable of these was the February Bybit exploit, which resulted in losses of nearly $1.5 billion, marking the largest digital heist in cryptocurrency history.

Money laundering industrialization

This surge in volume is supported by the emergence of Chinese money laundering networks (CMLNs) as a dominant force in the illicit on-chain ecosystem. These networks have dramatically expanded the diversification and professionalization of crypto crime.

Building on frameworks established by operations such as Huione Guarantee, these networks have created full-service criminal enterprises.

They offer specialized “laundering-as-a-service” capabilities, supporting a diverse client base that ranges from fraudsters and scam operators to North Korean state-backed hackers and terrorist financiers.

North Korean IT workers earned $17M this year with some funds coming from Circle accounts

North Korean IT workers breach crypto security, spotlight US exchanges and stablecoin usage.

A key trend identified in 2025 is the increasing reliance of both illicit actors and nation-states on infrastructure providers that offer a “full stack” of services.

These providers, which are themselves visible on-chain, have evolved from niche hosting resellers into integrated infrastructure platforms. They provide domain registration, bulletproof hosting, and other technical services specifically designed to withstand takedowns, abuse complaints, and sanctions enforcement.

By offering a resilient technical backbone, these providers amplify the reach of malicious cyber activity. They allow financially motivated criminals and state-aligned actors to maintain operations even as law enforcement agencies attempt to dismantle their networks.

Convergence of digital and physical threats

While the narrative of crypto crime often focuses on digital theft and laundering, 2025 provided stark evidence that on-chain activity is increasingly intersecting with violent crime in the physical world.

Human trafficking operations have increasingly Leveraged cryptocurrency for financial logistics, moving proceeds across borders with relative anonymity.

Even more disturbing is the reported rise in physical coercion attacks. Criminals are increasingly using violence to force victims to transfer assets, often timing these assaults to coincide with cryptocurrency price peaks to maximize the value of the theft.

Illicit activity remains less than 1% of crypto economy

Despite these alarming trends, the broader context remains important. The illicit volumes tracked in 2025 remain less than 1%  of the legitimate crypto economy.

However, the qualitative shift in that 1% is what concerns regulators and intelligence agencies. The integration of nation-states into the illicit supply chain via stablecoins raises the stakes for national security.

As government agencies, compliance teams, and security professionals look toward 2026, the challenge will be disrupting a professionalized, state-sponsored shadow economy that has successfully weaponized the efficiency of modern finance.

Cooperation among law enforcement, regulatory bodies, and crypto businesses will be crucial, as the integrity of the ecosystem now intersects directly with global geopolitical stability.