Iran’s $2 Billion Crypto Sanctions Evasion
Iran’s Islamic Revolutionary Guard Corps moved more than $2 billion through cryptocurrency channels last year, according to blockchain analytics firm Chainalysis. The funds were used to bypass international sanctions and support cybercriminal operations. That figure might actually be higher, since it only accounts for U.S. sanctions designations.
What’s interesting is how this reflects a broader pattern. Iran isn’t alone in turning to crypto to work around financial restrictions. The country’s situation shows an exponential rise in illicit cryptocurrency transactions, driven by similar pressures in places like Russia and North Korea.
Sanctioned Nations Drive Illicit Growth
Crypto crime reached unprecedented levels in 2025. Chainalysis data shows illicit cryptocurrency transactions jumped by 162% compared to 2024, totaling at least $154 billion. Sanctioned jurisdictions have significantly expanded their reliance on digital assets as a workaround.
In Iran’s case, affiliated proxy groups and entities labeled as terrorist organizations—including Hezbollah, Hamas, and the Houthis—have increasingly turned to digital assets to move and cash out funds. But Iran wasn’t the only driver of this surge.
Russia accounted for the largest share of illicit on-chain activity. This trend intensified after the state introduced its ruble-pegged A7A5 token last year. Transactions linked to Russia’s new stablecoin reached at least $93 billion. That volume alone emerged as the primary factor behind an almost sevenfold increase in crypto activity among sanctioned entities.
North Korean Hackers and Chinese Networks
North Korean hackers have been a persistent presence in the cyber threat environment. The past year marked their most damaging period to date, both in terms of value stolen and the growing sophistication of their methods. Hackers linked to the DPRK were responsible for approximately $2 billion in stolen funds.
Meanwhile, China’s role introduced an unexpected dimension. Chinese money laundering networks emerged as a dominant force in 2025. These organized groups accelerated the diversification and professionalization of on-chain crime. They now offer specialized services, including laundering-as-a-service and supporting criminal infrastructure.
Building on models like Huione Guarantee, these networks evolved into full-service criminal operations. They support fraud, scams, North Korean hacking proceeds, sanctions evasion, and terrorist financing.
From Digital to Physical Violence
Beyond crypto’s role in illicit financial activity, the report stressed the increased correlation between digital assets and violent crime. Physical attacks on bitcoin holders rose 33% in 2025. Violent crypto robberies and kidnappings jumped 169%.
Most wrench attacks start with public wallet exposure. Attackers don’t need to hack wallets—they just need to find the person. This connection between on-chain activity and physical coercion cases has grown more apparent.
The blockchain analytics firm clarified that illicit transactions still represent a small share of total crypto activity. But the urgency of protecting the ecosystem’s security and integrity has reached unprecedented levels. Perhaps what’s most concerning is how these networks have professionalized, creating what feels like a shadow financial system with real-world consequences.
