North Korea operates differently. The Lazarus Group — a state-sponsored hacking team — doesn’t receive donations. It steals. According to a UN Panel of Experts report, North Korea stole over $3 billion in crypto between 2017 and 2024 to fund its ballistic missile and nuclear weapons programs. The 2022 Ronin Network hack alone netted $625 million in a single operation.
The clearest recent example happened on February 28, 2026, when US and Israeli forces struck Iran. Within minutes of the first airstrike, outflows from Nobitex — Iran’s largest crypto exchange — spiked 700% according to blockchain analytics firm Elliptic. (Source: Fortune). Iranian citizens were converting their rials into crypto and moving assets to overseas wallets before any capital controls could be imposed.
Ukraine provides another documented case. When Russia invaded in February 2022, the Ukrainian government launched a crypto donation campaign within 48 hours. They published wallet addresses for Bitcoin, Ethereum, and USDT. Within weeks, Ukraine had received over $100 million in crypto donations from individuals around the world — money that moved faster and with lower fees than any traditional wire transfer.
The 700% spike in Iranian crypto exchange outflows during the 2026 US strikes is one of the clearest real-time demonstrations of how crypto functions as an emergency financial exit for civilians in conflict zones.
The common assumption is that crypto is impossible to police. That’s not accurate. Public blockchains are permanent, transparent ledgers. Every transaction is visible to anyone with the right tools. The problem for regulators isn’t visibility — it’s the volume and the speed of connecting wallet addresses to real identities.
That problem is getting solved. Three companies Chainalysis, Elliptic, and TRM Labs are now the primary tools that governments, exchanges, and financial intelligence units use to track crypto flows. These platforms can trace transactions across multiple blockchains, identify clusters of wallets controlled by the same entity, and flag connections to known illicit addresses in real time.
The most significant enforcement action came in 2023, when the US Department of Justice arrested Roman Storm, a developer of Tornado Cash a crypto mixing service used to obscure transaction trails. The arrest sent a direct message: building tools that help people evade sanctions is itself a crime, even if the tool is open-source code.
The Tornado Cash arrest in 2023 marked a turning point. For the first time, a developer was held criminally liable for building privacy tools used in sanctions evasion. It changed the calculation for anyone building infrastructure in this space.
Bitcoin transactions are pseudonymous, not anonymous. With enough blockchain forensics, a Bitcoin transaction can often be traced back to a real identity. Monero and Zcash are different. They were built specifically to make transactions untraceable.
Monero uses ring signatures, stealth addresses, and confidential transactions to hide the sender, receiver, and amount of every transaction. Zcash uses zero-knowledge proofs to achieve a similar result. These are not flaws in the system they’re the intended design.
In 2025, as geopolitical tensions escalated, both coins saw dramatic price increases. Monero rose over 56% while Zcash surged more than 500% from its lows. (Source: CryptoPotato). The demand wasn’t coming from retail speculators. It was coming from users who needed genuine financial privacy during a period of heightened surveillance and sanctions pressure.
Several major exchanges — including Kraken in the US and Bittrex have already delisted Monero in response to regulatory pressure. Japan and South Korea banned privacy coins entirely. The Financial Action Task Force (FATF) has flagged them as high-risk assets that undermine anti-money laundering efforts.
The tension here is real. Privacy coins serve legitimate users journalists, dissidents, citizens in authoritarian countries — alongside illicit actors. That dual-use nature makes them one of the most contested categories in crypto regulation.
Zcash’s shielded pool grew to nearly 4 million ZEC in 2025 as Google searches for crypto privacy surged. The Ethereum Foundation formed a new privacy research team in the same year, signaling that privacy is becoming a mainstream concern across the entire ecosystem. (Source: a16z Crypto State of Crypto 2025)
The research from Phemex’s geopolitical risk framework (Source) and Crypto.com’s conflict analysis both point to the same sequence: initial sharp drop, followed by recovery that often exceeds pre-conflict levels within weeks. The February 2026 US-Iran strikes dropped Bitcoin from $72,000 to $63,000 in hours. Two weeks later, Bitcoin was trading at $71,000 — above where it started.
Three things drive this pattern. First, crypto markets run 24/7, so they absorb the initial shock while stock markets are closed. By the time equities open Monday morning, the panic selling in crypto has already happened. Second, institutional investors now hold Bitcoin inside the same risk models as tech stocks — when they cut risk exposure across the board, Bitcoin gets sold alongside Nasdaq positions. Third, and most importantly, the fundamental reasons to hold crypto don’t disappear during a conflict. They often strengthen.
The single variable that matters most is oil. If a conflict disrupts oil supply and pushes prices above $100 per barrel, inflation follows. Higher inflation forces the Fed to keep rates elevated. Elevated rates drain liquidity from risk assets including crypto. That chain — conflict to oil to inflation to rates to crypto price — is the mechanism you need to watch, not the headline count.
Traders who watched oil prices during the US-Iran conflict outperformed traders who watched news headlines, according to Wintermute’s head of OTC.
The oil price is the transmission mechanism between geopolitical conflict and crypto markets.
Crypto didn’t choose to become a weapon in financial warfare. It became one because its properties — borderless, censorship-resistant, available 24/7 — are exactly what every actor in a financial conflict needs, whether that actor is a
sanctioned government, a terror group, a citizen escaping a collapsing currency, or an institutional investor cutting risk exposure on a Saturday morning.
The blockchain doesn’t care why you’re using it. But the governments, analytics firms, and regulators increasingly do. The window of genuinely unmonitored crypto activity is closing. What’s replacing it is a more mature, more surveilled,
and more consequential financial layer — one where the stakes are no longer just portfolio returns, but geopolitical outcomes.
