Cryptoassets and Sanctions Evasion: Emerging Typologies

Sanctions are among the most widely used instruments of foreign policy, aiming to restrict access to capital and services for individuals, entities, or states engaged in unlawful or destabilising activity. In the traditional financial system, sanctions compliance is enforced via regulated intermediaries—such as banks—through robust Know-Your-Customer frameworks, correspondent banking relationships, and centralised controls.

The emergence of cryptoassets challenges this architecture. Transactions on public blockchains are pseudonymous, borderless, and immutable. The ability to generate an unlimited number of wallet addresses, route transactions through intermediaries, or exchange assets via decentralised protocols introduces significant complexity to the enforcement of sanctions measures.

While blockchain offers a permanent audit trail, the effectiveness of sanctions compliance in the virtual domain depends heavily on the analytical capabilities and investigative tools deployed. Within DATACROS III, Crystal Intelligence’s know-how and technologies contribute to the development of new crypto-focused analytic modules and capacities – building on established collaborations with regulatory authorities, law enforcement agencies, financial institutions, and investigative partners to uncover crypto-enabled schemes employed by sanctioned entities and other illicit financial flows.

The importance of these technologies is evident from a recent investigation conducted by Crystal Intelligence into Garantex, a Russian-based cryptocurrency exchange sanctioned by the United States Department of the Treasury in April 2022 for its role in facilitating illicit financial flows, including ransomware-related transactions. Ransomware attacks involve a third party capturing a victim’s personal data, encrypting it, and holding it for ransom. In other words, individuals or companies are blackmailed  into paying their attacker to ensure their data does not end up for sale on the dark web or publicly released.

Following its designation as a sanctioned entity, Garantex ceased official operations—yet shortly thereafter, an exchange operating under the name Grinex appeared, exhibiting transactional patterns and wallet infrastructure consistent with its predecessor. Using Crystal’s blockchain analytics platform, continuity between Garantex and Grinex was identified, including shared address clusters, repeated counterparties, and mirrored fund flow patterns. Despite the change in branding, many of the original infrastructure components persisted, enabling continued access to crypto liquidity—particularly in USDT (Tether, a US dollar-pegged stablecoin)—through over-the-counter (OTC) brokers and offshore exchanges.

The Garantex case is an example of a broader pattern, wherein sanctioned entities simply exit and re-enter the financial eco-system under a new legal or operational guise. The complexity of cross-border enforcement, especially when supported by jurisdictional safe havens, creates opportunities for circumvention that are challenging to address without robust cross-sector cooperation and technical surveillance. Several recurring patterns and mechanisms can be observed:

• Non-Compliant and Unregulated Exchanges

Sanctioned actors exploit cryptocurrency exchanges with weak or absent Know Your Customer and anti-money laundering controls, particularly those based in jurisdictions with limited regulatory enforcement.

• Over-the-Counter (OTC) Brokers and Peer-to-Peer (P2P) Markets

OTC brokers and P2P platforms enable direct, often anonymous trading between individuals, including the conversion of traditional currencies (fiat) into cryptoassets. These transactions usually take place outside regulated channels, making them harder to monitor through conventional compliance procedures.

• Mixing Services and Privacy Coins

Mixers and tumblers are services that blend cryptocurrency transactions from multiple users, obscuring the trail of individual funds. Similarly, privacy-enhancing cryptocurrencies—such as Monero and Zcash—are designed to conceal sender, receiver, and transaction amount, making tracing extremely difficult.

• Chain-Hopping and Cross-Protocol Transfers

To evade detection, actors may transfer funds across multiple blockchains or convert them into different token formats. This is done using tools such as wrapped assets (tokens pegged to other cryptocurrencies), cross-chain bridges (to move assets between blockchains), and token swaps—techniques that complicate transaction tracing.

• Use of Decentralised Finance (DeFi) Protocols

DeFi platforms provide financial services such as trading, lending, and asset pooling through smart contracts—automated code that runs on blockchains. These platforms are often unregulated and do not require user identification, allowing sanctioned actors to access liquidity and move funds with minimal oversight.

• Rebranding and Shell Entity Structures

Entities facing sanctions may dissolve or rebrand while retaining core personnel, infrastructure, and customers, thereby maintaining operations under a new corporate identity.