Sanctioned States Use Crypto to Fund Weapons Programs, FATF Warns

Cryptocurrency is increasingly being used by sanctioned states such as North Korea and Iran to finance illicit weapons programs, according to a June 2025 report by the Financial Action Task Force (FATF). The global watchdog identifies blockchain-based assets as critical vulnerabilities exploited by proliferation finance networks. For instance, North Korea's theft of $1.4 billion from crypto exchange ByBit in February was facilitated by mixing services, unhosted wallets, and weakly regulated exchanges.

Jeremiah O’Connor, chief technology officer at digital asset security and risk management platform Webacy, emphasized the growing threat. "The threat is real and growing," he stated. "The report confirms what we've seen in the crypto security space for years: countries like North Korea are becoming increasingly skilled at using stolen crypto to fund weapons programs."

Threat groups like Lazarus, known for cybercrimes linked to Pyongyang, have played key roles in such operations, the FATF report claims. These groups seek to increase anonymity in virtual asset transactions by using virtual asset mixing services and anonymity-enhancing cryptocurrencies (AECs). These services help in the process of laundering proceeds for large-scale virtual asset heists that support the proliferation of weapons of mass destruction (WMDs).

Crypto's inherent characteristics make it especially attractive to sanctioned actors. O’Connor argued that "Crypto gives sanctioned states a powerful mix of global access, pseudonymity, and weak enforcement. Unlike traditional banking, blockchains run 24/7, across borders, with no central authority. That makes it easy to move money quickly and exploit gaps in compliance."

Platforms like eXch, recently shut down for its involvement in the ByBit hack, allegedly allowed threat actors and organizations such as the Lazarus Group to "cash out funds in plain sight." The FATF’s report draws heavily on investigations from blockchain analytics firm Chainalysis, including an extensive study on how crypto transactions tie evidence to a network of Chinese fentanyl suppliers to Mexican cartels.

Beyond the report's warnings, an emerging pattern of geopolitical coordination funded by crypto has been observed. O’Connor noted that "What’s more concerning is how these networks are starting to overlap." North Korean operatives have reportedly been “active in the Russia-Ukraine war,” with “Iranian-made drones” being used by Russian forces. There’s also evidence that Iran and Russia have been "building joint drone factories."

Iran, which has been in conflict with Israel, has relied on "militarised proxies in the Middle East as well as an array of transnational criminal organisations" to "mitigate the impact of economic sanctions." Crypto plays a key role in financing and sustaining this kind of coordination, quietly and at scale, according to O’Connor.