Iran's financial tradecraft on the blockchain
How Iran uses a hybrid threat finance system to fund its proxies and sanctions evasion activities.
Hello Insight Monitor subscribers, and welcome to another edition of our series examining how Iran uses cryptocurrency for sanctions evasion and terrorist financing. Today, we’re looking at the financial tradecraft that Iran uses to hide its money on the blockchain, all in the context of shifting economic and financial pathways for the Iranian regime. Get caught up and have a read!
In part 1 of this series, we explained the context of the Iran sanctions and how Iran began widespread cryptocurrency use in 2018, largely as a response to those sanctions. We highlighted Iran’s role in mining Bitcoin, which creates liquidity for the regime while also leveraging its oil surplus.
In part 2 of the series, we explored how Iran uses cryptocurrency to finance the Houthis (Ansarallah). We illuminated the various companies, exchanges, and individuals involved in Iran-Yemen crypto threat finance, highlighting the many jurisdictions this network spans.
Today, we’re exploring Iran’s use of financial tradecraft and how the regime integrates that with cryptocurrency to hide the source and destination of funds. As the economic impacts of the Iran-Israel-US war become apparent, it is clear that Iran’s economy has been badly damaged. Further, the war has caused a significant break in relations with other Gulf countries, notably the UAE, where Iran enjoyed relatively good freedom of movement, and made extensive use of the money service business sector to move money through MSBs, hawalas, and into the semi-formal system. With the UAE’s crackdown on Iranians (and their money service businesses), this part of Iran’s threat finance ecosystem is under significant strain, likely leading to an even greater move towards cryptocurrency.
Indeed, Iran stated that its tolls in the Strait of Hormuz would be paid at least in part in cryptocurrency. Reports suggest that Iran is accepting either Bitcoin or USDT; each has their own advantages and disadvantages. In practice, Bitcoin is a likely good option for Iran because the regime has extensive experience with it. However, Bitcoin also fluctuates in price, making it difficult to price assets (or services, such as tolls) in it. On the other hand, USDT is more stable (pegged to the US dollar) but is centrally controlled and can be frozen.
Tracing these transactions, as well as Iran’s other crypto transactions, is possible. Cryptocurrency alone does not guarantee anonymity. For Iranian actors and their proxies like Hamas, Hizballaha and the Houthis, successfully evading sanctions requires sophisticated financial tradecraft to conceal the source, destination, and purpose of funds. These actors blend blockchain-based tools with traditional illicit finance techniques, exploiting weaknesses in global regulatory regimes.[i]
Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!
Key elements of this tradecraft include:
Mixers and privacy tools: After a major asset seizure, Hamas began routinely using crypto mixers—services that blend cryptocurrency to obscure transactions.[ii] A cryptocurrency mixer is a service that obscures the origins and destinations of digital assets by pooling together multiple users’ coins and redistributing them in a way that breaks the transaction trail. Some common mixers include Tornado Cash (for Ethereum) and Wasabi wallet (specific to Bitcoin). They’ve also increasingly engaged with privacy coins like Monero, which are designed to resist tracing efforts.
Cross-chain protocols and book transfers: These techniques move value across different blockchains or within exchanges, often via internal (off-chain) transfers, making transactions difficult to trace on public ledgers. Some common cross-chain protocols include THORChain, which allows swapping assets directly across different blockchains, and the Ren Protocol, which facilitates the transfer of Bitcoin, Zcash, and other assets into Ethereum. (Also called “cross-chain swaps”.)
Use of shell and front companies: Entities labelled as “general trading companies” facilitate or camouflage transactions, especially in trade-based money laundering (TBML) schemes. These companies act as intermediaries or conduits for moving value tied to illicit networks.
Jurisdictional arbitrage: High-risk exchanges in Russia, China, Türkiye, and other permissive jurisdictions are regularly used for obfuscation, especially those with tiered KYC policies allowing significant transfers without identification.
OTC brokers: These brokers, often regionally based, facilitate the off-ramping of cryptocurrency into state-issued currency. They operate outside formal exchange infrastructure, creating additional layers of opacity. [iii]
Iran uses significant financial tradecraft to hide much of its activity on the blockchain. Newer tools, such as Russia’s Ruble-backed stablecoin A7A5 might increasingly play a role in these obfuscation techniques, although for the time being, there is no evidence to suggest that Iran has had to adopt newer (and sometimes riskier) techniques; the current tools that it uses appear sufficient to allow it to move money internationally and provide funds to its intended recipients, including terrorist groups.
In collecting tolls from the Strait of Hormuz, Iran is likely to use these (and possibly other) tools to hide the funds and protect them from freezing and seizure. Practically speaking, given the sophistication of Iran’s cryptocurrency operations, Iran has almost complete freedom of movement in this space, and working with other partners like Russia, will likely remain largely immune from efforts to disrupt their crypto operations.
Finally, US and Israeli strikes against Iranian regime members have killed a significant tranche of Iranian leadership. These were primarily older, more traditional regime members. The segment of the regime pushing cryptocurrency adoption has likely been empowered by these strikes, and will further push the Iranian regime into cryptocurrency adoption for threat (and regime) financing.
This research is part of my post-doctoral work funded by the University of Calgary’s Faculty of Law.
[i] Saiz, “Sanctions in the Virtual Asset Industry: SIFMANet Roundtable Report,” 3.
[ii] Julia Shapero, “Hamas Money Laundering Worries Spark Proposed New U.S. Crypto Rule,” Text, The Hill (blog), October 19, 2023, https://thehill.com/business/4265344-hamas-money-laundering-worries-spark-new-u-s-crypto-rule/.
[iii] Application for a warrant to seize property subject to forfeiture (US District Court for the District of Columbia March 27, 2025).
© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.