In brief
- A new FATF report claims that crypto use by sanctioned states has grown exponentially.
- Stolen virtual assets, including $1.5B from ByBit, have funded North Korea’s nuclear activities.
- An emerging pattern of coordination among threat actors has been observed, an expert claims.
Cryptocurrency is increasingly enabling sanctioned states like North Korea and Iran to finance illicit weapons programs, according to a June 2025 report by the Financial Action Task Force (FATF), an intergovernmental organization established over three decades ago by G7 countries.
The global watchdog identifies blockchain-based assets as critical vulnerabilities exploited by proliferation finance networks, citing incidents such as North Korea’s theft of $1.4 billion from crypto exchange ByBit in February, facilitated by mixing services, unhosted wallets, and weakly regulated exchanges.
“The threat is real and growing,” Jeremiah O’Connor, chief technology officer at digital asset security and risk management platform Webacy, told Decrypt. The report “confirms what we’ve seen in the crypto security space for years: countries like North Korea are becoming increasingly skilled at using stolen crypto to fund weapons programs.”
Threat groups like Lazarus, known for cybercrimes linked to Pyongyang, have played key roles in such operations, the FATF report claims.
“Many illicit actors seek to increase anonymity in virtual asset transactions by using virtual asset mixing services and anonymity enhancing cryptocurrencies (AECs),” the report stated.
Those services help “process of laundering proceeds” for “large-scale virtual asset heists” that support the proliferation of weapons of mass destruction (WMDs), the FATF claimed.
Crypto’s inherent characteristics, meanwhile, make it especially attractive to sanctioned actors, O’Connor argued.
“Crypto gives sanctioned states a powerful mix of global access, pseudonymity, and weak enforcement. Unlike traditional banking, blockchains run 24/7, across borders, with no central authority,” O’Connor explained. “That makes it easy to move money quickly and exploit gaps in compliance.”
“In plain sight”
Platforms like eXch, recently shut down for its involvement in the ByBit hack, allegedly allowed threat actors and organizations such as the Lazarus Group to “cash out funds in plain sight,” O’Connor said.
The FATF’s report draws heavily on investigations from blockchain analytics firm Chainalysis, including an extensive study on how crypto transactions tie evidence to a network of Chinese fentanyl suppliers to Mexican cartels.
But beyond the report’s warnings, an emerging pattern of geopolitical coordination funded by crypto has emerged, according to O’Connor.
“What’s more concerning is how these networks are starting to overlap,” O’Connor told Decrypt. North Korean operatives have reportedly been “active in the Russia-Ukraine war,” with “Iranian-made drones” being used by Russian forces.
There’s also evidence that Iran and Russia have been “building joint drone factories,” O’Connor said, citing reports his team has reviewed.
Iran, which has been in conflict with Israel for almost two weeks, has relied on “militarised proxies in the Middle East as well as an array of transnational criminal organisations” to “mitigate the impact of economic sanctions,” the FATF report stated.
“Crypto plays a key role in financing and sustaining this kind of coordination, quietly and at scale,” O’Connor warned.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
