Crypto becomes state infrastructure as sanctioned inflows surge 694%
Chainalysis and Moody's say stablecoins and cold wallets keep enforcement gaps open as illicit crypto moves beyond SWIFT.
Inflows to sanctioned entities surged 694% in 2025, marking a sharp shift in crypto-related crime towards state-driven activity and raising risks for global financial systems, according to Chainalysis and Moody’s.
Kaitlin Martin, Senior Intelligence Analyst at Chainalysis, said the rise signals a structural change in usage. “Nation states like Iran and Russia are using crypto at scale for trade settlement, reserve diversification, procurement of dual-use goods and financial innovation,” she said, adding that crypto is “no longer just a sanctions workaround, but it's a significant part of parallel financial systems.”
The increase is tied to concentrated activity. Martin cited “high volume activity for Russia's ruble-backed A7A5 token,” alongside newly sanctioned wallets linked to Iranian actors and proxies. “The Houthi wallets… had transacted nearly a billion dollars,” she said, highlighting the scale of flows.
Choon Hong Chua of Moody’s said crypto is replacing traditional evasion channels. “They are using crypto as a sort of parallel railway to the correspondent banking system that's outside of SWIFT,” he said, allowing cross-border transactions without relying on regulated banking networks.
Stablecoins have become central to these operations. Martin said sanctioned actors are “acquiring stablecoins… to conduct transactions that would otherwise be difficult through traditional financial institutions,” enabling settlement in currency-linked assets without direct exposure to the US financial system.
Different approaches are emerging. Russia uses its ruble-backed token to move fiat onto blockchain networks before converting to stablecoins for trade, whilst Iranian actors rely on “an intricate shadow banking network facilitated by financiers and proxies,” Martin said.
Enforcement gaps remain a key risk. Chua noted that “it is easy to take a cold wallet into a less regulated jurisdiction and extract value,” highlighting weaknesses across jurisdictions that allow activity to move beyond regulatory reach.
Regulators are extending traditional controls into digital markets. Martin pointed to “real-time transaction monitoring” and “robust KYC procedures,” alongside the inclusion of crypto addresses in sanctions lists by OFAC, OFSI, and the EU.
Authorities are also working with stablecoin issuers to freeze illicit funds, whilst exchanges face pressure to strengthen compliance.
As crypto becomes embedded in state-led financial activity, parallel payment systems are weakening sanctions enforcement and shifting liquidity outside regulated channels, increasing fragmentation risks across global markets.
