TL;DR: Sanctioned entities received 694% more value in 2025, pushing illicit transaction volume to a record $154 billion as states embedded crypto into trade settlement, procurement, and proxy financing, according to Chainalysis. The governance lesson is clear: enforcement now has to track service layers, not just wallets, because scale and speed have become operational features of state-backed abuse.
At a glance
What this is: This is Chainalysis’s analysis of how sanctioned entities and state-linked actors used crypto at industrial scale in 2025, with illicit volume reaching a record $154 billion and sanctioned value rising sharply.
Why it matters: It matters to identity, AML, and sanctions practitioners because the control problem has shifted from isolated wallets to the service layers, exchanges, brokers, and settlement rails that make large-scale evasion operational.
By the numbers:
- Illicit addresses received at least $154 billion in 2025, a 162% increase year-over-year, according to Chainalysis.
- Value received by sanctioned entities increased 694% in 2025, totaling $104 billion, according to Chainalysis.
- The IRGC and its proxy networks accounted for over 50% of value received by Iranian entities in Q4 2025, according to Chainalysis.
- The ruble-backed A7A5 stablecoin processed $93.3 billion in less than a year, according to Chainalysis.
Context
Sanctions evasion is no longer limited to opaque bank accounts and shell companies. In this reporting, Chainalysis argues that blockchain rails have become part of state infrastructure, giving sanctioned actors a faster way to move value, settle trade, and route around enforcement.
For identity and financial-crime teams, the operational problem is not simply which wallet is sanctioned. The real control gap is how exchanges, brokers, stablecoins, and peer-to-peer rails can be assembled into a durable sanctions-evasion service layer that looks like normal market activity until it is mapped end to end.
Key questions
A: Common signs include low donation volume, narrow wallet activity, public solicitation that is separate from the main procurement network, and transfers that do not materially change the organisation’s operating capacity. In those cases, crypto may be a supporting channel rather than the primary financing rail. Investigators should avoid overstating significance and instead weigh transactional evidence against operational context.
Q: Why do stablecoins make sanctions enforcement harder for compliance teams?
A: Stablecoins reduce friction between jurisdictions, asset classes, and counterparties, which makes them attractive for both legitimate trade and sanctions evasion. Compliance teams then have to separate ordinary settlement activity from state-backed or proxy-linked flows using relationship data, not just transaction appearance. The problem is scale, speed, and reuse of the same rails for different intents.
Q: What signs suggest crypto activity is being used as state infrastructure?
A: Look for repeatable settlement patterns, business-hour concentration, successor entities, rapid rebranding, and flows that pass through brokers or exchanges repeatedly before reaching strategic destinations. When those behaviours align with sanctions exposure or proxy activity, the network is behaving like operational infrastructure rather than ordinary market usage.
Q: How should organisations handle sanctions risk when crypto is used for cross-border payments?
A: Treat the payment as a sanctions decision, not just a treasury transaction. Screen the counterparty, wallet, intermediary, and jurisdiction before authorisation, and require an escalation path when a designated entity, exposed wallet, or high-risk corridor is involved. Blockchain traceability helps, but only if screening occurs before settlement and ownership of the decision is explicit.
Technical breakdown
How state actors turn crypto into a sanctions-evasion service layer
Crypto becomes sanctions infrastructure when wallets are only one part of a wider operating model. Exchanges, over-the-counter brokers, stablecoins, bridge services, and mule networks create a settlement layer that can move value across jurisdictions faster than traditional controls can inspect it. The key governance problem is not just attribution of an address, but understanding how liquidity, conversion, and custody are chained together to make illicit flows look routine. When that layer is mature, evasion stops being opportunistic and becomes repeatable operating procedure.
Practical implication: Map the full service chain around suspect flows, not just the destination wallet.
Why stablecoins and centralized services are attractive to sanctioned actors
Stablecoins give sanctioned actors speed, global reach, and easy conversion between currencies or asset types. Centralized services add liquidity and operational continuity, which matters when the objective is trade settlement, procurement, or proxy financing rather than anonymous speculation. The article also shows that these rails can support both licit and illicit use, which makes enforcement harder because the same infrastructure can carry normal commerce and sanctions violation side by side. The technical issue is mixed-use infrastructure, not a single compromised account.
Practical implication: Prioritise monitoring where liquidity, conversion, and jurisdictional reach converge.
How on-chain transparency changes sanctions enforcement
Public blockchains do not remove abuse, but they do leave traceable patterns in timing, counterparties, rebranding events, and service dependencies. That means investigators can often detect operational behaviour even when actors change labels, swap infrastructure, or route through multiple hops. The analytical challenge shifts from finding hidden ledgers to interpreting behavioural clusters and mapping continuity across entities. In this environment, enforcement works best when it combines blockchain analytics with sanctions lists, typology analysis, and infrastructure takedowns.
Practical implication: Correlate transaction patterns with infrastructure changes to spot continuity behind rebranding.
Threat narrative
Attacker objective: The objective is to move value, settle trade, and fund strategic state activity while reducing the effect of sanctions and enforcement pressure.
- Entry occurs when sanctioned states and their proxies access crypto through exchanges, OTC brokers, stablecoins, and peer-to-peer rails that support cross-border value transfer.
- Credentialed or trusted access to those service layers enables conversion, layering, and chain-hopping that conceal the true source, destination, and purpose of funds.
- Escalation happens when those rails are industrialized into repeatable settlement and procurement workflows, allowing state-backed actors to scale sanctions evasion across multiple jurisdictions.
- Impact is the creation of durable, state-backed financial infrastructure that supports proxy financing, trade settlement, cyber operations, and other strategic objectives at record scale.
Breaches seen in the wild
- Microsoft Storm-0558 key breach 2023: China-based Storm-0558 used a stolen, never-retired Microsoft signing key to forge tokens and read email at 22 organisations in 2023.
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Sanctions evasion has become a service-layer problem, not a wallet problem. The article shows that states no longer need to rely only on hidden bank accounts or isolated addresses to move value at scale. They can compose exchanges, brokers, stablecoins, bridges, and mules into a repeatable operating model. For practitioners, the governance question is how to identify the service dependency that makes the flow possible, not just the endpoint that receives it.
Stablecoins are now dual-use financial infrastructure. Their liquidity and interoperability make them attractive for legitimate commerce, but those same features let sanctioned actors settle cross-border trade and finance proxies. That does not make the instrument inherently illicit. It does mean compliance models that treat token type as the main signal will miss the real risk, which is how the token is operationalized across custody and conversion points.
State-backed crypto abuse now behaves like a resilient supply chain. The article’s examples of rebranding, successor exchanges, and layered conversion show continuity across entities rather than one-off transactions. That creates a named concept worth tracking: sanctions-evasion infrastructure continuity: the ability to replace one service node while preserving the same illicit operating model. Practitioners should look for continuity of function, not continuity of name.
Enforcement has to target operational choke points, not only sanctioned endpoints. The article makes clear that exchange infrastructure, OTC brokers, and bridge services can have outsized impact when disrupted. That aligns with broader financial-crime governance logic: if the ecosystem depends on a small number of conversion and settlement nodes, those nodes become the highest-value control points. For compliance teams, the practical conclusion is to prioritise network mapping over isolated list screening.
The scale here changes the risk model for financial controls. When sanctioned value reaches tens of billions and the same rails support trade, procurement, and proxy financing, the question is no longer whether abuse exists. It is whether a programme can detect when normal-looking throughput has crossed into national-security exposure. That requires stronger typology-based monitoring, not just more alerts.
What this signals
Sanctions-evasion infrastructure continuity: the same illicit operating model can survive exchange shutdowns, entity rebranding, and token relabelling if the conversion rails remain intact. Practitioners should therefore treat infrastructure persistence as the primary risk signal, not the name attached to the asset or service.
For compliance teams, the practical shift is toward graph-based monitoring of counterparties, settlement nodes, and conversion pathways. That is where abnormal scale, repeated behaviour, and state-linked facilitation become visible before they harden into a durable evasion network.
For practitioners
- Map service-layer dependencies Identify exchanges, brokers, stablecoins, bridge services, and P2P rails that repeatedly appear in sanctioned flow patterns, then treat them as part of one operational chain.
- Build typology-based monitoring Flag behaviours such as rapid rebranding, repeated conversion between assets, business-hour settlement spikes, and cross-jurisdiction hop patterns rather than relying only on wallet lists.
- Separate licit volume from sanctions risk Review whether high-throughput activity is consistent with normal commerce, or whether the service model is being used to settle prohibited trade, proxy support, or evasion activity.
- Prioritise choke-point disruption Escalate cases where a small number of service providers, issuers, or settlement nodes appear to enable a wider sanctions-evasion network.
Key takeaways
- Sanctions evasion now scales through crypto service layers, where exchanges, brokers, and stablecoins can be chained into repeatable operational infrastructure.
- The article’s evidence shows record volumes, with sanctioned value and state-linked activity reaching levels that change the enforcement problem from isolated events to systemic networks.
- Practitioners need graph-based monitoring and choke-point disruption because wallet-level screening cannot fully expose how state-backed abuse is actually assembled.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0010; TA0042 — Credential Access; Exfiltration; Resource Development | The article describes state-backed networks using crypto infrastructure to move and launder value at scale. |
| Recommendation — Map sanctioned-actor infrastructure to ATT&CK and hunt for resource development, conversion, and transfer patterns. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Sanctions evasion at this scale is a governance and risk-management issue spanning finance and security. |
| Recommendation — Align sanctions monitoring to a formal risk strategy that covers counterparties, rails, and escalation thresholds. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article depends on traceable transaction and infrastructure behaviour to expose evasion networks. |
| Recommendation — Centralise and retain logs for exchange activity, settlement flows, and infrastructure changes that support investigations. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Reduced access and constrained privileges limit abuse of exchanges, brokers, and settlement infrastructure. |
| Recommendation — Apply least privilege to transaction approval, custody, and settlement workflows that touch sanctioned-exposure pathways. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | Access control is central where financial infrastructure and settlement services can be repurposed for evasion. |
| Recommendation — Enforce access control over settlement, custody, and monitoring systems that could support sanctions evasion. | ||
Key terms
- Sanctions evasion: Sanctions evasion is the deliberate movement of value or goods to avoid legal restrictions imposed on designated people, entities, or jurisdictions. In crypto markets, it often relies on speed, cross-border settlement, and intermediary services that make destination tracing harder without strong monitoring.
- Stablecoin Rail: A stablecoin rail is the payment infrastructure used to move value using tokenised assets rather than traditional card or bank settlement. In governance terms, it shifts control from intermediary-heavy processing to wallet, key, and policy management, which creates a stronger need for privileged access oversight.
- On-Chain Typology: An on-chain typology is a repeatable pattern of blockchain behaviour that helps investigators recognise illicit activity. It can include rebranding, hop patterns, conversion chains, business-hour concentration, or repeated use of specific services that indicate an organised operating model rather than isolated transactions.
- Service-Layer Enforcement: Service-layer enforcement is the practice of targeting the infrastructure that enables illicit activity rather than only the final address or account. In crypto sanctions work, this means focusing on exchanges, brokers, issuers, and bridges whose disruption can break the wider flow network.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern identities, credentials, and access across modern security programmes.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org