TRM Labs | Crypto

Sanctions evasion networks, guarantee marketplaces, and large-scale money laundering schemes dominated illicit stablecoin use, says TRM Labs. Illicit entities received around $141 billion via stablecoins in 2025, the highest level observed in the last five years, says blockchain analytics firm TRM Labs. TRM said in a report released on Tuesday that the increase doesn’t reflect a broader growth in crypto-enabled crime, but does show a “deeper reliance on stablecoins within specific activity types where they offer clear operational advantages.” Stablecoins have been particularly used in sanctions-linked networks and large-scale money movement services, it said.  Read more

TRM Labs says the $17.9 billion figure reflects gross onchain volume, including internal transfers, not confirmed illicit proceeds. A Chinese-language crypto guarantee marketplace known as Xinbi processed nearly $18 billion in onchain transaction volume despite platform bans and United States enforcement actions aimed at dismantling similar services, according to a new report from TRM Labs. The report said recent crackdowns — reshaped but failed to dismantle — a key layer in crypto-enabled laundering infrastructure. TRM’s analysis showed that Xinbi sustained on-chain activity after Telegram banned clusters of Chinese-language guarantee services in 2025.  The report attributes Xinbi’s resilience to rapid migration to alternative messaging services and the launch of an affiliated wallet, XinbiPay. Onchain data showed wallet activity rebounded in January 2026 as users transitioned to the new setup. Read more

Bitcoin dipped toward $60,000 after liquidations across crypto derivatives markets reached $2.56 billion, the 10th-largest daily total on record. Cryptocurrency markets experienced a brutal sell-off this week as investor concerns grew over stagnating US liquidity following US President Donald Trump's nomination of Kevin Warsh to lead the Federal Reserve. Bitcoin exchange-traded funds (ETFs) recorded three consecutive days of outflows, with $431 million exiting on Thursday, according to data from Farside Investors. Bitcoin’s (BTC) price briefly dipped to $60,074 on Friday before recovering above $64,930 as of 7:49 a.m. UTC. Warsh — who previously served as a Fed governor from 2006 to 2011 — is expected to continue the interest rate cut trajectory. His nomination may also signal that broader market liquidity is expected to “stabilize rather than meaningfully expand,” Thomas Perfumo, economist at crypto exchange Kraken, told Cointelegraph. Read more

Blockchain intelligence firm TRM Labs reached a $1 billion valuation after closing a $70 million Series C funding round backed by major financial institutions. Blockchain intelligence platform TRM Labs completed a $70 million Series C funding round, valuing it at $1 billion, becoming the latest crypto company to reach unicorn status. The investment round was led by seed investor Blockchain Capital, with participation from Goldman Sachs, Bessemer Venture Partners, Brevan Howard Digital, Thoma Bravo, Citi Ventures and Galaxy Ventures, according to a Wednesday news release. TRM Labs seeks to equip public and private institutions with AI solutions that combat cybercrime. The company defends against illicit activities that increasingly rely on automation. Read more

The U.S. Department of the Treasury is scrutinizing crypto platforms, not just wallets, for enabling Iran’s sanctions evasion, according to TRM Labs’ Ari Redbord.

Venezuela’s worsening economy and a weakening bolívar are driving wider stablecoin adoption, TRM Labs says. The post Stablecoin Use in Venezuela Set to Rise as Bolívar Weakens: TRM Labs appeared first on Cryptonews.

The T3 Financial Crime Unit (T3 FCU), a joint initiative led by Tether, TRON, and TRM Labs, announced it has frozen more than $300 million in criminal assets globally. The post Tether, TRON, and TRM Labs’ Financial Crime Unit Blocks $300M in Illicit Crypto appeared first on Cryptonews.

Iran crypto flows dropped 11% so far this year to July, amid conflict with Israel, a $90 million hack on local crypto exchange Nobitex and Tether freezing 42 wallets. Flows into Iranian crypto trading platforms have fallen in 2025 due to a breakdown in nuclear negotiations with Israel, a $90 million hack on Iran’s largest crypto exchange, and a major stablecoin blacklisting, says blockchain analytics firm TRM Labs. Iranian crypto flows hit $3.7 billion between January and July, an 11% decrease compared to the same period last year, with the worst drop off coming in June and July, TRM Labs said in a report on Tuesday. Iran’s crypto flows started to sharply drop in June, just after the $90 million hack on Nobitex, which handles 87% of the country’s crypto transactions.  Read more

TRM Labs says the Embargo ransomware group has moved over $34 million in ransom-linked crypto since April, targeting US hospitals and critical infrastructure. A relatively new ransomware group known as Embargo has become a key player in the cybercrime underground, moving over $34 million in crypto-linked ransom payments since April 2024. Operating under a ransomware-as-a-service (RaaS) model, Embargo has hit critical infrastructure across the United States, with targets including hospitals and pharmaceutical networks, according to blockchain intelligence firm TRM Labs. Victims include American Associated Pharmacies, Georgia-based Memorial Hospital and Manor, and Weiser Memorial Hospital in Idaho. Ransom demands have reportedly reached up to $1.3 million. Read more

Crypto private key exploits and front-end protocol attacks account for 80% of the $2.1 billion worth of crypto that has been stolen so far this year, TRM Labs reports. Crypto private key exploits and front-end compromises have accounted for most of the $2.1 billion worth of crypto lost to attacks in the first half of 2025, says blockchain intelligence firm TRM Labs.  Over 80% of crypto stolen across 75 hacks so far this year was taken in so-called infrastructure exploits, which, on average, made off with 10 times more than other attack types, TRM Labs said in a report on Thursday. Infrastructure attacks target the technical backbone of a system to gain unauthorized control, mislead users, or reroute assets. Read more