In 2024, jurisdictions and entities on the OFAC sanctions list received $15.8 billion through cryptocurrency transactions—about 39% of all illicit activity. These figures were reported by experts from Chainalysis.
State Involvement in Illegal Transactions
According to analysts, a record 60% of illegal crypto transactions in 2024 were attributed to sanctioned jurisdictions rather than individuals or organizations.
Experts observed that this shift in proportions is linked to the activities of Iranian centralized exchanges, which have seen a surge in activity and fund outflows. Local services saw $4.8 billion exit—a 70% increase compared to the previous year.
New OFAC sanctions in 2024 primarily targeted financial infrastructure facilitating illegal financial activities, rather than individuals and small groups.
Chainalysis noted that as economic pressure intensifies, countries on the sanctions list are turning to cryptocurrencies to sustain trade and access capital.
Russia and Iran are strengthening ties with BRICS countries to develop payment mechanisms outside the traditional dollar system, including the potential creation of a common digital currency.
Resilience of Tornado Cash
Experts highlighted the role of crypto mixers in circumventing sanctions. They pointed out the service Tornado Cash, which continued operations despite OFAC sanctions (lifted in January 2025), the arrest of developers, and legal proceedings.
After the service’s web interface was disabled, fund inflows dropped by 90%, yet operations continued due to its decentralized smart contract system. In 2024, inflows increased by 108%.
“Although fund flows have not returned to pre-sanction levels, Tornado Cash still facilitates transactions worth hundreds of millions of dollars monthly,” analysts noted.
They emphasized that blockchain transparency allows for tracking illegal activities, but the decentralized nature of services makes forced shutdowns significantly challenging.
Earlier in February, Russian hosting provider Zservers was sanctioned for aiding the LockBit ransomware group.