It lowers the friction of moving funds across borders and gives operators a funding layer that can be reused across multiple campaigns. Even though transactions are traceable, defenders still have to connect wallets to real-world coordination, which takes correlation across financial, technical, and behavioural data. That makes speed of analysis the critical constraint.
Why cryptocurrency changes the defender’s job
Cryptocurrency changes influence operations because it decouples funding from traditional banking friction without eliminating traceability. That combination lets operators move value quickly, reuse the same funding layer across campaigns, and route payments through a system that defenders can inspect only after they have linked wallets, infrastructure and people to a shared operation.
The practical difference is not anonymity, it is tempo. When value can be moved or reissued in minutes, defenders lose the comfort of slow financial investigation and have to treat attribution as a correlation problem across technical, financial and behavioural evidence.
Why traceability does not equal easy disruption
Public ledgers can expose transactions, but the ledger rarely tells you whether a wallet belongs to a single operator, a short-lived burner, a mule, or part of a wider campaign network. The analyst still has to connect on-chain activity to off-chain coordination, and that connection often depends on exchange records, malware telemetry, messaging patterns, IP infrastructure, and timing analysis.
This is why disruption is harder than simple visibility suggests. A visible payment trail can still be operationally useless if the defender cannot turn it into a timely seizure, block, freeze, or account action before the next campaign stage starts.
What makes the funding layer so resilient
Cryptocurrency supports influence operations because the same wallet, seed, or payment path can be reused until it is burned, and the operator can reconstitute the funding layer faster than defenders can close every endpoint. That makes the issue one of operational resilience as much as financial flow.
In practice, Mailchimp breach 2022 shows how a support-system compromise can turn into downstream abuse when customer-facing credentials or exports are used to enable phishing at scale. Similarly, BitMart hot wallet hack 2021 illustrates how a stolen private key can immediately convert into large-scale fund drainage, which is the same basic disruption problem defenders face when a campaign’s money layer is exposed.
Risk and Threat Considerations
The main risk is not just stolen funds, it is operational continuity for the influence campaign. If the funding layer can be refreshed faster than defenders can correlate wallets to operators, the campaign can keep paying for infrastructure, accounts and content even after individual assets are identified.
Failure mechanism: Analysts often see the ledger movement before they can prove which real-world actor controls the wallet, and that delay lets the operator rotate infrastructure, split flows, or move value through intermediaries before interdiction lands.
Impact: Disruption becomes reactive instead of preventive, so defenders may end up documenting the campaign after it has already financed multiple waves of activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0011 — Command and Control | Influence ops funding often supports repeated adversary operations and infrastructure reuse. |
| Recommendation — Map campaign finance-linked infrastructure to adversary operations and hunt for repeatable support patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Correlation depends on logs from wallets, exchanges, infra and accounts. |
| Recommendation — Centralize and retain logs needed to correlate transactions with operational activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor network and physical environments | The answer depends on continuous monitoring to spot linked wallet, infra and behavioural activity. |
| Recommendation — Continuously monitor for linked financial and operational indicators across the campaign lifecycle. | ||
Practitioner Guidance
What to prioritise: Treat fund-flow correlation as part of the influence-ops detection problem, not as a separate financial investigation that starts later. If you wait for perfect attribution, you will usually miss the disruption window.
What to verify: Build a case only when wallet activity, infrastructure reuse, and behavioural indicators line up. A single transaction trail is rarely enough; the decision point is whether the same operational cluster can be linked across campaigns.
Practitioner takeaway: Cryptocurrency does not defeat visibility, it defeats delay, so the winning strategy is to shorten correlation time across financial and operational signals until disruption can keep pace with campaign reuse.
Related resources from NHI Mgmt Group
- Why does crypto funding make influence operations harder to defend against?
- Why does cross-chain movement make cryptocurrency fundraising harder to disrupt?
- Why does cryptocurrency make IP infringement harder to disrupt in online piracy and counterfeit sales?
- Why does access to cashout services make ransomware and scam operations harder to disrupt?