Blockchain & Ballistics

The Crypto Trade Connecting the Houthis, Iran, and Russia

📅 July 25, 2025

The Houthis, Iran’s most active remaining proxy, have entered a new frontier of warfare: using cryptocurrency to purchase advanced weapons systems. Not only are terrorist financing and digital asset adoption converging, but terrorist organizations are increasingly collaborating with jurisdictional partners to circumvent the global financial system and acquire advanced weaponry.

Iranian Oil and Houthi Profits

The Houthis have raised potentially billions of dollars as a direct participant in Iran’s oil smuggling schemes and shadow banking operations. The mastermind behind the Houthis’ financial and commercial networks, Sa’id al-Jamal, is embedded within the Iranian Revolutionary Guards Corps (IRGC) and has cultivated his own global networks to facilitate the illicit sale of Iranian oil, with comparable typologies to those of the IRGC. Shipping services, port managers, front companies for oil trading, import-export and logistics companies, and other businesses, are directly controlled by the Houthis and support all aspects of the supply chain.

Similar to Iran’s shadow banking schemes, al-Jamal has co-opted existing exchange houses or established his own – in Yemen and elsewhere – to store and launder the majority of proceeds of oil smuggling operations. The exchange houses allow the Houthis to both funnel the proceeds of the illicit oil trade back to Yemen and access funds abroad. Like other terrorist organizations, the Houthis also use digital assets to launder their illicitly sourced revenue and at times as a means of conversion to local fiat currency. However, the Houthis’ pivot towards digital assets as a form of settlement is emblematic of remarkable shifts in the geopolitical environment and fissures in the global financial architecture.

What is the Axis of Resistance?

The Axis of Resistance is a loose network of terrorist organizations supported by Iran, including the Houthis, Hamas, Lebanese Hezbollah, Palestinian Islamic Jihad, various militias in Iraq, and formerly the Assad regime in Syria. Although not all groups are uniform politically and ideologically, they have collaborated substantially in facilitating cross-border financial flows to each other, aided by Iranian expertise. The Houthis are arguably Iran’s strongest remaining partner in the Axis of Resistance.

The Virtual Terrorist Financing Threat

The incorporation of digital assets into the toolkit of terrorist organizations, both within and outside the Axis of Resistance, is not a novel development. Hamas, Hezbollah, the Islamic State Khorasan Province, and others solicit donations from sympathizers in the form of cryptocurrencies, broadcasting their donation drives on encrypted messaging platforms such as Telegram. In addition to fundraising, some groups, including the Houthis, have begun mining decentralized digital assets without the need for specialized hardware infrastructure.

Terrorist organizations are beginning to prefer stablecoins such as Tether over more volatile assets such as Bitcoin. Hamas, Palestinian Islamic Jihad, and Hezbollah have sent funds between each other using the same virtual asset service providers (VASPs) in an effort to cooperate and convert stablecoins to fiat currencies.

Terrorist groups often exploit underground exchanges without adequate KYC measures to host their wallets.

Hamas has used Buy Now, a Gaza-based exchange, to service its Bitcoin-denominated fundraising gains.

Garantex, the notorious Russia-based exchange, hosted wallets controlled by Hamas, Hezbollah, and the Houthis. It has likely rebranded as the Kyrgyzstan-registered Grinex exchange.

Nobitex, Iran’s largest VASP, although mainstream and licensed by the regime, has been favored by the IRGC and its Axis partners.

The Houthis’ digital asset operations flow between counterparties on unlicensed exchanges, with similar typologies to traditional finance money laundering.

Virtual Currency, Real Weapons

On April 2, 2025, the U.S. Treasury Department sanctioned eight wallets associated with the Houthis. An analysis of the wallets conducted by blockchain analysis firm TRM Labs linked Houthi-controlled wallet addresses to a “Russian broker selling unmanned aerial vehicles (UAVs) and anti-UAV equipment” on the Garantex exchange. No longer are digital assets solely adopted by terrorist groups as vehicles for money laundering. Now, they are being used as a medium of exchange in weapons dealings.

OFAC’s discovery and TRM’s analysis of Houthi wallets point to a concerning development and potentially dangerous trend. The Houthis are not working in a vacuum, and Iran’s diffusion of expertise extends beyond oil smuggling and shadow banking. The international partners of the Houthis – Iran and Russia – are cooperating to reshape global financial infrastructure, and entities domiciled in both jurisdictions are facilitating the provision of UAVs and other weaponry to the Houthis.

The Accelerating Use of Crypto by Sanctioned States

The rate at which comprehensively sanctioned states have begun to use digital assets as a transaction medium has accelerated in recent years. The Iranian regime and especially the IRGC, the Houthis’ main backer, has long sought to evade sanctions through cryptocurrencies. In 2024, Russia integrated digital assets into its cross-border payment systems to ease the bite of sanctions, and after being blocked from accessing Tether, has endeavored to create a new token as a workaround. The two nations have also previously explored the possibility of creating a common stablecoin to facilitate trade between them.

Adapting to a New Landscape

There are currently no indications that the Houthis will transition to mostly using crypto for weapons payments in the foreseeable future. However, as digital asset infrastructure proliferates globally and sanctioned jurisdictions work to find alternatives to the financial systems they have been cut off from, financial crime risk for VASPs and crypto-related businesses will continue to increase.

Despite the use of methods to obfuscate transactions and avoid detection, such as mixers and tumblers, and the use of unlicensed exchanges, both VASPs and traditional financial institutions can interdict the flow of illicit cryptocurrency. For example, the Houthis utilized mainstream exchanges to offramp crypto into fiat currency.

Traditional due diligence methods and screening tools can reveal common money laundering typologies, while blockchain analytics tools enable detection of suspicious transactions between wallets. Some well-established AML typologies have digital asset equivalents or apply equally in the crypto context, including:

Receiving or sending from wallets associated with illicit actors or that are subject to sanctions

Use of AI-generated personal identification documents to bypass KYC measures

Front companies opening wallets to store illegitimate ‘revenues’ held in virtual assets

Use of VASPs domiciled in jurisdictions with a weak or nonexistent regulatory environment

The Houthis’ evolving use of digital assets to procure advanced weaponry marks a dangerous escalation in terrorist financing tactics. As sanctioned states and terrorist groups exploit digital assets to bypass global controls, the convergence of crypto and illicit networks demands urgent, coordinated action. Financial institutions, including crypto businesses, must adapt swiftly to detect and disrupt these sophisticated schemes to safeguard the integrity of the global financial system.

Recommended Blogs

Cartels & Crypto

July 17, 2025

Cartels and the professional money launderers that service them have integrated digital assets throughout the narcotics trade, from precursors to sales and laundering proceeds.

Canada’s Strong Borders Act

July 8, 2025

Canada’s Strong Borders Act represents a sweeping overhaul of the country’s AML/CFT regime. The legislation introduces tougher penalties, expanded oversight, and stricter compliance and enforcement expectations.

The Network, Not the Node

June 5, 2025

Data analytics and advanced technologies are critical tools to take effective action against increasingly complex criminal networks. In this article we consider the best practices a financial institution could apply when implementing data analytics strategies and solutions, and what the future holds.

Syndicates of Terror

April 4, 2025

Eight Latin American drug cartels were recently designated by the United States as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The U.S. designation enhances compliance risks for financial institutions and other companies transacting in Latin America.

Advancement in Digital Asset Markets

March 24, 2025

Review policies and regulation on crypto in the U.S., UK, EU, and globally, how this influences adoption, and measures to capitalize on rewards while managing illicit finance risks.

Lighting Up the Darknet

February 20, 2025

The validity of blockchain analytics technology was assessed in the Bitcoin Fog money laundering trial. What lessons does the Court’s reasoning have for Chief Compliance Officer using blockchain analytics and other decision support technologies?

Examining Evasion

February 10, 2025

Explore three recent examples with Russia, Iran, and North Korea, which represent some of the most common methods illicit actors have embraced to evade sanctions. Understanding them is an important starting point for private sector firms in assessing and responding to their exposure.

2024’s Top 10 Major Developments

January 17, 2025

Explore the highlights from our recent webinar including an overview of the current illicit finance landscape, major events in 2024 as well as noted possible future developments as the global illicit finance regime grows and evolves.

Syria Sanctions Relief

January 16, 2025

The U.S. Treasury has issued a Syria General License to provide gradual sanctions relief for the Syrian people after the regime of Bashar al-Assad was toppled in December 2024. What does this sanctions relief mean to financial institutions and other firms hoping to transact in the country?