From Tehran to Sana’a: Cryptocurrency and Sanctions Evasion in the Axis of Illicit Finance
Ansarallah (the Houthis) and cryptocurrency-enabled terrorist financing
In part 1 of this series,1 we examined how Iran has increasingly turned to cryptocurrency as a core tool in its sanctions-evasion toolkit, using digital assets to bypass conventional financial controls and support its broader regional network of allied armed groups, including Hezbollah, Hamas, and Ansarallah (the Houthis). In today’s edition of the series, we’re looking at how Iran moves money to the Houthis using cryptocurrency, and the networks that underpin this capability. Have a read to learn more about this threat network, what it means for global instability, and how to counter it.
Part 1:
The first installment of this eight-part series outlined how one of the world’s most heavily sanctioned states has evolved its financial infrastructure — integrating traditional networks with crypto rails — to sustain its economy and underwrite proxy activities across the Middle East. Against a backdrop of geopolitical conflict and tightening sanctions, Iran’s adoption of cryptocurrency is not just about evading sanctions but about embedding itself in an emerging “axis of illicit finance” that links it with other sanctioned states and actors, making crypto increasingly central to its ability to fund and project influence through its affiliates. In recent years, Iran’s proxy networks have conducted on-chain activity of over $2 billion; this activity is based on confirmed wallets identified in sanctions designations, and likely represents a low estimate of Iran’s true use of cryptocurrency for terrorist financing.
Yemen, the Houthis, and the Axis of Resistance
Over the last two years, the Houthis have become even more important to Iran amid geopolitical losses. At the same time, cryptocurrency has become increasingly important for Iran, with the IRGC’s share of Iran’s cryptocurrency ecosystem rising to 50% in the last quarter of 2025. For instance, several reports indicate that Iran accepts crypto payments for military equipment purchases, even if those payments are not necessarily processed directly through websites. Ultimately, sanctions targeting both Iran and the Houthis, and Iran’s development of crypto rails for payments to its proxies (among other uses), likely complement other, more traditional payment methods like hawala, cash couriers, and even bank transfers.
Like the other axis members, Iran funds the Yemen branch of its axis of resistance (Ansarallah / The Houthis) in various ways, primarily by diverting profits from illicit oil sales through cryptocurrency transactions. The crypto component of Iran’s hybrid threat-financing network that funds the Houthis is illustrated below. Some of the basic details are as follows:
According to the US OFAC, the IRGC-QF cooperates with Iran-based Ansarallah financial official Sa’id al-Jamal; OFAC has identified five cryptocurrency wallets associated with him. Al-Jamal also operates exchange companies in Sana’a, Yemen, specifically Janat al Anhar General Trading LLC (formerly Abu Sumbol General Trading LLC). These businesses facilitate payment for Iranian oil.
Funds transfers are also facilitated for him through a variety of money exchanges located in the United Arab Emirates (UAE), including Adoon General Trading FZE. Al-Jamal reportedly generates revenue through the illicit sale of Iranian petroleum to customers in East Asia using a network of shipping firms in Malaysia. (Malaysia acts as an intermediary for some Iranian oil, with Iranian oil re-labelled as originating from Malaysia and sold to other countries, including China).
These oil transactions often appear in Iran’s shadow banking network and refer to “Malaysian blend” oil. Some of these transactions have been small-denomination inflows through informal exchanges.
These transactions are not limited to the Middle East and are linked to the broader illicit finance network through Russia, specifically the Russian cryptocurrency exchange Garantex, which is reportedly still active despite sanctions and domain seizure. In April 2025, the US further identified eight wallets associated with Sa’id Al-Jamal and indicated that, in addition to facilitating illicit petroleum sales, he is also involved in weapons procurement from Russia and facilitating the sale of stolen Ukrainian grain. These addresses included six private wallets and two deposit addresses at mainstream services. According to Chainalysis, these addresses have moved nearly $1 billion in illicit funds. As part of this activity, the Houthis used deposit addresses at Garantex. In early 2026, allegations surfaced about the role of Binance in Iran’s illicit finance network, including for sending money to the Houthis. These allegations suggest that Binance has facilitated over $1.7 billion for Iran / IRGC / Axis of Resistance.2
Financial Intelligence Sources
Do you want to identify and exploit new sources of financial intelligence? Our evergreen course is your guide to finding, analyzing, and contextualizing open source financial intelligence. This step-by-step guide to FININT sources will greatly expand your intelligence knowledge and skills. This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today
An International Network
Anyone versed in counter-terrorist financing will also not find it surprising that this terrorist financing network has connections in Türkiye. According to OFAC, Türkiye-based Hassan Jafari has also worked with Sa’id al-Jamal to launder money on behalf of al-Jamal’s network and has arranged payments worth millions of dollars in support of shipments for the Houthis. Jafari has also worked with brothers Hushang and Sohrab Gahirat on the Houthis’ commercial initiatives in Russia, including arms procurement and grain shipments.
Part of this network also extends into Syria. For instance, Alireza Derakshan and Arash Estaki Alivand coordinated more than $100 million in oil sales for the Iranian government through cryptocurrency and used a network of front companies across multiple jurisdictions. Alivand worked as a financial facilitator and oil broker for Syria-based Al Qatirji Company, while Derakhshan used UAE-based Minato Commercial Brokers as a front company to make a payment to Al Qatirji Company.
In Yemen, a network of money service businesses connects and facilitates cryptocurrency payments, as well as traditional financial transfers and likely cash-out services:
Houthi finance official, Abdullah al-Jamal, has used a network of money service businesses, trade facilitators, and cryptocurrency addresses to move funds.
He has used the Sana’a-based money service business Mohammed Ali Al Thawr Exchange, and he also controls the Davos Exchange and Remittances company.
Other exchanges, specifically Khaled Al Hazmi and Brother Company General Partnership, have also transferred funds to Davos Exchange as part of this illicit activity.
This cryptocurrency network does not operate in isolation. Instead, it plugs directly into a wider ecosystem of exchange houses, front companies, and long-standing smuggling routes tied to the Houthis’ weapons-procurement apparatus. Together, these crypto nodes form a parallel financial architecture—one that functions as a secondary payment system —designed to move value, settle transactions, and sustain illicit activity while insulating the network from sanctions and traditional financial controls. While parts of this network are visible through on-chain analysis, additional off-chain activity (including cash and hawala transactions) likely further obfuscates the network's full extent.
Iran and the Houthis’ hybrid threat finance system is likely growing in complexity and sophistication, and is facilitated by access to greater pools of illicit cryptocurrency funds provided by Chinese money laundering networks. Furthermore, Ansarallah has used privacy-enhancing tools such as mixers and cross-chain protocols, demonstrating financial tradecraft capabilities.
Ansarallah’s use of cryptocurrency for financing, facilitated by a small number of identified individuals, reflects a broader and potentially more complex network linked to Iran. These facilitators operate through companies, hawalas, and exchanges in Türkiye, Russia, Yemen, Syria, Lebanon, and the UAE, thereby enabling the group to access financial infrastructure beyond Yemen’s borders. While current evidence highlights these specific connections, it remains unclear whether this network represents the entirety of Ansarallah’s crypto-financing apparatus or merely the visible edge of a much larger system. The opacity of these networks, combined with Iran’s established role in supporting proxy groups through both traditional and emerging financial channels, suggests that the full scale and sophistication of Ansarallah’s digital financing strategy might still be underappreciated.
Following Iran’s significant military setbacks in the first half of 2025, Iran needs Ansarallah more than ever, and faces significant sunk costs in terms of existing investment in the group. As a result, Iran is likely to continue, and could increase, support for the group, and some of the tens or hundreds of millions of dollars a year that Iran provides to the group might increasingly move through cryptocurrency.
© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.
This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.
I remain somewhat skeptical of these numbers; many wallets are used for different purposes (and sometimes serve as cash-out services or hawalas), so counting all transactions as part of a terrorist financing network might not be accurate. It’s worth having a solid understanding of a methodology before fully embracing these estimates.