Loading story…
Governments are increasing pressure on the cryptocurrency ecosystem through sanctions enforcement and stricter compliance obligations aimed at disrupting money laundering, ransomware payments, and terrorism financing. OFAC has progressively expanded sanctions designations to include cryptocurrency addresses and, in some cases, entire crypto services, reflecting the view that virtual assets are being used to evade traditional financial controls; this approach has been supported by published guidance for the virtual currency industry on how to mitigate sanctions risk and avoid facilitating crypto-enabled crime.
India has similarly tightened its anti–financial crime posture by updating rules for cryptocurrency service providers via FIU-IND guidelines that require registration for any crypto entity serving Indian residents, including offshore operators. The new requirements mandate enhanced KYC and ongoing monitoring—collecting identity documents and financial details, plus technical and geolocation data (e.g., IP addresses and latitude/longitude with timestamps) and selfie-based verification—along with continuous transaction monitoring and suspicious activity reporting for both fiat and virtual currency flows, aligning crypto compliance expectations more closely with those applied to traditional financial institutions.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-01, OFAC updated its Specially Designated Nationals list to add 134 cryptocurrency addresses linked to Islamic State Khorasan Province (ISKP). Treasury said the addresses had moved more than $2 million in terrorist financing.
On 2026-04-24, OFAC updated the SDN entry for the Central Bank of Iran by adding two cryptocurrency addresses tied to the bank. The bank had originally been sanctioned in 2019, and the update followed U.S.-linked enforcement activity targeting Iranian sanctions-evasion flows involving USDT.
India's Financial Intelligence Unit issued updated rules requiring cryptocurrency entities serving Indian residents, including offshore operators, to register and disclose officer, location, and ownership details. The framework also mandates enhanced customer due diligence, transaction monitoring, and suspicious activity reporting to address fraud, money laundering, and terrorism financing risks.
The European Union announced its 19th package of sanctions against Russia on 2025-10-23, including measures targeting crypto providers alongside Russian energy interests and third-country banks. The action marked a new sanctions development by the EU expanding pressure on financial and crypto-related channels linked to Russia.
On 2025-08-14, OFAC re-designated Garantex under cyber-related authorities and designated successor exchange Grinex, three Garantex executives, and six associated companies in Russia and the Kyrgyz Republic. Treasury said the network enabled sanctions evasion and processed over $100 million in illicit transactions tied to ransomware actors, darknet markets, and other cybercriminal activity since 2019.
OFAC published formal compliance guidance for the virtual currency industry in October 2021, expanding its sanctions expectations for crypto businesses and related compliance programs.
The U.S. Treasury's Office of Foreign Assets Control first included cryptocurrency addresses in a sanctions designation on 2018-11-28, when it sanctioned two Iran-based individuals linked to the SamSam ransomware scheme and listed two Bitcoin addresses.
In 2018, OFAC began issuing frequently asked questions for the virtual currency industry to clarify how U.S. sanctions rules apply to cryptocurrency activity and compliance obligations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
trmlabs.com
Open sourcechainalysis.com
Open sourcechainalysis.com
Open sourcescworld.com
Open sourceconsilium.europa.eu
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026
Illicit cryptocurrency activity reached unprecedented levels in 2025, with at least $154 billion in crypto flowing to addresses linked to criminal activity, according to Chainalysis. This surge was primarily driven by a dramatic increase in transactions involving sanctioned entities, which saw a 694% year-over-year rise. Nation-states have become increasingly involved, leveraging both established criminal infrastructure and developing their own on-chain systems to evade sanctions at scale. The professionalization of the illicit crypto ecosystem now enables transnational criminal networks and governments to launder funds and procure goods and services more efficiently, raising the stakes for both consumer protection and national security. Concurrently, global fraud has evolved into a strategic tool for both organized crime and hostile states, integrating advanced technical tactics such as bot farms, malware, and cryptocurrencies. Governments and private sector organizations are responding by forming international task forces to address the industrialization of fraud, which now rivals the GDP of major economies. North Korea and other pariah states are specifically cited for weaponizing cyber-enabled fraud networks to circumvent sanctions and generate revenue, further blurring the lines between traditional financial crime and cyberwarfare. The convergence of nation-state actors and criminal syndicates in the crypto space underscores the urgent need for coordinated global action to counter these threats.
Jun 29, 2026
Regulatory frameworks for cryptocurrency have evolved rapidly in 2025, with significant changes such as the European Union's Markets in Crypto-Assets (MiCA) Regulation coming into full effect. Despite these advancements, implementation has been inconsistent across regions, with national interpretations and technical challenges complicating compliance for organizations operating internationally. Similar regulatory developments have occurred in Singapore and other jurisdictions, highlighting the global trend toward more comprehensive oversight of digital assets. Security leaders, particularly CISOs at multinational organizations, face increasing frustration with the fragmented nature of global crypto regulations. The lack of harmonization means that while cyber threats such as ransomware and advanced persistent threats operate without regard for borders, security teams must navigate a patchwork of compliance requirements. This regulatory complexity diverts resources from actual threat mitigation to compliance management, underscoring the urgent need for more unified global standards in cryptocurrency regulation and security.
Jun 29, 2026