Follow the Money · 19 — The Sanctioned State: Crypto Against the Blockade

Follow the Money — Case 19. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Most of this register follows criminals. This case follows states. When a nation is cut off from the dollar-based financial system by sanctions — as Russia was in substantial part after 2022, as Iran has been for years, as the DPRK has been comprehensively — it faces a problem no ransomware crew ever does: it has an entire economy to fund, trade to settle, and reserves to hold, and the world's dominant financial rail has been closed to it. And into that problem, cryptocurrency presents itself as a tempting answer: a way to move value across borders without the correspondent banks the United States controls.

The fear that follows is loud and widely held: that crypto hands rogue states a master key to the sanctions cage, a way to simply route around the blockade and carry on as if it were not there. This case tests that fear against the record, and finds it mostly wrong — not because the capability is imaginary, but because it is bounded. Crypto does give a sanctioned state a real rail around the dollar. It also gives that state a rail that is too shallow to carry a national economy, too transparent to hide the evasion, too dependent on a stablecoin with a kill switch, and too easily blocked node by node through designation. The escape hatch is real. It is also narrow, leaky, and repeatedly slammed shut.

This is the letter about crypto against the blockade, and the disposition is FROZEN. Not because the state never moves a dollar of value on-chain — it does — but because the escape is stopped and frozen at every edge: value halted at the shallow limits of the market, exposed by the transparent ledger, killed by the stablecoin freeze, and cut off by the SDN list. The sanctioned state's crypto finance is a supplement at the margin, not a substitute for the dollar, and the difference between those two is the whole case.

1. Why the Blockade Bites, and Why Crypto Tempts

Start with what a financial blockade actually is, because it explains both the temptation and its limits. The power of US sanctions over a foreign state does not come from controlling that state's money; it comes from controlling the dollar, and the dollar is the currency the world trades in. To move dollars internationally, you need correspondent banking — a chain of banks, anchored in the US financial system, that clear the payment. The United States can order that chain to exclude a sanctioned party, and because almost all international trade touches the dollar somewhere, being excluded from the dollar's plumbing means being excluded from a huge share of the world economy. That is the blockade: not a wall around a country, but a lock on the pipes everyone else uses.

Now the temptation is obvious. Crypto is a rail with no correspondent banks in the middle. Value moves peer-to-peer across borders and settles on a blockchain without any US-controlled intermediary in the chain. For a state locked out of dollar clearing, that looks like exactly the missing piece: a way to pay for imports, receive payment for exports, and move reserves, all without asking permission from a banking system that has been told to say no. And the most useful instrument is the dollar-pegged stablecoin — a token worth a dollar, moving on crypto rails, offering the stability of the dollar without (it seems) the dollar's gatekeepers. The Treasury's assessments document the actors reaching for exactly this: Russia after 2022 under a wave of new evasion designations, Iran with its long-sanctioned oil and financial networks, the DPRK with its documented crypto fluency.

So the register grants the premise fully: the capability is real. A sanctioned state can and does use crypto to move some value around the blockade. This is not a hypothetical or a panic; it is a documented use, and pretending otherwise would be as dishonest as the opposite exaggeration. The question the case actually turns on is not whether crypto offers a sanctioned state a rail around the dollar — it does — but how much that rail can carry, how visible it is, and how easily it can be blocked. And on all three, the answer bounds the escape hard.

2. The First Wall: Scale

The decisive limit is the one least appreciated in the fear narrative: crypto is far too small to carry a national economy's sanctioned trade. This is not a matter of technology or policy but of arithmetic, and it is close to dispositive on its own.

Consider the numbers a state has to move. A nation's sanctioned trade — oil exports, arms deals, machinery imports, the flows that actually sustain a state under blockade — runs to hundreds of billions of dollars a year. Now consider the pool available to move it: not the notional total market capitalization of all crypto, which is a misleading figure, but the actual liquidity usable for large cross-border settlement without moving the price. That pool is orders of magnitude smaller. Crypto markets, even the largest, are thin compared to the dollar system; a single very large order visibly moves the price, and settling a nation's oil exports would require moving sums that the market simply cannot absorb quietly or cheaply. You cannot run a country's foreign trade through a market that a big trade disrupts. The dollar system clears trillions a day without flinching; the crypto system cannot clear a major state's sanctioned commerce without buckling.

And beneath the liquidity problem sits the dollar's network effect, which is the deeper reason it cannot be replaced by decree. The dollar is dominant not because a law says so but because everyone prices in it, holds it, accepts it, and expects everyone else to — a self-reinforcing equilibrium a century in the making. A sanctioned state that wants to escape the dollar has to find counterparties willing to be paid in something else, at scale, for the goods it needs, and most of the world still wants dollars. Crypto does not solve that; it just offers a different non-dollar option that suffers the same problem of not being the dollar. So the first wall is simply that the escape hatch is the size of a window and the thing that needs to get through it is the size of an economy. Some value fits through. The economy does not.

3. The Second Wall: The Ledger Sees

The second wall is the register's founding paradox, now turned against a state, and it is the reason crypto is a peculiarly bad tool for the specific thing a sanctioned state most needs: to move value invisibly. Sanctions evasion is, above all, an exercise in not being seen — the whole point is to move the value the blockade forbids without the blockader noticing and intervening. And crypto, for most of its forms, is the opposite of invisible.

The public ledger records the state's crypto moves as permanently and legibly as it records a ransomware crew's, and the sanctions machine has learned to read it. Chainalysis documents OFAC's practice of publishing cryptocurrency addresses alongside its Specially Designated Nationals, and of analyzing pre- and post-designation exposure — the flows to and from a wallet before and after it is listed. Translate that into the state's problem: when a sanctioned actor moves value on-chain, it leaves a trail that analytics firms and OFAC can map, and every address it touches becomes a candidate for the SDN list. The transparent ledger that let investigators trace the Colonial ransom and expose the terror donors also lets them trace a state's evasion flows and blacklist the wallets carrying them. Crypto's traceability, celebrated throughout this register as a forensic gift, is a liability for a blockade-runner who needs to move unseen.

There is a partial answer, and the register names it honestly: the sanctioned state can reach for the tools of Cases 05 and 16 — mixers and privacy coins — to obscure the flows. But those tools carry their own frictions at national scale. Privacy coins are far too shallow and illiquid to move a state's trade (the first wall again), and mixing a national economy's worth of value is both impractical and conspicuous. So the transparency wall is not absolute, but it is high: the ordinary crypto rails a state would use for scale are transparent, the private rails that would hide the flows cannot handle the scale, and the state is caught between a visible tool and a tiny one. Either way, the evasion is far more exposed than the fear narrative assumes.

4. The Third Wall: The Switch and the List

The third wall is the sanctions machine itself, which does not sit still while the state moves on-chain, and it has two edges: the stablecoin kill switch and the designation list. Together they mean that the state's most useful crypto instruments are also its most vulnerable.

Recall Case 04. The dollar-pegged stablecoins that are the most attractive tool for evasion — because they offer dollar stability on crypto rails — are exactly the instruments that carry an issuer-controlled kill switch. A centralized stablecoin can freeze any address at the contract level, and it does so under exactly the sanctions authority a blockaded state is trying to evade. So the most convenient rail for the sanctioned state is a rail whose operator can, on a government listing, render the state's holdings inert. The state can hold value in a stablecoin to escape the dollar's gatekeepers, only to discover that the stablecoin has gatekeepers of its own, wielding the same power. The escape into the stablecoin is an escape into a cage with a lock the same authority controls.

And behind the switch stands the list. OFAC does not merely designate the state; it designates the exchanges, the facilitators, and increasingly the specific wallet addresses the state's evasion relies on. The Russia-connected exchange Garantex from Case 12 is the archetype — a node operating at the seam between organized crime and state-adjacent sanctions evasion, designated by OFAC and cut from the compliant system. Every cash-out point, every facilitator, every service the state uses to convert its crypto into something spendable is a node that can be added to the SDN list, and the DeFi assessment states the governing principle that makes this stick: sanctions-compliance obligations are the same whether a transaction is in virtual assets or fiat, because the sanctions attach to the actor and the conduct, not the currency. Switching from dollars to crypto does not switch off the sanctions; it just changes which nodes have to be listed. And the sanctions machine lists them, one after another, faster than the state can build new ones — which is why the disposition is FROZEN and not ESCAPED: the value keeps reaching an edge, and the edge keeps being blocked.

5. A Supplement, Not a Substitute

Put the three walls together and the honest assessment comes into focus, and it is a corrective to the fear at both ends. Crypto is neither the master key that lets rogue states escape sanctions wholesale, as the alarmists claim, nor a non-factor that can be ignored, as the dismissive would have it. It is a real but marginal supplement — a way for a sanctioned state to move some value at the edges of the blockade, bounded hard by scale, transparency, and the sanctions machine's reach into the crypto rails themselves.

The evidence supports this bounded reading, not the extreme one. If crypto were the master key, sanctions on Russia and Iran would have simply stopped working after those states adopted it — and they did not; the blockade continued to bite, the states continued to strain against it, and the Treasury continued to find new nodes to designate rather than announcing that evasion had defeated the regime. What the record shows instead is a cat-and-mouse at the margin: the state finds a crypto rail, moves some value, and OFAC designates the rail; the state finds another, and it is designated too; the state holds value in a stablecoin, and the freeze looms; the state moves on-chain, and the flows are traced. This is not the picture of an escape. It is the picture of a supplement being repeatedly clipped — useful to the state at the edges, worth the effort for the value it does move, and nowhere near sufficient to carry the weight of a blockaded national economy.

This is the register's structural finding about Case 19, and it matters for policy as much as for accuracy. The correct posture toward crypto sanctions evasion is neither panic nor complacency but exactly what the Treasury's actions embody: treat the crypto rails as one more front of the sanctions war, extend the designation and screening machinery into them, lean on the stablecoin issuers' freeze capability, and keep the on/off ramps under pressure — while recognizing that the fundamentals (the dollar's depth and network effects) do most of the work of keeping crypto marginal. The state's crypto escape is real enough to fight and small enough to be losing. The disposition FROZEN captures exactly that: value that keeps trying to slip the blockade and keeps being stopped at the edge, because the medium it is slipping into is too small, too visible, and too reachable to carry it free.

6. The counter-narrative, steelmanned

The strongest objections come from both directions, and both deserve a fair hearing.

From the alarmist side: the register is dangerously complacent, and 'a marginal supplement' understates a growing and adaptive threat. Sanctioned states, the argument goes, are getting better at this — building non-dollar settlement systems, using stablecoins issued outside US reach, moving toward privacy coins and mixers, and coordinating with each other (Russia-DPRK-Iran) to pool evasion capabilities; treating today's limits as permanent ignores that the state has time, resources, and motivation the criminal cases lack, and that even 'marginal' evasion of hundreds of millions funds militaries and weapons programs. From the dismissive side: the register overstates the whole phenomenon, and crypto sanctions evasion is a rounding error next to the real ways states dodge sanctions — trade misinvoicing, shadow-fleet oil tankers, friendly banks in non-cooperating jurisdictions, barter — so building a whole case around crypto inflates a sideshow.

The register grants what is true in each and holds the bounded center. Yes, the threat is adaptive, and the register says so — it names the coordination among sanctioned states, the reach for privacy coins, and the search for stablecoins outside US reach, and it explicitly frames the response as an ongoing cat-and-mouse, not a solved problem; 'marginal' means bounded, not static or harmless, and even bounded evasion that funds a weapons program is worth fighting, which is exactly why the disposition is FROZEN (actively blocked) rather than dismissed. And yes, crypto is smaller than the shadow fleet and the friendly banks — that is the register's own point against the alarmists, that crypto is one front among several and not the master key; naming it accurately as a real-but-marginal rail is not inflating a sideshow, it is sizing it correctly, which is the whole discipline. What the register will not concede is either extreme: not that crypto is the key that breaks the blockade, which the scale and transparency walls refute, nor that it is nothing, which the documented use and the wave of designations refute. The honest finding is the bounded one — a real, adaptive, but structurally limited rail, fought at the margin and losing on the fundamentals — and holding that line is worth more than either the panic that says the sanctions are broken or the shrug that says nothing new is happening.

7. Disposition — FROZEN

Case 19 followed the money of states rather than criminals — nations cut off from the dollar and reaching for crypto to route around the blockade. The reach is real: a sanctioned state can move value on rails with no correspondent banks in the middle, hold it in dollar-pegged stablecoins, and settle some trade outside the reach of US clearing. The fear that this hands rogue states a master key is not baseless; the capability exists. But the capability is walled on every side, and the walls are what earn the disposition.

The disposition — the money's fate — is FROZEN. Not escaped, but stopped and frozen at the edges of a system too small and too visible to break the blockade. The market is orders of magnitude too shallow to carry a national economy's sanctioned trade; the transparent ledger exposes the flows to the same analytics and designation machine that trace criminals; the stablecoins most useful for evasion carry an issuer kill switch wielded under the very sanctions authority being evaded; and every exchange, facilitator, and wallet the state relies on can be added to the SDN list and cut from the compliant world. The value keeps reaching an edge, and the edge keeps being blocked — a leaky supplement clipped again and again, not a rail that carries the state free.

Hold the register's corrective, because it cuts against a fear worth correcting. Crypto did not break the sanctions regime, and it did not make rogue states ungovernable; it gave them a narrow, marginal rail that the sanctions machine has extended itself to reach, and the fundamentals — the dollar's depth, the ledger's transparency, the stablecoin's switch — keep the escape small. The honeypot beneath these words watches attackers probe a network for a way through; this case watches a nation probe the financial system for a way around a blockade, and find crypto a window too small for an economy to climb through. The vectors do not lie: the state moved value on-chain, the ledger recorded it, and OFAC listed the nodes one by one. Judge the sanctioned state that reached for the escape. Then hold the bounded truth the register insists on — that the escape is real and narrow, fought at the margin and losing on the fundamentals, and that the money the state tried to slip past the blockade keeps being frozen at the edge of a system too small and too visible to set it free.

Follow the Money continues. Case 19 disposition: FROZEN. Confidence: HIGH on the framework and the record — state sanctions-evasion actors (Russia, Iran, DPRK) and the wave of US evasion designations are documented in the US Treasury 2024 proliferation-financing and money-laundering assessments and the OFAC SDN record (including Russia/Iran oil and financial networks); the principle that sanctions-compliance obligations are the same for virtual assets and fiat is from the DeFi risk assessment; OFAC's publication of sanctioned crypto addresses and pre/post-designation screening is from Chainalysis; the Garantex designation ties to Case 12 and the stablecoin freeze to Case 04. The scale, liquidity, and dollar-network-effect limits, and the 'marginal supplement not substitute' thesis, are argued as analysis grounded in market structure; specific trade and market figures are characterized as orders of magnitude rather than pinned. The threat's adaptiveness (privacy coins, coordination, non-US stablecoins) is acknowledged; the response is framed as ongoing. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the sanctioned state, the escape, and the walls that keep it frozen at the edge.