How Sanctions Enforcers Learned to Follow the Coins

In the early years of bitcoin, a common assumption among both enthusiasts and critics was that cryptocurrency would make economic sanctions obsolete. Money that moved without banks, the reasoning went, could not be blocked by governments that relied on banks to enforce their rules. A decade of experience has proved that assumption wrong, though not entirely. Governments have learned to trace, designate and seize crypto with increasing sophistication. At the same time, sanctioned states and criminal groups have adapted, and courts have begun to draw lines around what enforcers can do. The story of that contest explains a great deal about the current role of crypto in sanctions evasion.

Transparency was the first surprise

The central insight that transformed enforcement was that most public blockchains are not anonymous. Every transaction on the bitcoin or Ethereum ledger is recorded permanently and visible to anyone. Addresses are pseudonymous, but once an address is linked to a person or entity, often through an exchange that collects identity documents, the history becomes readable. A commercial industry of blockchain analytics firms grew up to exploit this, selling tools to law enforcement, exchanges and banks that cluster addresses, label known entities and flag suspicious flows.

The US Treasury's Office of Foreign Assets Control began including crypto addresses in its sanctions listings in 2018, when it named two Iran-based individuals linked to ransomware. In 2021 it designated Suex, a Russia-linked exchange, the first time a crypto trading platform itself was sanctioned for facilitating illicit transactions. Designation matters because any US person, including a US exchange, is then prohibited from dealing with the listed addresses, and compliance systems across the industry screen against them.

The Russian test case

After Russia's full-scale invasion of Ukraine in February 2022, Western governments worried that crypto could become a major route around the unprecedented sanctions imposed on Russian banks. In practice, the market was too small and too traceable to replace the banking system for large flows. But it did serve specific niches. OFAC sanctioned Garantex, a Moscow-based exchange, in April 2022, accusing it of facilitating transactions for darknet markets and ransomware groups. It continued operating for nearly three years. Last month, US authorities working with German and Finnish counterparts seized the exchange's web domains and froze funds, and US prosecutors unsealed charges against individuals said to be behind it.

Tornado Cash and the limits of sanctions law

The most legally consequential episode involved Tornado Cash, an Ethereum-based service that mixes users' funds to break the link between sender and recipient. In August 2022, OFAC sanctioned it, citing its use to launder billions of dollars, including proceeds of hacks attributed to North Korea's Lazarus Group. The designation was controversial because much of Tornado Cash consisted of immutable smart contracts, code that runs on the blockchain and that no one could shut down or alter.

Users challenged the designation in court. In November 2024, a federal appeals court ruled that the immutable smart contracts were not 'property' that could be blocked under the relevant sanctions law. Last month, the Treasury removed Tornado Cash from the sanctions list. The episode established an important boundary: sanctions law is well suited to targeting people and companies, but applying it to software that no one controls is legally fraught. Criminal prosecutions of individuals associated with the service are a separate matter and have continued.

Blockchains made money visible. They did not make it easy to stop, and the law is still working out the difference.

North Korea: theft as a revenue model

No state has exploited crypto more aggressively than North Korea. Rather than using it mainly to move legitimate trade revenue, Pyongyang has used hacking to steal crypto on a large scale, with the proceeds widely assessed by governments and United Nations experts to help fund its weapons programs. In February, the Dubai-based exchange Bybit suffered a theft of roughly one and a half billion dollars in digital assets, the largest crypto hack on record, which the FBI attributed to North Korean actors. The stolen funds were quickly moved through a series of swaps and bridges, illustrating both the reach of blockchain tracing, which followed the flows in near real time, and its limits, since much of the money could not be frozen.

What the history shows

• Crypto has not been a large-scale replacement for sanctioned banking, but it serves specific evasion and laundering niches.
• Traceability is the enforcer's main advantage; conversion points such as exchanges are the main chokepoints.
• Sanctions work best against identifiable intermediaries and less well against autonomous code.
• State-linked hacking represents a distinct threat that sanctions alone cannot address.

The current US administration has adopted a far friendlier stance toward the crypto industry, dropping several cases against platforms and signaling that enforcement resources will be concentrated on fraud and serious crimes rather than on regulatory disputes. That shift may change the mix of cases, but sanctions enforcement is likely to remain a priority, given its national security dimension.

An arms race, not a solved problem

The contest between sanctions enforcers and those trying to evade them is ongoing. Enforcers have become far more capable, using the transparency of blockchains and cooperation with exchanges to trace and seize funds. Evaders have turned to mixing services, cross-chain bridges, stablecoins on high-throughput networks and jurisdictions with weak oversight. The legal framework is still adapting, as the Tornado Cash ruling shows. For policymakers, the lesson of the past decade is that crypto is neither a sanctions-proof channel nor a solved problem, but a new terrain that requires specialized tools and international cooperation. This article is analysis, not legal or investment advice.