The year 2025 stands out as a pivotal moment in the enforcement of sanctions within the cryptocurrency sector, according to insights from blockchain analytics firm Elliptic. This period witnessed unprecedented actions by authorities, underscoring the growing intersection of digital assets with global security concerns.
From massive thefts funding rogue state programs to sweeping seizures targeting criminal networks, the landscape highlighted the urgent need for robust compliance measures in the crypto industry.
One of the most alarming developments involved North Korean state-sponsored hackers.
In early 2025, the notorious Lazarus Group pulled off what became the biggest crypto heist on record, siphoning off approximately $1.5 billion worth of Ether from the prominent exchange Bybit.
This single incident dwarfed the group’s total takings from the previous year, which amounted to $1.34 billion.
Over the past decade, starting from 2017, these cyber operatives have amassed more than $6 billion through similar exploits.
Intelligence reports indicate that these illicit funds are funneled directly into North Korea’s advanced weaponry initiatives, including nuclear capabilities and long-range missiles.
Following the Bybit breach, the hackers employed sophisticated laundering tactics, channeling about 85% of the stolen assets—roughly $1.2 billion—through decentralized platforms like THORChain.
By swapping tokens across various wallets and blockchains, they evaded asset freezes and complicated tracking efforts.
Shifting focus to transnational crime, October 2025 marked a historic milestone when U.S. officials dismantled operations linked to the Prince Group, a sprawling criminal syndicate.
This operation resulted in the confiscation of $15 billion in Bitcoin, the largest such recovery ever, alongside the blacklisting of 146 associated people and organizations under sanctions.
Elliptic’s independent investigations went further, uncovering an extra $560 million in wallet addresses potentially under Prince Group control that escaped official designation by the Office of Foreign Assets Control (OFAC).
This revelation emphasizes the limitations of relying solely on government lists for risk assessment, as hidden networks can still pose significant threats.
Meanwhile, entities tied to Russia demonstrated remarkable adaptability in circumventing international penalties.
After joint U.S. and European forces shut down the sanctioned Garantex exchange in March 2025, evasion activities migrated to alternative platforms and digital tools.
A notable emergence was the ruble-pegged stablecoin A7A5, which rapidly scaled to handle up to $1 billion in daily trades at its height.
Elliptic’s tracking exposed how such mechanisms perpetuate evasion, making it increasingly difficult for regulators to dismantle these resilient infrastructures.
Elliptic outlines a five-step strategy to bolster sanctions adherence in cryptocurrency operations.
First, implement thorough blockchain surveillance, including checks before and after transactions across diverse assets and protocols like DeFi and cross-chain bridges.
Second, evaluate geographic risks, particularly from regions near sanctioned nations such as Russia, Iran, and North Korea, with tailored risk protocols.
Third, recognize warning signs like mixers, privacy-focused coins, and decentralized swaps, drawing from regulatory advisories and proprietary studies.
Fourth, establish clear investigative protocols, complete with staff education and forensic tools to trace suspicious flows. Finally, integrate a holistic risk management system encompassing assessments, training, and policy enforcement across the organization.
These incidents from 2025 serve as a stark reminder of cryptocurrency’s dual-edged nature—offering innovation while attracting exploitation. As Elliptic stresses, proactive compliance isn’t just regulatory; it’s essential for safeguarding the ecosystem against geopolitical risks.