Iran and Russia have built payment routes around tokens Washington can freeze. North Korea’s record Binance heist shows the limits of that approach.
Binance lost about $6.36bn last week, in what has been described as the largest heist in history. Most of the funds were gone within 20 minutes, according to blockchain analytics firm TRM Labs.
TRM traced the theft, with what it called “high confidence”, to TraderTraitor – a North Korean state hacking unit. Not only is it the largest crypto heist on record, it is the latest in a run of attacks that has made stolen crypto a source of foreign currency for Pyongyang.
Theft, however, is only the most visible way sanctioned governments use crypto – as evidenced by the reaction to the Binance case – it is not the broadest. Wallets belonging to sanctioned people and organisations received about $104bn collectively in 2025, nearly eight times the 2024 total, according to Chainalysis.
The firm said the surge made sanctions evasion the main driver of a record $154bn in illicit crypto flows. North Korea’s hackers stole $2.02bn over the same year.
Most of the money reaching sanctioned states is earnt, saved and spent rather than stolen. It flows through Iran’s central bank and Revolutionary Guard, through the brokers who sell Iranian oil, and through a rouble token linked to a Russian state bank. Much of Iran’s share moves in Tether’s USDT, a stablecoin with its value – as the name suggests – pegged against the US dollar.
A dollar stablecoin gives a sanctioned state such as Iran something close to dollars without a US bank account. This is important when faced with high inflation to sanction-hit local currencies; the downside for these states, though, is that every transfer sits on a public ledger, and Tether can freeze any address holding its tokens.
Over the past year, Washington has learnt to use this too. It has frozen hundreds of millions of dollars of Iranian funds and pushed sanctions down to the exchanges where crypto turns into cash.
How Iran and Russia move money in dollar tokens
Iranian users and state bodies convert rials into stablecoins on local exchanges and send them abroad to settle trade. Nobitex, the largest of those exchanges, handled more than half of the country’s crypto inflows in 2025, and Chainalysis said it also allowed regime insiders to move wealth out of the country during internet blackouts.
Much of that money moves in USDT on the Tron blockchain. TRM said the Islamic Revolutionary Guard Corps (IRGC) exploited the “low transaction costs, high throughput, and widespread regional adoption” of the infrastructure to move value outside the banking system through crypto. IRGC-linked wallets received more than half of the money flowing into Iran’s crypto sector in the last three months of 2025. Chainalysis concluded crypto “is no longer peripheral” to Iran’s sanctions evasion.
Chainalysis’ findings are also supported by Elliptic, which found USDT transfers to Central Bank of Iran wallets surged as the rial fell, with the bank buying $507m of the token. The US Treasury’s Office of Foreign Assets Control (OFAC) also noted how Nobitex processed hundreds of millions of dollars of stablecoin transfers for the bank.
The networks around this trade include familiar names. OFAC designated Babak Zanjani to be sanctioned in January and said the Iranian financier had been “freed from imprisonment in order to launder money for the regime”. TRM said his UK-registered exchanges, Zedcex and Zedxion, have processed about $1bn in IRGC-linked funds since 2023.
It described Zedcex as “a stablecoin clearing hub embedded within a broader sanctions-evasion ecosystem”.
Russia took a different route, building a token of its own rather than relying on Tether’s. A7A5 is pegged to the rouble and linked to state-owned Promsvyazbank and to Ilan Shor, who is sanctioned for interfering in Moldova’s elections on Russia’s behalf. It processed $93.3bn in about ten months, and Chainalysis described it as “a token expressly designed to bypass the traditional financial system entirely”.
Where the stablecoin freeze bites the sanctioned
Tether said it froze $344m in two Central Bank of Iran wallets in April after US authorities sent it the addresses, and the next day, the OFAC added the wallets to its sanctions list.
A further $131m followed in July, and Tether said it helped freeze about $550m of Iran-linked USDT this year. “We will follow the money that Tehran is desperately attempting to move outside of the country and target all financial lifelines tied to the regime,” Treasury Secretary Scott Bessent said in April.
Russia’s crypto token reached the same limit by a different path, after the US, UK and EU sanctioned A7A5 and the crypto exchanges around it in the second half of 2025. Elliptic said the sanctions took hold where holders swapped A7A5 into USDT.
Average daily trading fell 96% from its July 2025 peak to $24.3m in June 2026. “The token cannot be turned off, but the surrounding network of venues that give it value, can be,” Elliptic said.
OFAC has since widened its reach over Iran’s exchanges, sanctioning Nobitex and three other platforms in June. On 24 August it gained power to sanction any person, anywhere, operating in Iran’s digital asset sector. Launching the wider campaign, Bessent said: “Those who tether themselves to Tehran should expect to share in the isolation of a withering regime.”
The weak link is the most effective freeze available to Washington rests on a private company’s cooperation. Senator Richard Blumenthal wrote to Tether in June questioning its description of its sanctions compliance as “voluntary”. CEO Paolo Ardoino has said USDT is “not a haven for sanctioned actors, terrorist organisations or criminal networks”.
A rule proposed in April under the GENIUS Act would require US-regulated stablecoin issuers to be able to freeze tokens wherever they trade.
Tether, however, issues USDT from outside the US and is not a permitted issuer under the regulation. Until that obligation reaches the token sanctioned states actually use, Washington’s best tool depends on Tether choosing to act.
Why North Korea is harder to stop
North Korea poses a different problem, because it steals rather than buys. Ether and bitcoin have no issuer to freeze them. TRM said most of the ether stolen from Bybit in February 2025 was swapped into bitcoin through THORChain, a protocol with “no operator willing to freeze or reject transfers”.
The attacks increasingly target people rather than code. Arkham Intelligence said North Korean proxies met Drift Protocol staff in person at conferences before the $285m theft from the exchange in April. Binance said its initial investigation pointed to a compromised laptop.
North Korean IT workers are reported to take remote jobs under false identities and earn the regime $250m to $600m a year, by a 2024 UN estimate, relying on Russian intermediaries to cash out.
Against Pyongyang, the defences to combat theft sit at either end of the money being stolen. At one end is the security of exchanges’ own staff and systems, and at the other are the brokers, including those in Russia, who turn stolen crypto into cash.
Binance said it had frozen about $3bn of what was taken last week, and what happens to the remaining $3.3bn is dependent on whether any company in its path is able, and obliged, to freeze it.
