Blockchain & Ballistics

The Crypto Trade Connecting the Houthis, Iran, and Russia

📅 July 25, 2025

The Houthis, Iran’s most active remaining proxy, have entered a new frontier of warfare: using cryptocurrency to purchase advanced weapons systems. Not only are terrorist financing and digital asset adoption converging, but terrorist organizations are increasingly collaborating with jurisdictional partners to circumvent the global financial system and acquire advanced weaponry.

Iranian Oil and Houthi Profits

The Houthis have raised potentially billions of dollars as a direct participant in Iran’s oil smuggling schemes and shadow banking operations. The mastermind behind the Houthis’ financial and commercial networks, Sa’id al-Jamal, is embedded within the Iranian Revolutionary Guards Corps (IRGC) and has cultivated his own global networks to facilitate the illicit sale of Iranian oil, with comparable typologies to those of the IRGC. Shipping services, port managers, front companies for oil trading, import-export and logistics companies, and other businesses, are directly controlled by the Houthis and support all aspects of the supply chain.

Similar to Iran’s shadow banking schemes, al-Jamal has co-opted existing exchange houses or established his own – in Yemen and elsewhere – to store and launder the majority of proceeds of oil smuggling operations. The exchange houses allow the Houthis to both funnel the proceeds of the illicit oil trade back to Yemen and access funds abroad. Like other terrorist organizations, the Houthis also use digital assets to launder their illicitly sourced revenue and at times as a means of conversion to local fiat currency. However, the Houthis’ pivot towards digital assets as a form of settlement is emblematic of remarkable shifts in the geopolitical environment and fissures in the global financial architecture.

What is the Axis of Resistance?

The Axis of Resistance is a loose network of terrorist organizations supported by Iran, including the Houthis, Hamas, Lebanese Hezbollah, Palestinian Islamic Jihad, various militias in Iraq, and formerly the Assad regime in Syria. Although not all groups are uniform politically and ideologically, they have collaborated substantially in facilitating cross-border financial flows to each other, aided by Iranian expertise. The Houthis are arguably Iran’s strongest remaining partner in the Axis of Resistance.

The Virtual Terrorist Financing Threat

The incorporation of digital assets into the toolkit of terrorist organizations, both within and outside the Axis of Resistance, is not a novel development. Hamas, Hezbollah, the Islamic State Khorasan Province, and others solicit donations from sympathizers in the form of cryptocurrencies, broadcasting their donation drives on encrypted messaging platforms such as Telegram. In addition to fundraising, some groups, including the Houthis, have begun mining decentralized digital assets without the need for specialized hardware infrastructure.

Terrorist organizations are beginning to prefer stablecoins such as Tether over more volatile assets such as Bitcoin. Hamas, Palestinian Islamic Jihad, and Hezbollah have sent funds between each other using the same virtual asset service providers (VASPs) in an effort to cooperate and convert stablecoins to fiat currencies.

Terrorist groups often exploit underground exchanges without adequate KYC measures to host their wallets.

Hamas has used Buy Now, a Gaza-based exchange, to service its Bitcoin-denominated fundraising gains.

Garantex, the notorious Russia-based exchange, hosted wallets controlled by Hamas, Hezbollah, and the Houthis. It has likely rebranded as the Kyrgyzstan-registered Grinex exchange.

Nobitex, Iran’s largest VASP, although mainstream and licensed by the regime, has been favored by the IRGC and its Axis partners.

The Houthis’ digital asset operations flow between counterparties on unlicensed exchanges, with similar typologies to traditional finance money laundering.

Virtual Currency, Real Weapons

On April 2, 2025, the U.S. Treasury Department sanctioned eight wallets associated with the Houthis. An analysis of the wallets conducted by blockchain analysis firm TRM Labs linked Houthi-controlled wallet addresses to a “Russian broker selling unmanned aerial vehicles (UAVs) and anti-UAV equipment” on the Garantex exchange. No longer are digital assets solely adopted by terrorist groups as vehicles for money laundering. Now, they are being used as a medium of exchange in weapons dealings.

OFAC’s discovery and TRM’s analysis of Houthi wallets point to a concerning development and potentially dangerous trend. The Houthis are not working in a vacuum, and Iran’s diffusion of expertise extends beyond oil smuggling and shadow banking. The international partners of the Houthis – Iran and Russia – are cooperating to reshape global financial infrastructure, and entities domiciled in both jurisdictions are facilitating the provision of UAVs and other weaponry to the Houthis.

The Accelerating Use of Crypto by Sanctioned States

The rate at which comprehensively sanctioned states have begun to use digital assets as a transaction medium has accelerated in recent years. The Iranian regime and especially the IRGC, the Houthis’ main backer, has long sought to evade sanctions through cryptocurrencies. In 2024, Russia integrated digital assets into its cross-border payment systems to ease the bite of sanctions, and after being blocked from accessing Tether, has endeavored to create a new token as a workaround. The two nations have also previously explored the possibility of creating a common stablecoin to facilitate trade between them.

Adapting to a New Landscape

There are currently no indications that the Houthis will transition to mostly using crypto for weapons payments in the foreseeable future. However, as digital asset infrastructure proliferates globally and sanctioned jurisdictions work to find alternatives to the financial systems they have been cut off from, financial crime risk for VASPs and crypto-related businesses will continue to increase.

Despite the use of methods to obfuscate transactions and avoid detection, such as mixers and tumblers, and the use of unlicensed exchanges, both VASPs and traditional financial institutions can interdict the flow of illicit cryptocurrency. For example, the Houthis utilized mainstream exchanges to offramp crypto into fiat currency.

Traditional due diligence methods and screening tools can reveal common money laundering typologies, while blockchain analytics tools enable detection of suspicious transactions between wallets. Some well-established AML typologies have digital asset equivalents or apply equally in the crypto context, including:

Receiving or sending from wallets associated with illicit actors or that are subject to sanctions

Use of AI-generated personal identification documents to bypass KYC measures

Front companies opening wallets to store illegitimate ‘revenues’ held in virtual assets

Use of VASPs domiciled in jurisdictions with a weak or nonexistent regulatory environment

The Houthis’ evolving use of digital assets to procure advanced weaponry marks a dangerous escalation in terrorist financing tactics. As sanctioned states and terrorist groups exploit digital assets to bypass global controls, the convergence of crypto and illicit networks demands urgent, coordinated action. Financial institutions, including crypto businesses, must adapt swiftly to detect and disrupt these sophisticated schemes to safeguard the integrity of the global financial system.

Recommended Blogs

Real Estate, Real Risks

September 17, 2026

The FATF has identified the global real estate sector as an area requiring heightened attention due to its vulnerabilities to money laundering, terrorism financing, sanctions evasion and other illicit activity. This article explores why property transactions attract financial crime.

Crypto Layering

June 17, 2026

Public blockchains make transactions visible, but that doesn't mean illicit activity is easy to trace. In our latest article, we examine how criminals use crypto layering techniques to obscure fund flows and the practical controls financial institutions can deploy to strengthen their AML programs.

Data as a Critical Business and Compliance Asset

April 15, 2026

Data is an increasingly critical asset. It plays a key role in due diligence, identifying and responding against illicit finance, and identifying fraud, as well as for commercial decisions and business success. Explore global data protection and retention requirements in this article.

The Travel Rule Playbook

March 25, 2026

The Travel Rule was established by the FATF to help prevent bad actors from moving illicit funds undetected. The scope has expanded to include VASPs and digital assets transactions. Explore best practices for compliance and implementation strategies in this article.

Professional Crypto Laundering

March 18, 2026

The indictment of Venezuelan national Jorge Figueira in 2026 reveals a highly advanced professional laundering network using cash, crypto, OTC brokerages registered in the UK and U.S., and shell companies with accounts at regulated financial institutions. This article assesses the methodology used, red flags, and actions for financial institutions.