Gray trading volume hits a record high, market segmentation behind the $158 billion figure

On-Chain Data Research Institution’s latest report reveals a noteworthy phenomenon: by 2025, the flow of illicit funds in the crypto network will reach $158 billion, a 145% year-over-year increase, setting a new record. This figure may seem staggering, but it does not indicate that the “crypto world has suddenly gone dark,” rather it reflects a deep structural adjustment within the industry being exposed.

Comparing historical data shows that between 2022 and 2024, this gray capital has remained relatively stable, ranging from $64 billion to $75 billion. The abnormal spike last year was not due to a surge in criminal activity itself but resulted from the combined effects of multiple factors.

Sanctions Policy Upgrades Change Fund Flows, Accelerating On-Chain Migration of Gray Transactions

Against the backdrop of increasing global financial sanctions, sanctioned regions and institutions face restrictions on traditional financial channels and are forced to seek alternatives. The decentralized nature of blockchain makes it a new option for these funds to complete cross-border transfers. Especially for funds related to Russia, which became the main driver pushing up gray transaction data.

The stablecoin A7A5, pegged to the ruble, had an on-chain transaction volume of over $72 billion last year, playing a “key channel” role in sanctions-related crypto activities. This data alone accounts for nearly half of all gray transactions, fully illustrating how policy environments directly influence on-chain fund aggregation.

Significantly Improved Tracking Capabilities Redefine the Boundaries of Gray Areas

It is important to clarify a key point: the growth in statistical data does not necessarily equate to an increase in illegal activities. TRM Labs explicitly states that the amount of identifiable and labeled funds is increasing. In other words, the improvement of blockchain analysis tools and regulatory infrastructure is gradually bringing previously hidden fund flows to light.

This means gray funds have not increased out of thin air but have shifted from “invisible” to “visible.” Advances in tracking technology are redefining the boundaries of gray areas—funds that were once difficult to trace can now be precisely located and classified.

Hacker Attacks Are Becoming More Concentrated and Professionalized, with Significantly Larger Single-Transaction Amounts

Security incident data also reflect this trend of differentiation. Last year, approximately 150 hacking incidents resulted in a total theft of $287 million. At first glance, the number of incidents appears to have decreased, but the amount stolen per incident has increased significantly.

The most representative case is a $146 million ETH theft from a major exchange, with security agencies pointing to activities related to North Korea’s Lazarus hacking group. The emergence of such large single-attack thefts indicates that illegal activities are evolving from dispersed small-scale operations to highly concentrated, professional large-scale schemes.

Regulatory Pushes for Industry Transparency, Gray Areas Undergoing Orderly Rebuilding

Overall, the nature of illegal activities is undergoing profound change—not disappearing but evolving toward more covert, more professional, and more centralized forms. The true significance of this evolution lies in its forcing the entire ecosystem toward greater transparency, controllability, and institutionalization.

Policy adjustments by regulators are essentially not about destroying the crypto market but about promoting its transition from disorder to order. The contraction of gray areas precisely indicates that market rules are gradually being established. For investors, this “chaos-to-order” transformation presents a genuine opportunity for industry upgrading.