According to the Financial Action Task Force (FATF) in their March 2026 Targeted Report on Stablecoins and Unhosted Wallets, stablecoins have moved from the periphery to the very center of global finance
Key Findings in Numbers
The report highlights the explosive growth and significant risks associated with the stablecoin ecosystem as of 2025 and 2026:
- There were 259 circulating stablecoins as of June 2025, with a total market capitalization reaching USD 316 billion by October 2025.
- Stablecoins represented 30% of all on-chain virtual asset transaction volume in 2025. Fiat-backed stablecoins dominated the market at 95% of total market capitalization, with 97% of those being USD-referenced.
- Daily trading volumes for stablecoins surpassed those of Bitcoin, reaching USD 156 billion in a 24-hour period compared to Bitcoin’s USD 55 billion.
- Stablecoins accounted for 84% of the USD 154 billion illicit virtual asset transaction volume in 2025, surpassing Bitcoin as the primary asset for cybercrime-related on-chain transactions.
- One example involves the DPRK’s Lazarus Group stealing nearly $1.46 billion in February 2025 and laundering it through over 125,000 Ethereum wallets.
- Approximately 90% of stablecoins were centrally governed as of mid-2025.
The report outlines a complex landscape of risks associated with the rapid growth of stablecoins and suggests several technological and regulatory controls to mitigate these threats.
Highlighted Risks and Vulnerabilities
- Misuse by State Actors and Terrorists: DPRK (North Korea): Groups like the Lazarus Group use stablecoins to launder proceeds from massive thefts (e.g., $1.46 billion in early 2025) and to procure raw materials like copper for munitions. Iran: Sanctioned entities use stablecoins to finance the procurement of drone components and weapons, as these assets are superior for financing international trade. Terrorist Financing: ISIL and Al-Qaeda solicit donations in stablecoins and use “smurfing” (breaking large sums into small transfers) to move funds globally through multiple VASPs.
- P2P Transactions via Unhosted Wallets: These transfers occur directly between individuals without regulated intermediaries, placing them outside traditional AML/CFT obligations and making them inherently high-risk.
- Sophisticated Obfuscation: Threat actors utilize chain-hopping (moving funds across different blockchains), mixers, and cross-chain bridges to fragment transaction flows and degrade the ability of law enforcement to trace funds.
- Regulatory Arbitrage: The borderless nature of stablecoins encourages issuers to headquarter in jurisdictions with weak regulatory frameworks while still operating globally.
- Data Gaps: While blockchain records are immutable, they are pseudonymous and lack geographical context. Additionally, many transactions occur off-chain within a VASP’s internal ledger, making them invisible to external monitors.
Suggested Controls and Good Practices
To address these vulnerabilities, the report suggests a range of controls focused on smart contract programmability and international regulatory cooperation:
Technological (Smart Contract) Controls
- Allow-listing (Whitelisting): Permitting only pre-approved wallet addresses to hold or transfer tokens. This requires identifying the user before a transaction can even be initiated.
- Deny-listing (Blacklisting): Restricting specific high-risk addresses from transacting. This is often reactive, based on law enforcement requests or sanctions lists.
- Freeze, Burn, and Re-issue: Issuers are encouraged to maintain the technical capability to immobilize illicit funds or “burn” them and re-issue the value to a legitimate authority.
- Programmable Compliance: Embedding Customer Due Diligence (CDD) requirements directly into the stablecoin’s core code.
Regulatory and Operational Controls
- Implementation of FATF Recommendation 15: Requiring all stablecoin issuers and intermediaries to be licensed or registered and subject to AML/CFT supervision.
- Travel Rule Compliance: Ensuring VASPs collect and share originator and beneficiary information, including for transfers involving unhosted wallets.
- Transaction Limits: Implementing caps on daily transfer volumes or per-transaction amounts to mitigate risks in the secondary market.
- Advanced Monitoring: Utilizing blockchain analytics tools for on-chain penetration tracking and identifying high-risk wallet clusters.
Cooperative Frameworks
- Supervisory Colleges: Establishing multinational frameworks to coordinate the oversight of stablecoin issuers that operate across multiple borders.
- Public-Private Partnerships: Strengthening collaboration between governments and stablecoin issuers to share information on emerging threats and risk indicators.
A massive thank you to the Financial Action Task Force (FATF) for their vital work and leadership in authoring this comprehensive March 2026 report. Their insights provide a roadmap for securing the future of digital value transfer.
Read the full report here>>> https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html