When Western nations impose economic sanctions, they expect isolated targets to struggle. Instead, something counterintuitive happens: the most heavily sanctioned nations develop the most sophisticated sanctions evasion networksOrganized systems of companies and intermediaries designed to circumvent economic sanctions through coordinated trade, financial, and logistics operations.[s]. In 2025, this paradox reached its clearest expression yet, with illicit cryptocurrency addresses receiving a record $154 billion—over $100 billion of which flowed to sanctioned entities[s].
The Scale of the Problem
The numbers are stark. According to blockchain analyticsThe examination of blockchain transactions and wallet patterns to identify suspicious activity, fund flows, and potential market manipulation. firm Chainalysis, the value received by sanctioned entities surged 694% in 2025[s]. This was not random crime but coordinated state policy. Russia, Iran, and North Korea each built industrial-scale bypass systems that now rival legitimate financial infrastructure in their complexity.
Russia’s A7A5 stablecoin processed $93.3 billion in less than a year, acting as a critical bridge for Russian businesses to access global markets despite sanctions[s]. Iran’s ghost fleet grew from 70 vessels in 2020 to 573 by late 2025[s]. North Korea stole more than $2 billion in cryptocurrency in 2025 alone[s].
Why Sanctions Create Better Evaders
The paradox emerges from basic incentives. When sanctions threaten economic survival, targeted states invest heavily in circumvention. These sanctions evasion networks are not random creations but directed by state security services and military-industrial complexes[s].
More pressure means more resources dedicated to finding workarounds. The A7A5 stablecoin, for example, was designed as a “high-speed, high-volume bypass designed to reconnect the Russian economy with global liquidity by shielding illicit capital from the reach of Western regulators”[s].
The Whack-a-Mole Effect
Enforcement faces a structural disadvantage. When Western authorities shuttered the Russian cryptocurrency exchange Garantex in March 2025, users migrated to its replacement, Grinex, within days[s]. The transition of users from Garantex to Grinex “serves as a warning that for every node the West disables, the Kremlin is ready to launch another”[s].
Iran employs similar tactics at sea. The most common method is “flag hoppingThe repeated switching of a ship's registration between different national registries to evade sanctions or regulation, often with new shell companies and vessel name changes.,” repeatedly switching a ship’s registration between countries while forming new shell companiesLegal entities without real business operations, used to obscure ownership and facilitate transactions. and changing vessel names[s]. The U.S. Treasury sanctioned more than 180 vessels responsible for shipping Iranian petroleum products since early 2025[s], yet the ghost fleet keeps growing.
China as the Central Hub
These sanctions evasion networks require a hub, and China fills that role. According to the U.S.-China Economic and Security Review Commission, China is “a flagrant and decisive enabler of sanctions evasion” for the so-called axis of autocracy[s].
A shadow fleetOlder, uninsured tankers used to evade international sanctions by operating outside official shipping registries and insurance markets. of tankers shipping sanctioned oil from Iran and Russia has found safe harbor in China, where independent refineries accept discounted energy with falsified customs data[s]. China is also the largest supplier of dual-useGoods, technologies, or knowledge with both legitimate civilian applications and potential military uses, typically subject to export controls and international oversight. technology items that have enabled Russia to sustain its military operations in Ukraine[s].
Learning From Each Other
Perhaps most concerning, sanctioned nations are sharing tactics. Russia adopted Iran’s shadow fleet methods. North Korea’s cryptocurrency laundering techniques have spread. The USCC report notes that “shared tactics, like Russia’s adoption of Iran’s shadow fleet, also demonstrates that the axis countries are learning from each other in enhancing their evasion toolkits”[s].
What This Means
The paradox does not mean sanctions are useless. Academic research suggests sanctions still impose real costs on targets, even when circumvention appears successful[s]. Russia must pay premium prices for rerouted goods. Iran’s oil sells at steep discounts. North Korea’s cyber operations require constant innovation.
But the current approach of targeting individual entities resembles playing whack-a-mole against opponents who have professionalized the game. As the Royal United Services Institute concluded, sanctions evasion networks “operate as global enterprises, and sanctions-imposing countries must do the same to render them ineffective”[s].
The over $100 billion that flowed through sanctions evasion networks in 2025 represents a challenge that cannot be solved by adding more names to blacklists. It requires rethinking how economic pressure is applied in an interconnected world where the most isolated actors have become the most creative at building connections.
Economic sanctions rest on a theory of coercion: restrict access to global financial systems and trade networks, and target states will modify their behavior. What 2025 demonstrated is a counterintuitive outcome that sanctions scholars have long debated[s]. The most heavily sanctioned nations have developed the most sophisticated sanctions evasion networksOrganized systems of companies and intermediaries designed to circumvent economic sanctions through coordinated trade, financial, and logistics operations., with illicit addresses receiving $154 billion total, as sanctioned entities alone saw a 694% surge to over $100 billion[s].
Sanctions Evasion Networks as State Infrastructure
These are not criminal enterprises operating at the margins. Russia’s A7A5 stablecoin, launched in early 2025, represents state-directed financial innovation. The Center for European Policy Analysis describes it as “a high-speed, high-volume bypass designed to reconnect the Russian economy with global liquidity by shielding illicit capital from the reach of Western regulators”[s].
The architecture is deliberately multi-jurisdictional. A7A5 is issued under Kyrgyzstan’s regulatory framework, backed by ruble deposits at Promsvyazbank (a sanctioned Russian state bank), and traded through Grinex (a Kyrgyz exchange) with liquidity access via a Paraguayan exchange[s]. The result: $93.3 billion processed in under a year[s].
The Royal United Services Institute’s analysis confirms the organizational sophistication: “These thousands of companies are often not random or spontaneous creations, but directed by the Russian military-industrial base. They consist of networks of individuals and companies directing this support and supply business, along with intermediary companies and the shipping and logistics firms that facilitate the circumvention trade.”[s]
The Iranian Shadow FleetOlder, uninsured tankers used to evade international sanctions by operating outside official shipping registries and insurance markets. Model
Iran pioneered the maritime dimension of sanctions evasion networks. According to United Against Nuclear Iran, the ghost armada grew from 70 vessels in November 2020 to 573 by late 2025[s]. These ships operate through systematic deception.
The core tactic is “flag hoppingThe repeated switching of a ship's registration between different national registries to evade sanctions or regulation, often with new shell companies and vessel name changes.,” which UANI describes as “the repeated switching of a ship’s ‘flag’ to different national registries. Often accompanied by the formation of new shell and front companies, ownership and name changes, and even alterations to ships’ physical markings.”[s] Vessels move between flags of convenienceShip registration systems offered by countries with minimal regulatory oversight, allowing vessel owners to easily change registration and avoid strict maritime laws., exploiting registries that lack compliance infrastructure. The December 2025 Treasury action targeted 29 shadow fleet vessels and their management firms, bringing the total sanctioned since early 2025 to over 180[s].
Yet enforcement faces diminishing returns. As the fleet expands and tactics evolve, each new sanction triggers adaptation rather than compliance.
North Korea’s Cyber-Financial Apparatus
The Lazarus Group represents the most technically sophisticated component of global sanctions evasion networks. Between 2021 and 2025, this North Korean state-sponsored unit stole over $5 billion in cryptocurrency[s]. In 2025 alone, DPRK actors stole more than $2 billion, making it their most successful year[s].
The February 2025 Bybit hack exemplifies their capabilities. The Lazarus Group infiltrated the exchange’s multi-signature walletA cryptocurrency wallet requiring multiple private keys to authorize transactions, providing enhanced security against theft or unauthorized access. solution, extracting $1.5 billion in Ethereum[s]. The group has “perfected an industrialized laundering pipeline” operating on a 45-day cycle following each major theft[s].
These funds directly finance weapons programs. Unlike Russia or Iran, which seek to maintain economic activity, North Korea’s cyber operations are primarily extraction-focused, treating global cryptocurrency markets as a source of hard currency for the Kim regime’s WMD development[s].
China as Structural Enabler
The U.S.-China Economic and Security Review Commission’s November 2025 report is unambiguous: China is “a flagrant and decisive enabler of sanctions evasion” for the axis of autocracy[s].
China provides three critical functions. First, a market for sanctioned commodities: “A ‘shadow fleet’ of tankers shipping sanctioned oil from Iran and Russia has found safe harbor in China, where a cluster of independent refineries accepts discounted energy resources, the origin of which China knowingly misreports in customs data.”[s]
Second, dual-useGoods, technologies, or knowledge with both legitimate civilian applications and potential military uses, typically subject to export controls and international oversight. technology supply. China is “the largest supplier of dual-use technology items that have enabled Russia to build and sustain its military operations in Ukraine”[s].
Third, financial infrastructure. Hong Kong serves as a node connecting shadow banking systems to global finance, while smaller mainland banks process transactions outside Western oversight[s].
Network Effects and Knowledge Transfer
The USCC report identifies a compounding dynamic: “The sum of China’s sanctions evasion activities is greater than the parts. In acting as a hub for a range of sanctions evasion activities, China is achieving economies of scale for firms that facilitate evasion. Shared tactics, like Russia’s adoption of Iran’s shadow fleet, also demonstrates that the axis countries are learning from each other in enhancing their evasion toolkits.”[s]
This learning effect accelerates capability development. When Western authorities shut down Garantex in March 2025, Grinex was operational within days, inheriting user wallets and A7A5 token liquidity[s]. The infrastructure had been prepared in advance.
The Enforcement Asymmetry
Academic analysis of sanctions effectiveness suggests that behavioral change remains rare, yet researchers note this metric may be too narrow[s]. Sanctions impose costs even when circumvented: Russia pays premiums for rerouted goods, Iran’s oil sells at discounts, and North Korea’s operations require constant technical innovation.
However, the current enforcement model faces structural limitations. As RUSI observes, “If third countries provide circumvention routes or substitutes for the goods and services that sanctions aim to curtail, then the sanctions will be weakened or fail.”[s] With “third countries” comprising a majority of the global economy, the coalition of non-participants creates permanent arbitrage opportunities.
The conclusion from RUSI is stark: sanctions evasion networks “operate as global enterprises, and sanctions-imposing countries must do the same to render them ineffective”[s]. The over $100 billion flowing through these systems in 2025 suggests current approaches remain far from that standard.
