TL;DR: Sanctioned entities received 694% more crypto in 2025 and illicit addresses handled a record $154 billion, driven by state actors embedding digital assets into financial infrastructure and policy goals, while North Korea stole over $2 billion and A7A5 processed more than $93 billion, according to Chainalysis. Crypto sanctions evasion is no longer a niche compliance issue; it is an infrastructure, liquidity, and attribution problem that changes how security and risk teams think about control boundaries.
At a glance
What this is: Chainalysis says crypto sanctions evasion has matured into a state-scale infrastructure problem, with sanctioned entities, state actors and proxy networks using digital asset rails at massive volume.
Why it matters: For IAM, PAM, NHI and fraud teams, this shifts the focus from individual wallet activity to the control of intermediary services, delegated access, liquidity paths and cross-border transaction governance.
By the numbers:
- Sanctioned entities received 694% more crypto in 2025.
Context
Crypto sanctions evasion is no longer limited to hidden wallets or isolated laundering paths. The article shows a shift toward infrastructure, where exchanges, stablecoins, bridges, OTC brokers and hosting providers are used to sustain cross-border value transfer at scale.
That matters because the governance problem is no longer only attribution of a single address. It is control over service layers, delegated access, liquidity channels and the boundaries between legitimate financial usage and sanctions-breaching activity.
Key questions
Q: What breaks when sanctions monitoring focuses only on wallets?
A: Wallet-only monitoring misses the intermediary layer where sanctioned actors actually keep value moving. Exchanges, OTC brokers, bridges, and swap services can reconstitute access even after specific addresses are flagged. Effective controls have to follow the flow, the operator, and the infrastructure that makes the transaction possible, not just the final address.
Q: Why do stablecoins and exchanges increase sanctions-evasion risk?
A: They reduce friction in cross-border settlement and make it easier to move value quickly across jurisdictions. When those rails are controlled by weakly governed intermediaries, state actors and proxies can fragment flows, relabel funds and route around traditional financial controls. The risk is not the technology alone, but the combination of liquidity, reach and weak lifecycle governance.
Q: What signs indicate a sanctions-evasion network is becoming infrastructure-based?
A: Look for repeated reuse of the same service providers, rapid successor branding, dependency on instant swap services, concentration of flows through specific intermediaries and growth that outpaces normal retail or commercial usage patterns. Those signals suggest the network is no longer opportunistic. It is being operated as a parallel settlement layer.
Q: How should compliance teams respond when sanctioned activity is embedded in shared infrastructure?
A: Treat the shared infrastructure as part of the risk object, not just the customer or wallet. That means stronger counterparty due diligence, ongoing monitoring of service dependencies, faster escalation when intermediary relationships change and coordinated action across sanctions, AML and cyber governance so that operational enablers are addressed alongside the transactions themselves.
Technical breakdown
How crypto infrastructure supports sanctions evasion
Sanctions evasion through crypto depends on layered infrastructure rather than one-off transfers. Stablecoins provide a liquid settlement layer, exchanges provide conversion and access, bridges move value across chains, and OTC brokers hide transactional intent behind informal exchange relationships. That combination makes the activity resilient even when individual wallets are identified. The important mechanism is not anonymity alone, but the ability to fragment control across many entities and jurisdictions while preserving settlement continuity. Once that happens, enforcement must target the service layer, not just the endpoint wallet. The result is a governance problem that resembles distributed access control more than isolated fraud.
Practical implication: Map and govern the full service chain, not just the receiving wallet.
Why sanctions activity resembles identity and privilege sprawl
The identity angle here is real because the ecosystem depends on delegated trust. Exchanges, brokers, infrastructure providers and intermediaries act like privileged operators in a financial workflow, even when they are not traditional IAM subjects. When those relationships are weakly verified, over-permissioned or poorly offboarded, sanctions-sensitive flows can persist through rebranding, shell entities or intermediary reuse. In that sense, the problem looks like non-human identity sprawl: many machine-like actors, each with a narrow role, but collectively creating a wide attack surface. Governance fails when organisations treat each node as an isolated counterparty instead of part of a lifecycle-managed trust chain.
Practical implication: Treat intermediaries as governed identities with lifecycle, scope and offboarding controls.
Why enforcement is moving toward infrastructure disruption
The article shows regulators increasingly targeting the enablers around the flow, not just the flow itself. That includes exchanges, hosting providers, instant swap services and other access points that make sanctions evasion operationally viable. This mirrors a broader security pattern: when the primary object is hard to suppress directly, authorities shift to the surrounding infrastructure that provides reach, liquidity and persistence. For practitioners, this means governance and monitoring must follow the enablement layer, because that is where abuse becomes scalable. The decisive control question is whether the ecosystem can be forced to lose continuity, not merely whether one address can be blacklisted.
Practical implication: Focus controls on the enablers that preserve continuity of illicit flows.
NHI Mgmt Group analysis
Sanctions evasion has become a trust-chain problem, not a wallet problem. The article shows that states and proxies no longer rely on a single hidden endpoint; they rely on exchanges, brokers, bridges and settlement tokens to keep value moving. That shifts the real governance question from transaction visibility to lifecycle control over the intermediaries that make the flow possible. Practitioners should treat the enablement layer as the unit of risk.
Crypto sanctions evasion now looks like non-human identity sprawl. The services in the flow behave like machine actors with delegated authority, narrow scope and persistent trust relationships. When those relationships are not tightly governed, rebranding and service substitution can preserve the same operational path under a different name. The practitioner takeaway is that identity governance principles apply even when the “identity” is an exchange, broker or bridge.
State-scale abuse changes the enforcement model. The article makes clear that enforcement is moving from address-level blocking toward disruption of the infrastructure that sustains liquidity and reach. That is the right direction because scale comes from continuity, not from any single actor. Security and compliance teams should expect the same pattern in adjacent domains, where abuse persists until the enabling service layer is constrained.
Stablecoin settlement is now a geopolitical control surface. A7A5 and similar mechanisms show how a token can function as a sanctioned parallel rail when national actors need cross-border settlement outside traditional finance. That makes the boundary between financial crime, sanctions compliance and cyber-enabled state activity much thinner. Organisations that rely on digital asset exposure, custody or on-ramp relationships need governance models that assume this boundary will continue to blur.
Regulators are signalling that infrastructure providers will be treated as part of the abuse surface. The article’s emphasis on hosters, swap services and intermediary networks shows a deliberate shift in policy focus. For practitioners, that means counterparties cannot be assessed only on direct client risk; they must also be evaluated on how easily they can be repurposed into illicit settlement infrastructure.
What this signals
Parallel settlement rails are now a governance issue for any organisation that touches digital assets. When sanctions-sensitive activity can move through exchanges, bridges and OTC intermediaries, the practical challenge becomes dependency control rather than address blocking. Risk teams need to know which counterparties can be repurposed into illicit payment infrastructure and how quickly those relationships can be cut off.
The strongest control point is the enabling service layer. The article shows that the market keeps finding ways to preserve liquidity even when individual entities are designated. That means practitioners should focus on counterparty lifecycle management, rebranding detection and infrastructure dependency mapping rather than assuming transaction screening alone will contain the problem.
For practitioners
- Map sanctions exposure across the full value chain Identify exchanges, OTC brokers, bridges, stablecoin issuers and infrastructure providers that can move funds across borders, then classify where control is direct, delegated or indirect.
- Tighten counterparty governance for intermediary services Require lifecycle controls for high-risk counterparties, including onboarding diligence, ownership verification, periodic review and rapid offboarding when service relationships become sanctions-sensitive.
- Monitor rebranding and service substitution patterns Watch for renamed entities, successor exchanges, instant swap services and repeated wallet reuse that preserve the same transaction path after enforcement action.
- Align financial-crime controls with infrastructure risk Coordinate sanctions, AML, fraud and cyber teams so that suspicious flows, hosting dependencies and payment rails are investigated as one operational problem.
Key takeaways
- Crypto sanctions evasion has moved beyond isolated wallets into a service-layer problem built on exchanges, bridges, brokers and stablecoin rails.
- The scale of the activity is now measured in industrial flows, which makes attribution and lifecycle governance more important than endpoint blocking.
- Practitioners should treat intermediary services as governed risk nodes and coordinate sanctions, AML, fraud and cyber oversight around them.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on governing who can use high-risk digital asset rails and intermediary access. |
| Recommendation — Apply PR.AA-05 to tightly scope and review access across high-risk crypto counterparties and service dependencies. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The flow depends on abused access paths and repeated movement through intermediaries. |
| Recommendation — Map the reuse of intermediaries and settlement rails to TA0006 and TA0008 to guide threat hunting. | ||
| CIS Controls v8 | CIS-5 — Account Management | Counterparty, operator and service accounts are central to preserving illicit infrastructure. |
| Recommendation — Use CIS-5 to inventory, review and revoke high-risk service relationships that sustain sanctions evasion. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article shows how delegated access and intermediary overreach enable sanctions-busting flows. |
| Recommendation — Apply AC-6 to restrict intermediary permissions to the minimum needed for legitimate transactions. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud and platform controls over counterparties and service operators are part of the abuse surface. |
| Recommendation — Use IAM controls to govern delegated access across digital asset service providers and hosting layers. | ||
Key terms
- Sanctions evasion: Sanctions evasion is the deliberate movement of value or goods to avoid legal restrictions imposed on designated people, entities, or jurisdictions. In crypto markets, it often relies on speed, cross-border settlement, and intermediary services that make destination tracing harder without strong monitoring.
- Stablecoin Settlement Layer: A transaction layer built on stablecoins that moves value quickly and with low friction across borders. In this context, it becomes a governance problem when the layer is used to route sanctioned or otherwise high-risk flows through otherwise ordinary financial activity.
- Counterparty Lifecycle Governance: The discipline of onboarding, reviewing, scoping and offboarding external service relationships that can influence access, settlement or trust. For digital assets, it must include intermediaries whose technical role can be repurposed into illicit infrastructure even if they are not end users.
- Delegated trust chain: The sequence of systems, intermediaries, and policies that carries a consumer’s permission from the original request to the final data exchange or transaction. This chain is only as strong as its weakest handoff, so governance must cover scope, revocation, and third-party accountability end to end.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org