They use it to move value outside constrained banking channels, preserve access when correspondent rails are limited and reduce dependence on institutions that may freeze or scrutinise transactions. Crypto does not eliminate traceability, but it can reduce friction and create more routing options for sanctioned or politically exposed networks.
Why sanctions pressure pushes some states toward crypto rails
Under economic pressure, state-linked actors often look for payment paths that are faster, less dependent on correspondent banking and harder to interrupt at the point of transfer. Cryptocurrency can serve that role because value can move across borders without relying on a single bank relationship, even though the surrounding activity may still be traceable and exposed to interdiction.
The important point is not that crypto is anonymous. It is that it can be routed through a wider set of venues, intermediaries and wallets, which gives sanctioned or politically exposed networks more operational flexibility when traditional financial access tightens.
How crypto changes the operating environment, not the underlying exposure
Crypto is attractive in periods of pressure because it can reduce friction in cross-border movement of funds, support rapid settlement and help preserve liquidity when accounts, fiat gateways or payment processors become unreliable. That makes it useful for evasion, continuity and optionality, especially for networks that need to keep operating while official channels are constrained.
It also changes the investigative picture. Transactions can be visible on public chains, but attribution often depends on exchange records, wallet clustering, off-ramp intelligence and the ability to connect blockchain activity to real-world entities. In practice, CISA cyber threat advisories and similar public reporting consistently emphasise that visibility alone is not the same as control.
For state-linked users, that mix matters. Crypto can lower banking friction while still leaving room for tracing, seizure, sanctions enforcement or network disruption if investigators can reach the exchange, wallet operator or infrastructure point that bridges crypto back to the regulated economy.
What practitioners should watch for in sanctions or pressure-driven flows
Economic pressure tends to shift behaviour toward layered transfers, short-lived wallets, proxy service use, peer-to-peer liquidity and reuse of infrastructure across operations. Those patterns are not proof of state direction by themselves, but they do raise the likelihood that the purpose is access preservation rather than ordinary commercial payment.
In real incidents, pressure-resistant value movement is often supported by key theft, wallet compromise or abusive access to an intermediary rather than by the chain alone. The difference between a viable route and a blocked one is frequently the custody point, not the currency format itself. The BitMart hot wallet hack 2021 is a reminder that access to signing material can turn a wallet into an immediate drain path.
Where the pressure is sustained, actors may also prefer systems that minimise approval overhead and limit dependency on any one institution. That is why control failures around key custody, transaction approval, wallet segregation and exchange onboarding become strategically important, especially when the funds may support procurement, influence operations or sanctions evasion.
Risk and Threat Considerations
Crypto use under economic pressure creates a dual risk: it can help sanctioned or politically exposed networks preserve value, and it can create an investigative blind spot if defenders focus only on banks rather than the on- and off-ramps that connect crypto to fiat. The most dangerous assumption is that public-chain visibility equals effective disruption.
Failure mechanism: Actors exploit alternative payment paths, custody gaps and intermediary churn to move value despite banking restrictions, while using the relative speed of wallet creation and transfer to outpace controls at the point of conversion or seizure.
Impact: Funds can continue to support procurement, covert logistics, influence activity or sanctions evasion, and defenders may lose time chasing the chain instead of the custody, exchange and identity points that actually enable conversion and control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1657 — Financial Theft | Crypto use under pressure often supports illicit fund movement and value preservation. |
| Recommendation — Map money-movement behavior to T1657 and monitor exchange, wallet and off-ramp activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Tracing crypto flows depends on logs from wallets, exchanges and conversion points. |
| Recommendation — Retain and correlate wallet, exchange and payment logs to support attribution and recovery. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Sanctions-driven crypto use is a strategic risk requiring defined monitoring and response. |
| Recommendation — Include sanctions-evasion and alternative-rail exposure in enterprise risk decisions. | ||
| ISO/IEC 27001:2022 | A.5.23 — Information security for use of cloud services | Hosted wallets and exchange services create third-party trust and control dependencies. |
| Recommendation — Assess third-party custody services before allowing value movement through them. | ||
Practitioner Guidance
What to prioritise: Focus on the conversion layer first, not the coin itself. If you can identify the exchange accounts, hosted wallets, OTC brokers, payment intermediaries and KYC choke points, you are much closer to disrupting the flow than if you only label the blockchain address.
What to verify: Check whether the wallet movement is paired with rapid off-ramping, repeated address rotation or reused infrastructure across supposedly separate operations. Those combinations matter more than a single suspicious transfer.
Practitioner takeaway: Economic pressure does not make crypto magical, it makes alternate routing more valuable. Effective defence depends on treating crypto as part of a wider sanctions-evasion and access-preservation pathway, with attention on custody, conversion and attribution rather than on the ledger alone.
Related resources from NHI Mgmt Group
- How should compliance teams evaluate state-linked cryptocurrency exchanges?
- Who is accountable when crypto flows may involve sanctioned or state-linked actors?
- How should security teams evaluate the risk of anonymous hosting providers when cryptocurrency transactions may be linked to sanctioned or criminal actors?
- How should cryptocurrency businesses respond when DPRK-linked IT worker schemes use sanctioned wallets and cross-chain movement services?