A new report from blockchain analytics firm Elliptic warns that sanctioned individuals, entities and even nation-states are increasingly turning to stablecoins to bypass global financial restrictions.
Stablecoins are digital tokens linked to the value of major currencies. They’ve become widely used because they keep a steady price, move quickly, and work across borders. In 2024, people sent more than $27 trillion worth of stablecoins around the world. Big companies like PayPal, Stripe, and major banks now use them in their payment systems. At the same time, regulators in the EU, Hong Kong, and the US are creating rules to guide how stablecoins should be used.
According to Elliptic, stablecoins are becoming a preferred instrument for those who wants to bypass sanctions, as they offer the liquidity and dollar-denomination needed to transact in high-value goods, ranging from from commodities to dual-use technologies.
Elliptic found that sanctioned individuals increasingly rely on networks of OTC brokers and high-risk virtual asset service providers (VASPs) to convert fiat into stablecoins, move funds across borders and hide transaction origins. Red flags include sudden large stablecoin transfers from unregulated VASPs, exposure to wallets linked to sanctioned entities, and high-value trading with no believable business reason.
Stablecoins are also being used to pay for goods and services from jurisdictions under sanctions. Warning signs include unexplained high-volume stablecoin payments moving into accounts linked to risky industries like energy or defense, IP logins from sanctioned countries such as Russia or Iran, and the use of tools such as mixers or cross-chain bridges that hide where transactions come from.
Cybercrime groups, especially North Korea’s Lazarus Group, still use stablecoins in hacks and money-laundering. They move funds quickly across different blockchains, break transactions into many layers, and use decentralized swaps to avoid being tracked.
In June 2025, the US Department of Justice indicted Russian national Iurii Gugnin, accusing him of running a $500 million stablecoin-based sanctions evasion scheme. Prosecutors allege Gugnin accepted USDT payments from clients of sanctioned Russian banks, converted the funds into dollars via US-based VASPs and banks, and used the proceeds to purchase luxury goods and sensitive technologies.
Gugnin’s operation was closely intertwined with Garantex, a Russia-based crypto exchange first sanctioned in 2022 and then re-sanctioned in 2025 together with its successor Grinex. Despite restrictions, Garantex allegedly processed more than $60 billion in transactions, primarily USDT on TRON, by using obfuscation techniques. The exchange became a central hub for Russia-linked individuals and entities seeking to evade sanctions until its disruption in March 2025.
Following Garantex’s takedown, Elliptic observed activity migrating to successor platforms such as Grinex, where users gained access to A7A5, a ruble-pegged stablecoin. Issued on Ethereum and TRON by sanctioned entities in Russia and Kyrgyzstan, A7A5 has already facilitated billions of dollars in swaps with USDT across high-risk VASPs and decentralized exchanges.
“By issuing their own rubble-backed stablecoins, Russian entities hope to create a viable channel for financial transactions with trading partners that may prove robust against disruption, especially as sanctions increasingly target banks in third countries such as China that facilitate business with Russia,” Elliptic noted.
