Look for repeatable settlement patterns, business-hour concentration, successor entities, rapid rebranding, and flows that pass through brokers or exchanges repeatedly before reaching strategic destinations. When those behaviours align with sanctions exposure or proxy activity, the network is behaving like operational infrastructure rather than ordinary market usage.
How to tell when crypto activity is acting like state infrastructure
When crypto rails start to look engineered for repeatability rather than trading, the signal is usually structural. Patterns worth weighting heavily include settlement paths that repeat, counterparties that appear in clusters, and entity changes that preserve the same operating flow. The question is not whether crypto is present, but whether it is being used to move value with administrative discipline.
That distinction matters because state-linked networks often optimise for continuity, deniability, and persistence. The practical test is whether the behaviour remains stable across time, venues, and corporate wrappers, which is why investigators should look for the same transaction logic reappearing under different labels.
What behavioural patterns separate infrastructure from ordinary market use?
Ordinary market activity tends to vary with price, liquidity, and trader preference. Infrastructure-like use tends to be repeatable. One useful signal is business-hour concentration in one or more time zones that match an operating centre rather than dispersed retail behaviour. Another is routing through brokers or exchanges more than once before funds reach a strategic destination, especially when the same routing pattern recurs.
Successor entities and rapid rebranding are also important because they show operational continuity under changing names. If a wallet cluster, desk, or intermediary disappears publicly but the payment logic, venue choices, and destination types stay the same, the network is likely being preserved as a functional channel rather than abandoned as a commercial actor.
What does the flow pattern usually reveal about intent?
The most informative pattern is not a single transfer, but the chain around it. Repeated settlement through exchanges, intermediate brokers, and freshly formed entities suggests a managed pipeline with controls over timing, handoff, and destination. That is materially different from a one-off user cash-out or a simple investment rotation.
Signals become stronger when the pattern aligns with sanctions exposure, proxy activity, or strategic destinations that are not consistent with ordinary customer use. At that point, the network should be treated as part of an operating system for value movement, where the crypto rail supports a broader political, commercial, or covert objective.
Risk and Threat Considerations
These patterns matter because infrastructure-like crypto activity can hide continuity, absorb disruption, and obscure beneficial control. The risk is not just misuse of a wallet, but the creation of a resilient payment layer that can survive account closures, venue takedowns, or public attribution pressure.
Failure mechanism: Repeated use of brokers, exchanges, and successor entities fragments visibility, making it harder to distinguish ordinary liquidity management from coordinated state-linked routing or sanctions evasion.
Impact: Investigators can underestimate the scale and persistence of the network, allowing strategic flows to continue while appearing operationally normal at each individual hop.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | Recurring settlement patterns and proxy flows indicate security risk worth identifying. |
| DE.AE-02 — Potentially Adverse Events are Analyzed | Behavioural clustering and sanctions-linked flows require analysis of suspicious activity patterns. | |
| DE.CM-01 — Network and Environment Monitoring | Detecting infrastructure-like crypto use depends on monitoring repeated flows and timing patterns. | |
| Recommendation — Map repeated routing and successor entities as risk indicators in threat and exposure reviews. Analyze clustered crypto flows for repeated settlement and strategic destination patterns. Monitor transaction paths for recurring brokers, exchanges, and business-hour concentration. | ||
| MITRE ATT&CK | T1020 — Data Exfiltration | State infrastructure often uses financial rails to move value covertly over time. |
| T1090 — Proxy | Brokers and exchanges can function as intermediaries that obscure origin and destination. | |
| Recommendation — Map repeated crypto routing to suspected value-moving exfiltration activity. Treat repeated intermediary use as proxying that warrants deeper path tracing. | ||
Practitioner Guidance
What to prioritise: Weight clusters, repeat routing logic, and entity succession more heavily than isolated transaction size. A small transfer can be more significant than a large one if it sits inside a recurring settlement pattern tied to the same destinations.
What to verify: Check whether the observed flows persist across different venues, wrappers, and naming changes. If the network keeps the same behaviour after rebranding, treat continuity as the signal, not the label.
Practitioner takeaway: The strongest indicator is behavioural persistence across changing fronts, so assess crypto networks as systems of operation, not as isolated transactions.
Related resources from NHI Mgmt Group
- What are the signs that a Linux endpoint is already being used for crypto mining activity?
- What are the signs that crypto activity in a conflict zone is being used for malicious support operations rather than humanitarian relief?
- What are the signs that crypto ATMs are being used for illicit trafficking activity?
- What are the signs that illicit crypto activity is being used to launder or recycle proceeds rather than just receive payments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org