Sanctioned entities received $104 billion in cryptocurrency in 2025, a 694% increase over 2024, according to Chainalysis. Total illicit crypto flows hit $154–158 billion across both Chainalysis and TRM Labs estimates, reversing a multi-year decline. The primary driver: nation-states deploying blo...
"You need to prepare an economy that can bypass them. Blockchain is one of the alternatives, certainly." — Benjamin Netanyahu, Prime Minister of Israel, Channel 10 interview, October 23, 2026
Sanctioned entities received $104 billion in cryptocurrency in 2025, a 694% increase over 2024, according to Chainalysis. Total illicit crypto flows hit $154–158 billion across both Chainalysis and TRM Labs estimates, reversing a multi-year decline. The primary driver: nation-states deploying blockchain infrastructure not as a speculative asset class but as a parallel financial system designed to route around Western banking restrictions.
On October 23, 2026, Israeli Prime Minister Benjamin Netanyahu publicly stated he had commissioned a blockchain-based plan to prepare for possible banking sanctions — making Israel the latest state actor to float crypto as sanctions infrastructure. The statement, made four days before a national election, contained no implementation detail: no named blockchain, no stablecoin, no responsible agency, no timeline. But it placed Israel in a category previously occupied by Russia, Iran, North Korea, and Venezuela — states that have moved past rhetoric into operational crypto-sanctions programs at scale.
This report compares the sanctions-evasion crypto architectures deployed by four state actors, examines the enforcement response, and assesses the structural question Netanyahu's statement raises: whether blockchain is a viable state-level tool for sanctions circumvention, and at what cost.
In an interview broadcast on Israel's Channel 10 on October 23, 2026, Netanyahu told viewers that Israel must prepare for a scenario in which international banking access is restricted. "I have already asked for a plan to be prepared for that," he said, identifying blockchain as one alternative.
The statement was notably absent of specifics. Netanyahu named no blockchain protocol, stablecoin, or settlement mechanism. He identified no government office or timeline. According to Haaretz, the approach drew comparisons to Iran's crypto infrastructure — a comparison Netanyahu's opponents seized on. Opposition leader Yair Lapid warned that sanctions "will devastate our economy, cause prices to skyrocket and inflict irreparable damage."
From a technical standpoint, the statement was empty. From a geopolitical standpoint, it was significant: a sitting leader of a G20-adjacent economy publicly endorsed blockchain as a sanctions bypass tool. This places Israel's stated intent alongside four countries that have already operationalized such systems — with varying degrees of success.
Russia operates the most extensive state-linked crypto sanctions-evasion infrastructure yet documented. The centerpiece is A7A5, a ruble-pegged stablecoin launched in January 2025 by A7 LLC. According to Chainalysis, A7A5 processed $93.3 billion in transactions in under 12 months. Elliptic's separate analysis placed cumulative volume above $100 billion by January 2026.
A7 LLC's shareholders include Ilan Shor, a Moldovan-born businessman sanctioned by the U.S. and EU for election interference on behalf of Russia, and Promsvyazbank (PSB), a state-owned Russian bank sanctioned for servicing Russia's defense sector. The primary trading pairs — A7A5/rubles ($11.2 billion) and A7A5/USDT ($6.1 billion) — indicate A7A5 functions primarily as a bridge between the ruble and dollar-denominated stablecoins for cross-border settlement.
Grinex, a Kyrgyzstan-registered exchange, served as A7A5's primary trading venue. Grinex itself was a successor to Garantex, the Russian exchange dismantled by international law enforcement in March 2025. OFAC designated Grinex, A7 entities, and the A7A5 issuer Old Vector on August 14, 2025.
The enforcement action had measurable impact. Blockchain analytics firms Elliptic and TRM Labs found that roughly 34% of A7A5 activity was circular wash trading, and a 96% volume collapse followed Grinex's shutdown. Daily issuance and trading dropped sharply after mid-2025.
However, the Russian state continues to develop alternatives. The A7 network connects Russia-linked actors with counterparties across China, Southeast Asia, and Iran — a hub-and-spoke model that Chainalysis described as "centrally coordinated sanctions evasion architecture."
Iran's crypto-sanctions apparatus operates through a network of domestic exchanges that process an estimated $8–10 billion annually, according to TRM Labs. The Islamic Revolutionary Guard Corps (IRGC) accounted for more than 50% of the value received by Iranian cryptocurrency services by end of 2025, per Chainalysis data.
Stablecoins — primarily USDT — constitute the dominant instrument. Iran's regime used brokers to convert fiat deposits into stablecoins through a network the U.S. Senate Homeland Security Committee described as "shadow banking" in a September 2026 report titled "Tethered to Terrorism."
The four largest Iranian exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — were designated by OFAC on June 2, 2026, in the Treasury Department's largest enforcement action against Iran's digital asset economy. OFAC froze approximately $131 million in Iran-linked wallets on July 15, 2026.
In August 2026, a second round of designations targeted additional exchanges used by Tehran and a ringleader of a front-company network facilitating illicit cryptocurrency transfers. Combined, these actions represent the most concentrated OFAC crypto enforcement against a single country in 2026.
Iran's model differs from Russia's in a critical respect: Iran did not build a sovereign stablecoin. Instead, it parasitized existing dollar-denominated stablecoins — primarily Tether's USDT — and relied on centralized exchanges as access points. This created a single point of enforcement failure: OFAC could and did target the exchanges directly.
North Korea's approach to crypto-based sanctions evasion is structurally distinct. Rather than building settlement infrastructure, the DPRK's Lazarus Group steals digital assets directly. DPRK-linked actors took $2.02 billion in 2025, according to TRM Labs — a 51% increase year-over-year — pushing cumulative theft to $6.75 billion since 2017.
The February 2025 Bybit hack, attributed by the FBI to the TraderTraitor sub-cluster of Lazarus, extracted $1.5 billion in ETH in a single incident — the largest cryptocurrency theft in history. In April 2026, Lazarus took an additional $577 million across the KelpDAO bridge exploit and the Drift Protocol breach. Through mid-2026, North Korea accounted for 76% of all crypto hack value.
Laundering proceeds through Chinese underground banking networks and mixers, DPRK converts stolen crypto into fiat. According to pseudonymous investigator ZachXBT, Lazarus moved over $1 billion in stolen assets through Chinese launderers.
The DPRK model requires no state-built infrastructure, no stablecoin, no exchange partnerships. It relies on offensive cyber capability. The economic output is smaller than Russia's A7A5 throughput but requires minimal capital deployment and no diplomatic coordination.
Venezuela's crypto-sanctions trajectory offers a cautionary case study. The government launched the Petro in 2018, a state-backed cryptocurrency purportedly tied to oil reserves, and mandated its use for domestic transactions. The Petro was sanctioned by executive order, failed to attract meaningful adoption, and was abandoned.
The operational pivot came through PDVSA, Venezuela's state oil company, which shifted to USDT for crude oil sales to circumvent banking restrictions. An estimated $21 billion in oil revenue was routed through USDT channels, according to Atlantic Council analysis. When PDVSA discovered that Tether could freeze wallets on U.S. government request, it shifted to Bitcoin — a less traceable but less liquid alternative.
In March 2026, OFAC issued General License 52, authorizing transactions with PDVSA and its subsidiaries — the most significant easing of Venezuela oil sanctions since the company's designation. The crypto workaround became partially moot.
Venezuela's trajectory demonstrates a pattern: sovereign stablecoins fail when they lack credible reserves and real demand. The pivot to existing stablecoins works until the issuer cooperates with enforcement. Bitcoin provides censorship resistance but introduces liquidity and volatility risk at sovereign scale.
OFAC's 2026 enforcement actions against crypto-sanctions evasion represent a step change in both scope and targeting:
The pattern is clear: OFAC is targeting choke points — exchanges, issuers, and OTC desks — rather than attempting to regulate the underlying protocols. This approach exploits the centralization embedded in most sanctions-evasion architectures: A7A5 required Grinex; Iran required Nobitex; Venezuela required Tether cooperation.
Stablecoins remain the dominant instrument for state-level sanctions evasion. According to Chainalysis, stablecoins account for approximately 84% of illicit crypto transaction volume. This concentration creates both a vulnerability (centralized issuers can freeze assets) and an enforcement opportunity (transaction flows are traceable on public blockchains).
| Dimension | Russia (A7A5) | Iran (Exchange Network) | DPRK (Theft) | Venezuela (Petro/USDT) | |---|---|---|---|---| | Volume | $93B+ (2025) | $8–10B/yr | $2B/yr (theft) | $21B cumulative | | Instrument | Sovereign stablecoin | Dollar stablecoins (USDT) | Stolen assets | Sovereign token → USDT → BTC | | Infrastructure | Dedicated exchange (Grinex) | Domestic exchanges | Cyber operations | State oil company | | OFAC Vulnerability | High (exchange shutdown = 96% volume drop) | High (exchanges designated) | Low (no centralized infra) | Medium (issuer cooperation) | | Sustainability | Degraded post-enforcement | Degraded post-enforcement | Operationally persistent | Partially mooted by sanctions relief |
The data reveals a structural paradox. The architectures that process the most volume (Russia, Iran) are the most vulnerable to enforcement because they require centralized intermediaries. The architecture most resistant to enforcement (DPRK theft) generates the least volume and creates the most diplomatic exposure.
No state actor has successfully built a self-sustaining, enforcement-resistant, high-throughput crypto settlement system. Russia's A7A5 came closest but collapsed 96% when its sole exchange was shut down.
Netanyahu's blockchain statement is notable not for what it proposed — it proposed nothing specific — but for what it signals. A leader of a developed, globally integrated economy is publicly considering the same tools deployed by Russia, Iran, North Korea, and Venezuela. The empirical record of those programs is mixed at best.
The $104 billion in sanctions-related crypto flows in 2025 demonstrates that blockchain can move sovereign-scale value outside traditional banking rails. But the same data shows that enforcement is catching up. Russia's A7A5 collapsed under a single designation. Iran's exchange network was dismantled in a coordinated action. Venezuela pivoted three times as each channel was compromised.
The structural challenge remains: any sanctions-evasion architecture that processes meaningful volume requires centralized points — exchanges, issuers, custodians — and those points are targetable. The DPRK model avoids this but generates revenue through theft, not commerce.
For Israel, a $530 billion GDP economy with deep integration into global financial markets, the trade-off is different. Banking sanctions would be more damaging than for any of the four states examined here, and a crypto workaround would need to handle orders of magnitude more throughput than any existing state program has sustained. The gap between Netanyahu's statement and operational reality is, by all available evidence, very large.