Topic starter
11/07/2026 8:48 pm
TL;DR: Sanctioned entities received 694% more value in 2025, pushing illicit transaction volume to a record $154 billion as states embedded crypto into trade settlement, procurement, and proxy financing, according to Chainalysis. The governance lesson is clear: enforcement now has to track service layers, not just wallets, because scale and speed have become operational features of state-backed abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “Crypto Crime in 2025 Was Primarily Driven by 694% Surge in State-Driven Sanctions Evasion Volume”.
By the numbers:
- Illicit addresses received at least $154 billion in 2025, a 162% increase year-over-year, according to Chainalysis.
- Value received by sanctioned entities increased 694% in 2025, totaling $104 billion, according to Chainalysis.
- The IRGC and its proxy networks accounted for over 50% of value received by Iranian entities in Q4 2025, according to Chainalysis.
Key questions
A: Common signs include low donation volume, narrow wallet activity, public solicitation that is separate from the main procurement network, and transfers that do not materially change the organisation’s operating capacity.
Q: Why do stablecoins make sanctions enforcement harder for compliance teams?
A: Stablecoins reduce friction between jurisdictions, asset classes, and counterparties, which makes them attractive for both legitimate trade and sanctions evasion.
Q: What signs suggest crypto activity is being used as state infrastructure?
A: Look for repeatable settlement patterns, business-hour concentration, successor entities, rapid rebranding, and flows that pass through brokers or exchanges repeatedly before reaching strategic destinations.
Practitioner guidance
- Map service-layer dependencies Identify exchanges, brokers, stablecoins, bridge services, and P2P rails that repeatedly appear in sanctioned flow patterns, then treat them as part of one operational chain.
- Build typology-based monitoring Flag behaviours such as rapid rebranding, repeated conversion between assets, business-hour settlement spikes, and cross-jurisdiction hop patterns rather than relying only on wallet lists.
- Separate licit volume from sanctions risk Review whether high-throughput activity is consistent with normal commerce, or whether the service model is being used to settle prohibited trade, proxy support, or evasion activity.
Bottom line: Sanctions evasion now scales through crypto service layers, where exchanges, brokers, and stablecoins can be chained into repeatable operational infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:15 pm
Sanctions evasion has become a service-layer problem, not a wallet problem. The article shows that states no longer need to rely only on hidden bank accounts or isolated addresses to move value at scale. They can compose exchanges, brokers, stablecoins, bridges, and mules into a repeatable operating model. For practitioners, the governance question is how to identify the service dependency that makes the flow possible, not just the endpoint that receives it.
A question worth separating out:
Q: How should organisations handle sanctions risk when crypto is used for cross-border payments?
A: Treat the payment as a sanctions decision, not just a treasury transaction. Screen the counterparty, wallet, intermediary, and jurisdiction before authorisation, and require an escalation path when a designated entity, exposed wallet, or high-risk corridor is involved. Blockchain traceability helps, but only if screening occurs before settlement and ownership of the decision is explicit.
👉 Read our full editorial: Crypto sanctions evasion is scaling into state infrastructure