Asher Draycott Nov
25

How $15.8 Billion in Sanctioned Crypto Transactions Shaped 2024's Financial Landscape

Sanctioned Crypto Flow Calculator

How do different analysis methods change the reported value of sanctioned crypto transactions? Input the total transactions amount to see how Chainalysis, TRM Labs, and CoinLaw.io would report it.

Article context: The $15.8 billion figure represents all transactions linked to sanctioned wallets, while CoinLaw.io's $2.7 billion counts only directly designated addresses. The difference comes from methodology.

Total Crypto Transactions ($)

Analysis Methodology

Over $15.8 billion in cryptocurrency flowed to entities and jurisdictions under U.S. sanctions in 2024. That’s not a typo. It’s more than the GDP of some small countries - all moving through digital wallets, cross-chain bridges, and decentralized exchanges, mostly out of reach of traditional banking systems. This isn’t about speculative trading or tech hype. This is about money laundering, ransomware, and state-backed evasion on a scale that’s rewriting the rules of global finance.

Why Bitcoin Still Dominates Sanctioned Crypto Flows

Bitcoin wasn’t just the most popular cryptocurrency in 2024 - it was the backbone of sanctioned activity. It made up 68% of all transactions tied to OFAC-designated wallets. Why? Because it’s the oldest, most liquid, and easiest to move across borders without immediate scrutiny. Unlike newer tokens, Bitcoin’s transaction history is fully public and traceable, but that’s exactly why bad actors rely on it: they know how to hide in plain sight.

Ethereum followed at 20%, mostly because smart contracts enable complex DeFi maneuvers. Stablecoins like USDT accounted for the remaining 12%. These are the digital cash equivalents - pegged to the U.S. dollar, easy to convert, and widely accepted on exchanges that still operate in gray zones. In 2024, over $2 million in Bitcoin was swapped for USDT through Garantex by a sanctioned money launderer named Ekaterina Zhdanova. That’s not an anomaly. It’s a pattern.

The Real Culprits: Garantex, Nobitex, and the Exchange Duopoly

You won’t find these names in your everyday crypto news. But if you’re tracking sanctioned transactions, Garantex and Nobitex are the two biggest gateways. Together, they handled more than 85% of all crypto inflows to sanctioned entities in 2024.

Garantex, based in Russia, was officially sanctioned by the U.S. Treasury in March 2024. Why? Because it knowingly processed millions in ransomware proceeds - from Conti, Black Basta, LockBit, and other notorious gangs. The exchange didn’t just accept funds. It offered accounts, withdrawal services, and even helped convert crypto to fiat through shell companies. OFAC didn’t just freeze wallets - they shut down entire infrastructure.

Nobitex, Iran’s largest centralized exchange, became the go-to for capital flight. As Western banks cut ties with Iranian entities, crypto became the only lifeline. Transactions spiked as individuals and businesses tried to move money out of the country. The Iranian government didn’t officially endorse this - but it didn’t stop it either. The result? A surge in crypto outflows that mirrored the collapse of the rial’s value.

DeFi: The Wild West of Sanctions Evasion

Decentralized Finance wasn’t supposed to be a loophole. It was meant to remove middlemen, not empower criminals. But in 2024, 33% of all illicit crypto funds passed through DeFi platforms linked to sanctioned entities. Liquidity pools, automated market makers, and non-custodial wallets made it nearly impossible for regulators to freeze or trace funds.

OFAC flagged 150 DeFi liquidity pools as high-risk in 2024. These weren’t random smart contracts - they were designed to mix funds, break transaction trails, and obscure origins. One pool, for example, accepted USDT from a ransomware wallet, swapped it for ETH, then sent it to a new address that had never been flagged before. The whole process took under 12 minutes. No KYC. No ID. No oversight.

The problem isn’t that DeFi is inherently bad. It’s that the tools meant to protect privacy are now being weaponized. And regulators are playing catch-up.

Two ancient exchange towers, Garantex and Nobitex, loom over a landscape of collapsing currency and glowing stablecoins held by a child.

Ransomware, Darknets, and the Rise of State-Sponsored Crypto

Ransomware didn’t disappear in 2024 - it adapted. $800 million in ransom payments were routed through sanctioned wallets, a 22% jump from 2023. Most of it came from Russia-linked groups. These weren’t lone hackers. These were organized cybercrime units with ties to state intelligence networks.

Darknet marketplaces, once the primary hub for illegal crypto trade, still moved $1.1 billion in 2024. Russia-based platforms dominated this space, offering everything from stolen data to weapons. What changed? Buyers started using stablecoins more often. Why? Because USDT and USDC are easier to cash out without raising red flags than Bitcoin.

And then there’s Iran. Its use of crypto wasn’t just about evasion - it was about survival. As sanctions tightened on its banking system, Tehran quietly encouraged the use of digital assets to bypass restrictions. The result? A shadow economy powered by crypto, where ordinary citizens trade USDT for food and medicine while the government funnels oil revenues into offshore wallets.

Why the Numbers Don’t Add Up (And Why It Matters)

Here’s the twist: not everyone agrees on the $15.8 billion figure.

Chainalysis says $15.8 billion. TRM Labs says $14.8 billion. CoinLaw.io says $2.7 billion. Why such a gap?

It comes down to methodology. Chainalysis includes all transactions that pass through a wallet ever linked to a sanctioned entity - even if the funds were mixed, moved, or layered dozens of times. TRM Labs uses stricter thresholds, only counting direct inflows. CoinLaw.io focuses on wallets with confirmed ties to OFAC designations, ignoring indirect links.

The truth? All three are right - in different ways. But the most important number isn’t the total. It’s the trend. Illicit crypto volume dropped 24% overall in 2024, but sanctions-related activity held steady. That means criminals are doing less fraud and more sanctioned evasion - a shift in strategy that’s far more dangerous.

A glowing lotus-shaped DeFi pool emits spirits of privacy coins as AI drones hover above, with wallet addresses glowing beneath like fish.

The Infrastructure Behind the Numbers

Behind every transaction is a system. In 2024, 19% of sanctioned crypto flows used cross-chain bridges to hop between blockchains - Bitcoin to Ethereum to Solana to Polygon - to confuse tracking tools. These bridges are supposed to make crypto more interoperable. Instead, they’ve become evasion tunnels.

And here’s the kicker: 55% of sanctioned wallets processed over $500,000 each. These aren’t small-time scammers. These are organized operations with budgets, teams, and infrastructure. One wallet alone moved $12 million in Bitcoin over six months - all from ransomware payouts. It wasn’t hidden. It was just ignored until it was too late.

What’s Next? The Arms Race Heats Up

In 2025, the game changes again. Regulators are deploying AI to detect patterns in real time. New tools can now cluster thousands of wallets and flag anomalies before they become problems. The U.S. Treasury is working with Europol, the UAE, and Singapore to share blockchain intelligence. Countries that once turned a blind eye are now freezing crypto wallets under U.S. sanctions.

But the bad guys aren’t standing still. Privacy coins like Monero and Zcash are gaining traction. New DeFi protocols are launching with built-in mixing features. Cross-chain bridges are getting faster, cheaper, and harder to monitor.

The $15.8 billion in 2024 wasn’t a peak. It was a warning. Crypto isn’t going away. Sanctions aren’t going away. The only question is: who will win the race?

How did $15.8 billion in sanctioned crypto transactions happen in 2024?

The $15.8 billion came from cryptocurrency inflows to wallets linked to sanctioned countries like Iran and Russia, as well as criminal groups like ransomware gangs. These funds moved through centralized exchanges like Garantex and Nobitex, cross-chain bridges, and DeFi platforms. The money originated from ransomware payments, capital flight, and illicit trade, then was layered across multiple blockchains to avoid detection.

Why is Bitcoin the most used crypto in sanctioned transactions?

Bitcoin is the most liquid, widely accepted, and easiest to move across borders without KYC. Even though its transactions are public, criminals use mixing services, multiple wallet addresses, and cross-chain swaps to obscure the trail. Its established infrastructure makes it the default choice for large-scale, high-value transfers tied to sanctions.

What role did DeFi play in sanctions evasion?

DeFi platforms enabled 33% of all illicit crypto flows in 2024 by removing centralized control. Liquidity pools and automated swaps allowed funds to move without identity checks, making it nearly impossible to freeze or trace transactions. OFAC flagged 150 DeFi pools as high-risk, but shutting them down isn’t feasible since they’re code-based and decentralized.

Why are Garantex and Nobitex so important in this context?

Garantex and Nobitex handled over 85% of all crypto inflows to sanctioned entities in 2024. Garantex processed ransomware payments and helped launder funds for Russian cybercriminals. Nobitex became Iran’s primary gateway for moving money out of the country as traditional banking collapsed. Both were sanctioned by the U.S. Treasury, but their infrastructure remains active through shell operations.

Is crypto becoming a tool for state-sponsored evasion?

Yes. Countries like Iran and Russia are no longer just passive users of crypto - they’re actively shaping its use to bypass sanctions. Iran uses it for capital flight and importing essentials. Russia uses it to fund cyberattacks and move oil revenue. These aren’t rogue actors - they’re state-aligned operations with resources, planning, and coordination.

What’s the difference between Chainalysis and TRM Labs’ numbers?

Chainalysis counts all transactions that ever touched a sanctioned wallet, even after multiple transfers. TRM Labs only counts direct inflows to known sanctioned addresses. CoinLaw.io uses the strictest criteria, requiring confirmed OFAC designations. The differences reflect methodology, not error - and all point to the same conclusion: sanctions evasion is growing more sophisticated.

Are privacy coins like Monero a bigger threat now?

They’re not the biggest threat yet - Bitcoin still dominates sanctioned flows. But privacy coins are rising. Their built-in anonymity features make transactions untraceable. As regulators crack down on public blockchains, criminals are shifting toward Monero and Zcash. That’s why enforcement agencies are investing heavily in next-gen analytics that can detect even hidden transactions.

Can regulators ever catch up to crypto sanctions evasion?

They’re making progress. AI tools now detect wallet clusters and transaction patterns faster than ever. International cooperation between the U.S., EU, and Asia is improving. But crypto evolves faster than regulation. The real challenge isn’t technology - it’s global coordination. As long as some countries ignore sanctions or host unregulated exchanges, evasion will continue.

Asher Draycott

I'm a blockchain analyst and markets researcher who bridges crypto and equities. I advise startups and funds on token economics, exchange listings, and portfolio strategy, and I publish deep dives on coins, exchanges, and airdrop strategies. My goal is to translate complex on-chain signals into actionable insights for traders and long-term investors.