Chainalysis: Crypto Sanctions Evasion Surged 700% in 2025 as Russia, Iran and North Korea Turned to Stablecoins

Chainalysis pegs the scale as more than $100 billion moved onchain tied to sanctions evasion flows, a headline number that frames 2025 as the year state actors industrialized their crypto operations rather than dabbling around the edges. ^[2]

The 700% surge: what actually changed in 2025

A 700% jump does not happen from retail going rogue. Chainalysis attributes the step-change to state-linked coordination, where sanctioned entities combine three ingredients:

1. Stablecoins for settlement speed and price stability
2. Hacked or seized funds as a liquidity source
3. Exchanges and brokers that are permissive, state-linked, or lightly enforced

Chainalysis also flags that these flows helped push crypto-related illicit finance to record levels in 2025, with sanctions evasion as a major driver rather than a niche category.

Stablecoins are the main rail, and the numbers are ugly

That statistic is a gut check for anyone still treating stablecoins as "just plumbing." Plumbing is exactly where enforcement pressure goes when authorities want maximum impact with minimum ambiguity. Stablecoins are used because they:

• Settle globally with low slippage compared with thin altcoin pairs
• Minimize volatility risk during multi-hop laundering
• Plug directly into OTC networks and exchange order books
• Make accounting simpler for large, repeated transactions

A7A5: a ruble-pegged stablecoin as a sanctions conduit

That number is doing a lot of work. It suggests two things at once:

• Sanctions evasion is not limited to one-off hacks or opportunistic transfers, it is being operationalized at scale.
• Purpose-built stablecoins (especially ones aligned with domestic currency use cases) can concentrate flow in ways that make enforcement both easier to target and harder to shut down completely.

Iran and North Korea: different playbooks, same settlement asset

Chainalysis connects Iran's Islamic Revolutionary Guard Corps (IRGC) activity and North Korean hacking operations to increased reliance on stablecoins. ^[2] The strategic logic differs by country, but the transactional goal converges: move value without touching the traditional correspondent banking system.

Iran: stablecoins as a workaround for restricted rails

Iran-linked networks have strong incentives to use stablecoins for cross-border procurement and payments where banking access is constrained. Stablecoins also make it easier to intermediate through third countries or OTC desks, keeping counterparties one step removed from the sanctioned origin.

North Korea: hacked funds become working capital

North Korea's crypto footprint is often tied to hacks, but the important evolution is what happens after the hack: assets get swapped, bridged, and converted into stablecoins because that is where execution risk is lowest. Once funds are in stablecoins, they can be parceled out in smaller clips, routed through multiple venues, and used for real-world purchases with less exposure to market swings.

State-linked exchanges and the compliance choke point

Chainalysis also calls out state-linked exchanges as part of the machinery. This is where sanctions evasion stops being a purely onchain tracing problem and becomes a jurisdiction problem.

Onchain activity leaves footprints. Offchain conversion is where pressure is applied. The chokepoints that matter most are:

• Stablecoin issuers and their freeze controls
• Centralized exchanges with fiat onramps
• OTC brokers and payment processors
• Cross-border "high-risk" jurisdictions that can delay or ignore enforcement requests

What would invalidate the "stablecoins will be targeted next" thesis?

Two things could cool the heat.

First, if enforcement proves that freezing and seizures are consistently effective at scale, regulators may lean into targeted actions rather than broad restrictions. That is the best outcome for legitimate stablecoin markets: punish bad actors without torching liquidity.

Second, if sanctioned flows migrate away from mainstream stablecoins into harder-to-police instruments and networks, the political appetite to regulate large compliant issuers might ease. The downside is that it pushes illicit activity into darker pools, which can still trigger heavy-handed responses if headlines get bad enough.

Market takeaway: risk is not price, it is access

Traders love clean narratives. This one is messy, but tradable in a different way: it is about access risk. If stablecoins are now the dominant rail for illicit volume, then every stablecoin dependent strategy carries a new variable, policy shock.

Watchlist: what to monitor next

• Stablecoin enforcement actions: freezes, seizures, or blacklists tied to sanctions evasion clusters.
• Exchange delistings and jurisdictional bans: especially for region-specific stablecoins or venues named in investigative reporting.
• Onchain concentration: whether volumes keep clustering into a small set of stablecoins like A7A5$0.012892 (a centralization risk), or disperse across many instruments (a whack-a-mole risk).
• Bridges and swap routes: sudden shifts in preferred chains or liquidity pools can signal pressure campaigns or adaptation by bad actors.
• Regulatory language drift: when policymakers start framing stablecoins explicitly through sanctions and national security, expect faster rulemaking and tougher compliance expectations.

Bottom line: Chainalysis is signaling that 2025 was not just another year of crypto crime. It was a scale-up year for nation-state sanctions evasion, and stablecoins are the settlement layer. If you are positioned anywhere near that liquidity, keep one eye on the chart and the other on the compliance headlines.