Sanctions, Hackers and Ruble Tokens: Crypto on the Front Lines of Conflict

When analysts discuss crypto and geopolitics, they often focus on prices: how bitcoin reacts to a war or a sanctions announcement. A more consequential story is unfolding behind the charts. Over the past few years, states at war or under sanctions have integrated crypto into their financial strategies, while Western governments have developed new tools to fight back. The result is a quiet front line where hackers, sanctions officials, blockchain analysts and stablecoin issuers now play significant roles.

North Korea: crypto theft as state finance

No state has exploited crypto more aggressively than North Korea. Groups linked to its government have stolen billions of dollars in digital assets over the past several years, according to UN monitors and blockchain analytics firms. The largest single incident came in February 2025, when roughly $1.5 billion in ether was stolen from the Dubai-based exchange Bybit, the biggest crypto theft on record. The FBI attributed the attack to North Korean hackers.

For a heavily sanctioned state, crypto theft is not a side business. UN reports have described it as a significant source of foreign currency, used to support weapons programs. The stolen funds are typically laundered through a series of swaps, cross-chain bridges and over-the-counter brokers, which makes recovery difficult despite the transparency of public blockchains.

Russia: building a parallel system

Russia's relationship with crypto has shifted since 2022. Facing Western sanctions and restrictions on its access to the international banking system, Moscow adopted legislation in 2024 permitting crypto use in certain cross-border settlements and legalizing crypto mining under a regulated framework. The aim was to give exporters and importers alternative channels to move value.

Western authorities responded. In March 2025, US and European law enforcement took down the domains of Garantex, a Russian exchange that had been sanctioned for facilitating money laundering. Attention then turned to a ruble-backed stablecoin known as A7A5, which analysts linked to sanctioned Russian financial networks and which processed large volumes of transactions in 2025. Western governments, including in the EU and UK, moved to include it and related entities in sanctions measures.

The Russian case highlights a key point: a state cannot simply switch to crypto to escape sanctions. It needs exchanges, liquidity providers and counterparties willing to accept the risk of secondary sanctions. Each of these can be targeted, which is why enforcement increasingly focuses on the infrastructure rather than individual transactions.

Crypto did not make sanctions obsolete. It moved the enforcement battle from banks to exchanges, issuers and code.

Iran: crypto in a hot war

Iran offers a different example. The country has used crypto mining to monetize cheap energy and has faced long-standing restrictions on its financial system. During the brief but intense conflict between Israel and Iran in June 2025, a hacker group widely described as pro-Israel attacked Nobitex, Iran's largest crypto exchange, and destroyed roughly $90 million in assets by sending them to inaccessible addresses. The attack was aimed less at stealing money than at undermining a financial channel associated with the Iranian state.

The episode showed that crypto infrastructure can itself become a target in wartime, not just a tool for moving funds. It also raised uncomfortable questions for ordinary Iranians who used the exchange to protect savings from a depreciating rial, and whose assets were caught up in an attack aimed at the state. In conflicts, the line between state-linked infrastructure and civilian financial tools is often blurred.

Ukraine: crypto as a fundraising tool

Crypto has also been used on the other side of these conflicts. In the early weeks of Russia's 2022 invasion, the Ukrainian government and volunteer groups raised well over $100 million in crypto donations, according to blockchain analysts, and used some of the funds to buy military and humanitarian supplies. Ukraine later passed legislation to regulate virtual assets. The case shows that crypto's role in conflict is not only a story of sanctions evasion; it can also be a fast channel for legitimate support when traditional systems are slow.

The enforcement toolkit

Western governments have developed an expanding set of tools to address these risks:

• Sanctions designations against exchanges, mixers, individuals and specific wallet addresses.
• Stablecoin freezes, since issuers of major stablecoins can block tokens in specific addresses, often at the request of law enforcement.
• Blockchain analytics, which allows investigators to trace flows across wallets and exchanges.
• International cooperation, including information sharing and coordinated takedowns of illicit platforms.

New regulatory frameworks reinforce these tools. The EU's MiCA regime and its anti-money laundering rules require crypto providers to verify customers and trace transfers. In the United States, the GENIUS Act of July 2025 requires stablecoin issuers to maintain the technical ability to freeze and seize tokens when legally required.

The limits of enforcement

Enforcement has clear limits. Decentralized protocols and privacy tools are harder to police than centralized exchanges. Stablecoins issued outside Western jurisdictions may not cooperate with Western requests. And sanctioned states can develop their own infrastructure, including local-currency tokens and domestic exchanges, that operate largely outside Western reach.

There is also a policy trade-off. Aggressive enforcement can push activity toward less transparent channels, while overly broad sanctions can affect legitimate users. The debate over sanctioning software protocols, as opposed to people and companies, has been particularly contentious in the United States, with courts questioning how far such sanctions can go.

Why this matters for markets

For crypto markets, the growing role of digital assets in conflict has two effects. It increases regulatory scrutiny, which can weigh on sentiment and raise compliance costs. But it also underlines crypto's real-world significance: tools used by states, sanctioned or not, are no longer marginal. As conflicts continue in Eastern Europe and the Middle East, crypto's role as both a weapon and a battlefield is likely to grow. This article is analysis, not investment advice.