TL;DR: Iran’s crypto ecosystem reached more than $7.78 billion in 2025, with activity spiking around conflict, sanctions pressure, and domestic unrest, while IRGC-linked addresses accounted for about 50% of total values received in Q4 2025, according to Chainalysis. The pattern shows how political instability can turn blockchain activity into both a financial pressure valve and an illicit finance channel.
At a glance
What this is: Chainalysis finds that Iran’s crypto activity accelerated in 2025 and moved in step with sanctions pressure, conflict and unrest, while IRGC-linked addresses captured roughly half of Q4 inflows.
Why it matters: Identity, sanctions and financial-crime teams should read this as a live example of how geopolitical stress reshapes transaction behaviour, custody choices and illicit finance exposure across digital asset ecosystems.
Context
Iran’s crypto market is best understood as a stress indicator, not a normal growth story. When currencies weaken, protests spread and external pressure rises, digital asset flows can move from convenience to necessity, and that shift creates monitoring challenges for financial-crime and sanctions programmes.
The article also shows why blockchain activity cannot be analysed in isolation from state power and coercive control. In this case, the same ecosystem supports ordinary users seeking capital preservation and networks tied to the IRGC, which makes wallet attribution, sanctions screening and behavioural analysis especially important.
Key questions
Q: How should sanctions teams interpret crypto flow spikes during unrest?
A: Treat them as context-dependent signals, not automatic evidence of illicit activity. A spike may reflect capital flight, self-custody preference, exchange risk or sanctioned-network movement. The right response is to correlate on-chain changes with event timing, wallet attribution and sanctions intelligence before deciding whether escalation is warranted.
Q: Why do state-linked actors use cryptocurrency during economic pressure?
A: They use it to move value outside constrained banking channels, preserve access when correspondent rails are limited and reduce dependence on institutions that may freeze or scrutinise transactions. Crypto does not eliminate traceability, but it can reduce friction and create more routing options for sanctioned or politically exposed networks.
Q: What are the warning signs that self-custody is being used as a risk signal?
A: Look for sudden increases in withdrawals from exchanges to personal wallets, especially when they align with protests, internet blackouts, currency collapse or conflict. Those patterns can indicate capital preservation behaviour, but they can also mark a shift away from controls that exchanges can still enforce.
A: Organisations should prioritise blockchain analytics when they need visibility into wallet clustering, indirect exposure, and asset movement that list-only screening cannot provide. In crypto, sanctioned activity can spread across many addresses, and a small designation may hide a much larger network. Analytics becomes essential when the compliance question is not just who was named, but what else that entity controls or touches.
Technical breakdown
Why sanctions pressure changes crypto flow patterns
Sanctions do not just restrict payment rails, they reshape user behaviour. When local currency confidence collapses, people move to assets that preserve optionality, while state-linked actors use the same rails to route value outside conventional oversight. On-chain data then becomes a mixed signal, combining defensive self-custody, capital flight and potentially illicit finance. The governance problem is not merely volume, but intent attribution across wallets, exchanges and intermediaries that may be operating under very different motivations.
Practical implication: transaction monitoring must pair wallet analytics with geopolitical context and sanctions intelligence, not treat every outflow as economically equivalent.
How state-linked networks exploit digital asset infrastructure
A politically connected network can use cryptocurrency as a financing layer when banking access is constrained or scrutiny is high. In practice, that means exploiting exchange access, self-custody, shell entities and cross-border facilitators to move value with less friction than traditional correspondent banking. Attribution is difficult because on-chain visibility does not equal ownership clarity. The technical issue is not blockchain transparency alone, but the distance between visible wallet activity and the real control structure behind it.
Practical implication: sanctions and fraud teams should build attribution workflows that connect addresses to entities, facilitators and control relationships before escalation decisions are made.
Why self-custody surges during unrest
When people expect banking instability, capital controls or internet disruption, they often move assets from exchange balances into personal wallets. That is a custody shift, not just a payment choice. It reduces dependence on institutions, but it also removes some of the traceability and intervention points that exchanges provide. For compliance and risk teams, the key technical question is where the control boundary sits between platform-held assets and user-held assets, especially during periods of civil unrest.
Practical implication: exchanges and service providers should review withdrawal monitoring, risk scoring and event-triggered controls for abnormal shifts into self-custody.
Threat narrative
Attacker objective: The objective is to preserve or move value outside constrained financial systems while supporting sanctioned or proxy-linked activity.
- Entry occurs through geopolitical and economic pressure that pushes users and state-linked actors toward alternative value transfer channels.
- Credential access and control are not the central issue here; instead, the abuse path comes from exploiting exchange access, self-custody and cross-border facilitation to move value beyond normal oversight.
- The impact is the dual use of crypto rails for household capital preservation and for IRGC-associated financing and sanctions evasion.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Sanctions pressure turns crypto into a governance problem, not just a market behaviour problem. When political instability and currency collapse drive users toward digital assets, transaction monitoring has to distinguish survival-driven self-custody from structured illicit finance. That is a sanctions screening and financial-crime challenge as much as a blockchain analytics one. Practitioners should treat geopolitical context as part of the control environment, not as background noise.
State-linked crypto activity creates attribution debt. Once a politically connected network uses exchanges, shell structures and facilitators to route value, the hard part is no longer seeing transactions but proving who controls them. That is where the compliance model breaks if it assumes wallet visibility equals risk visibility. Practitioners need attribution rules that connect addresses, entities and control relationships before enforcement decisions are made.
Financial instability creates a custody trust gap. The article shows that users increasingly move to self-custody when they distrust banks, inflation or capital controls. That shifts risk from institutionally supervised balances to wallets where intervention is limited and recovery is harder. For identity and access teams in digital asset firms, the lesson is that custody choice changes the governance model, not just the user experience.
Blockchain analytics only becomes actionable when paired with sanctions intelligence. The article’s value is not the existence of on-chain data, but the way it maps political events to flow changes and IRGC-linked concentration. That is a strong case for combining wallet analytics, entity attribution and external intelligence feeds in a single investigative workflow. Practitioners should use on-chain data as evidence, not as a standalone conclusion.
What this signals
Sanctions-era transaction monitoring needs geopolitical context. Crypto compliance teams should expect activity patterns to change when protests, conflict or currency collapse reshape user behaviour. A flow spike is only useful when it is read alongside event timing, custody shifts and attribution quality.
Attribution is the bottleneck. The article shows that the hardest part is not observing movement on-chain, but determining whether addresses are controlled by ordinary users, facilitators or state-linked networks. That makes entity resolution and control mapping central to investigations, not optional enrichment.
Custody decisions change the control model. When users move from exchange balances to personal wallets, firms lose some intervention points and gain less certainty about who ultimately controls assets. Practitioners should plan for sudden withdrawal surges during periods of unrest and financial instability.
For practitioners
- Map wallet flows to political event windows Correlate transaction spikes with sanctions announcements, protest periods, conflict events and internet blackouts so investigators can separate behavioural flight from structured laundering.
- Strengthen entity attribution for high-risk wallets Link addresses to facilitators, shell entities, exchange accounts and known control relationships before applying sanctions or escalation decisions.
- Tune withdrawal monitoring for self-custody surges Flag abnormal movement from exchange custody into personal wallets when unrest, currency collapse or infrastructure disruption changes user behaviour.
- Combine blockchain analytics with sanctions intelligence Use intelligence feeds, watchlists and geopolitical context alongside on-chain evidence so the case file supports enforcement, fraud and risk decisions.
Key takeaways
- Iran’s crypto market demonstrates how sanctions pressure and civil unrest can reshape digital asset behaviour into both a resilience mechanism and an illicit finance channel.
- The article ties 2025 activity to more than $7.78 billion in ecosystem value and shows IRGC-linked addresses accounting for about 50% of Q4 inflows.
- Practitioners need event-aware monitoring, stronger entity attribution and custody-aware controls to separate legitimate flight-to-safety behaviour from sanctioned-network activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0 sets the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.SC-01 — Cybersecurity Supply Chain Risk Management | The article centers on cross-border financial and sanctions risk that depends on third-party actors and facilitators. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Custody shifts and exchange withdrawals change who can control assets and when. | |
| Recommendation — Map high-risk wallet and facilitator relationships into your supply-chain risk governance. Review entitlement boundaries for exchange custody, self-custody and withdrawal approval paths. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The pattern involves using access paths and value transfer channels to move funds beyond oversight. |
| Recommendation — Track abusive access and transfer patterns as part of your threat-hunting and financial-crime workflows. | ||
| GDPR | Art.32 — Security of Processing | The article touches digital asset monitoring and behavioural data, which can create processing-security obligations. |
| Recommendation — Apply security-of-processing controls to behavioural and transactional data used in crypto-risk investigations. | ||
Key terms
- Self-Custody: Self-custody is an identity and asset model where the user, not a central provider, holds the credentials that control access. It improves control and portability, but it also means lost credentials can become unrecoverable unless backups and emergency paths are designed in advance.
- Sanctions evasion: Sanctions evasion is the deliberate movement of value or goods to avoid legal restrictions imposed on designated people, entities, or jurisdictions. In crypto markets, it often relies on speed, cross-border settlement, and intermediary services that make destination tracing harder without strong monitoring.
- Agent Attribution: Agent attribution is the ability to tie each request, action, retry, and cost event back to a specific non-human actor. It matters because shared credentials and anonymous automation hide misuse, make revocation harder, and prevent security teams from understanding which identity actually performed a task.
- Custody Boundary: A custody boundary is the point where control over assets shifts from an institution to an end user or another controller. In digital assets, that boundary determines who can freeze, monitor, reverse or approve movement, making it a core governance issue during instability or protest-driven withdrawals.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org