How Iran, Russia, and North Korea Used $154 Billion in Crypto to Evade Sanctions

Total Illicit Crypto Volume in 2025

Chainalysis data shows that $154 billion flowed through illicit crypto addresses in 2025, with $104 billion of that tied directly to sanctioned entities . Stablecoins accounted for 84% of all sanctions-related transaction volume . The A7A5 ruble-pegged stablecoin, created by Russia and used by North Korea, handled more than $93 billion in transactions alone . While the dollar figures are record-breaking, Chainalysis notes that illicit activity still represented under 1% of total global on-chain volume, meaning the vast majority of crypto use remains legitimate .

Crypto Received by Specific Sanctioned Nations

Iran's Islamic Revolutionary Guard Corps (IRGC) moved over $2 billion in cryptocurrency to evade U.S. sanctions and finance covert cyber operations . Iranian domestic crypto exchanges handled roughly $9.9 billion in total volume in 2025, with about $7.7 billion (78%) flowing through the four largest exchanges: Nobitex, Wallex, Bitpin, and Ramzinex .

Russia was the single largest contributor to illicit crypto transactions among sanctioned states, substantially driven by its ruble-linked A7A5 stablecoin . The Russian finance ministry disclosed crypto transactions totaling roughly 50 billion rubles (~$650 million) per day, implying annual turnover exceeding $130 billion, much of it sanctions-related .

North Korea funds an estimated one-third of its government revenue through cryptocurrency schemes, including state-sponsored hacking, ransomware, and use of the A7A5 token . North Korean state-sponsored groups like Lazarus continued large-scale crypto theft to fund fuel imports and military equipment purchases .

How They Used Digital Assets

Oil Trade Payments and International Trade

Sanctioned states used crypto to pay for and receive payment for sanctioned oil sales and other international trade. Iran's Nobitex exchange and other platforms facilitated payments for the Iranian regime, helping it access global markets despite banking isolation . Russia's A7A5 stablecoin was specifically designed to facilitate cross-border trade settlements in ruble-pegged digital value, processing billions in sanctions-evading transactions .

State-Sponsored Hacking

North Korean hacker groups continued large-scale crypto theft to fund fuel imports and military equipment purchases . The IRGC used crypto proceeds to finance its military and cyber operations .

Crypto Infrastructure Built by Sanctioned States

Russia legalizing crypto for foreign trade (July 1, 2026 target) — The Russian government submitted a bill to the State Duma to legalize digital currencies for foreign trade, with proposed new requirements taking effect on July 1, 2026 . The State Duma passed the bill in its first reading on April 21, 2026 (327 of 340 votes) . It classifies crypto as property and legalizes its use for foreign trade and cross-border payments, while maintaining a ban on domestic crypto payments . As of late June 2026, the bill remained under consideration with further readings pending . A State Duma committee vice chair stated the bill allows Russian companies to "pay foreign counterparties using cryptocurrencies, thereby circumventing sanctions restrictions" .

Iran's large exchanges — Iran operated major exchanges including Nobitex (the largest), Wallex, Bitpin, and Ramzinex, which together processed the vast majority of the country's $9.9 billion in crypto volume .

North Korea's A7A5 ruble-linked token — Russia created the A7A5 stablecoin, pegged to the ruble and designed for sanctions evasion. North Korea actively used this token to move value between Russian and DPRK entities .

Enforcement Actions by the U.S. and EU

U.S. Treasury Sanctions on Four Major Iranian Exchanges

On June 2, 2026, the U.S. Treasury's OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex — Iran's four largest digital asset exchanges — under Executive Orders 13224 and 13902, as part of "Operation Economic Fury" . These exchanges handled roughly 72–78% of all Iranian crypto volume (~$7.7 billion) . The Treasury stated that Nobitex alone processed more than 50% of all Iranian digital asset income in 2025 and supported Iran's sanctions evasion network . The sanctions also targeted exchange founders and executives personally .

U.S. Seizure of Iranian Crypto Assets

In April 2026, the Treasury Department froze $344 million in cryptocurrency allegedly linked to the Iranian regime, which Treasury Secretary Scott Bessent described as the most aggressive digital asset enforcement action of the conflict . Tether confirmed it executed the freeze, blocking USDT stablecoins across two addresses on the Tron blockchain . By May 30, 2026, Bessent announced the U.S. had seized nearly $1 billion in Iranian crypto assets cumulatively through multiple actions under Operation Economic Fury, launched in March 2025 . Bessent remarked: "We have seized about a billion dollars of their crypto. Just outright grabbed the wallets. Some of them may be typing in right now and might not realise their wallet had been grabbed" .

EU's 21st Sanctions Package — 11 Crypto Platforms Banned

On June 9, 2026, the European Commission proposed its 21st sanctions package against Russia, which for the first time included a transaction ban on 11 cryptocurrency platforms accused of sanctions evasion, plus asset freezes on nearly 90 Russian banks . The package also introduced a groundbreaking mechanism to potentially ban crypto-asset services from entire non-EU jurisdictions that host platforms materially helping Russia evade sanctions . The package requires unanimous approval from all 27 EU member states . EU foreign policy chief Kaja Kallas confirmed the package targets "banks, weapons manufacturers, oil traders, refineries, and crypto operators in third countries" .

Why Enforcement Remains Difficult

Differing regulatory standards across countries create a fragmented global enforcement landscape. Key challenges include:

• Regulatory arbitrage: Non-EU jurisdictions with lax or absent crypto regulation host platforms that serve sanctioned actors, and the EU's new country-level ban mechanism is untested .
• Decentralized and pseudonymous nature: Blockchain transactions cross borders instantly, and sanctioned actors use mixers, privacy coins, and new blockchains that make attribution and freezing slow .
• Scale mismatch: While $154 billion in illicit volume is record-breaking, Chainalysis notes that illicit activity remained under 1% of total on-chain volume globally, meaning the vast majority of crypto activity is legitimate and hard to police at scale .
• State-backed infrastructure: Russia, Iran, and North Korea have built sovereign crypto infrastructure (state-linked exchanges, national stablecoins, legal frameworks) that is deeply integrated into their financial systems, making external enforcement far more difficult than against rogue private actors . As TRM Labs noted, Iran's crypto volumes have held at roughly $10 billion annually despite sustained enforcement, suggesting additional exchange infrastructure with significant capacity remains outside U.S. jurisdiction .

The 2025 data shows that sanctioned nations have moved from experimental crypto use to systematic, state-level integration of digital assets into their financial infrastructure. Western enforcement has escalated in response, but the fragmented regulatory landscape and the inherently borderless nature of blockchain technology mean the shadow war over crypto sanctions evasion is likely to intensify further in 2026.