Category deep-dive: Sanctioned entities continued to drive illicit crypto volume in 2024

Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. In part one, we took a look at overall crypto transaction volumes and examined the decline in illicit crypto volume on TRON. 

To read the 2025 Crypto Crime Report in full and download your copy, click here.

Sanctioned entities drove the largest share of illicit crypto volume in 2024

In 2024, sanctioned entities drove the largest share of illicit crypto volume, though inflows currently appear to have decreased from USD 21.9 billion in 2023 to USD 14.8 billion — a 33% decline. 

Garantex, Russia’s largest cryptocurrency exchange, and Nobitex, Iran’s largest cryptocurrency exchange, accounted for over 85% of the inflows to sanctioned entities and jurisdictions, though their overall volumes also decreased. This is likely due to a number of factors, including the potential use of alternative services and the uncertainty of regime support for cryptocurrency use in heavily sanctioned jurisdictions. The end of 2024 saw reports from Iran indicating that the Iranian regime is preparing to regulate the crypto economy for increased transparency, as well as reports the Central Bank of Iran closing access to the portals of cryptocurrency exchanges.  

{{BlogAd-2025CryptoCrimeReport-Report-2}}

Leveraging sanctions to disrupt the Russian illicit economy, Hamas, and Hezbollah

A standout aspect of the 2024 sanctions landscape was the targeting by the United States and global partners of key entities and individuals supporting sanctions evasion and money laundering through virtual currencies as part of Russia’s illicit economy. OFAC issued 13 sanctions designations that included 86 cryptocurrency addresses — many of which targeted Russia and cyber-related individuals and entities, including members of the Trickbot ransomware group, money laundering networks, and cryptocurrency exchanges facilitating illicit activities. 

Centralized and peer-to-peer exchanges NetEx24, Bitpapa, and Cryptex were among those targeted for facilitating millions worth of transactions for illicit and sanctioned actors. Inflows to these three exchanges dropped an average of 82% in the three months post-designation, compared to their pre-designation volumes. Individuals like Elena Chirkinyan and Khadzi-Murat Dalgatovich Magomedov were also designated following a major global investigation led by the United Kingdom’s National Crime Agency (NCA) “Operation Destabilise,” for their role in money laundering and sanctions evasion operations through various means, including cryptocurrency.

In addition to Russia and cyber-related designations, there were a number of crypto-related designations of entities and individuals connected to Hamas and Hezbollah in the wake of the October 7 attack in 2023. These designations included GazaNow (a Gaza-based entity) and its founder Mustafa Ayash for raising funds for Hamas following the October 7 attack, as well as Tawfiq Muhammad Sa’id al-Law (a Lebanon-based Syrian hawala operator) for providing Hezbollah with digital wallets to receive funds from IRGC-QF commodity sales and conducting crypto transfers on behalf of sanctioned Syrian entities.

{{horizontal-line}}

Next up in this series: We take a closer look at the use of cryptocurrency in terrorist financing.

Ready to dive into the full 2025 Crypto Crime Report? Get your copy here.