The Shadow Crypto Economy Feeding Russia’s War Machine

A crowd calls for sanctions against Russia after the war was launched in Ukraine.

Swift exit: A crowd calls for sanctions against Russia after the war was launched in Ukraine. Image: Wirestock / Alamy


Crypto is embedded in Russia’s procurement model, allowing it an access to Common High Priority Items that international sanctions were intended to deny. Huge disruption is necessary to apply pressure to Russia's supply chains for critical military components.

Russia’s war in Ukraine has been accompanied by one of the most comprehensive sanctions regimes in modern history. Export controls and financial restrictions have had a measurable impact on Russia’s procurement environment, reshaping supply chains for critical military components – known as Common High Priority Items (CHPIs). Direct access to Western suppliers has been curtailed and trade flows have been diverted through intermediary jurisdictions across Eurasia and Asia.

However, while sanctions have increased costs and complexity, they have not halted procurement. Instead, they have driven adaptation. As traditional financial channels have come under heightened scrutiny, payment settlement has emerged as a key point of vulnerability. In response, Russia and its intermediaries have increasingly turned to cryptocurrency, particularly stablecoins, to settle cross-border transactions outside sanctions-compliant banking systems.

Crypto-enabled settlement is now embedded in Russia’s procurement model, linking diverted CHPI supply chains with alternative payment mechanisms designed to blunt the disruptive effects of sanctions. Exchanges, successor platforms, payment agents, rouble-backed tokens, stablecoins and over-the-counter (OTC) brokers form a layered ecosystem that allows cross-border purchasing power with reduced exposure to traditional compliance controls. While sanctions have degraded parts of this infrastructure, targeting has often focused on individual entities rather than the networked architecture that sustains them.

Addressing this challenge requires ecosystem-level disruption: enhanced intelligence collection on OTC brokers and other off-chain actors; structured public-private data sharing to improve attribution; network-based sanctions targeting successor entities and bridging assets; coordinated diplomatic pressure on permissive jurisdictions; and closer integration of trade and financial enforcement. Without such a shift, sanctions will continue to reshape Russian procurement routes without materially constraining the financial mechanisms that enable them.

Introduction

As the war in Ukraine has descended into a prolonged phase of attrition, the Russian Federation has been compelled to restructure its economy to sustain its military campaign. Following the full-scale invasion in February 2022, an international coalition imposed sweeping sanctions intended to isolate Russia from the global financial system and deprive its defence industrial base of critical technologies. The exclusion of major Russian banks from the SWIFT messaging system, the freezing of central bank assets and the imposition of strict export controls were designed to cripple the Kremlin’s capacity to finance and resource its war. As the conflict has evolved, however, so too have Russia’s mechanisms for survival and procurement.

quote
This pivot towards crypto reflects more than an effort to conceal wealth. It is a functional response to the collapse of conventional payment channels

Russia continues to feed its war machine and faces an urgent and persistent demand for battlefield items or CHPIs. These include microelectronics, navigation equipment and advanced machine tools essential for the production of missiles, drones and heavy artillery. While the initial sanctions shock disrupted established supply chains, Russia has since cultivated a complex and adaptive web of transshipment routes and evasion techniques. Traditional laundering methods involving shell companies and permissive jurisdictions remain widespread. Increasingly, however, cryptocurrency has evolved from a peripheral tool associated with cybercriminal activity into a systemic, state-tolerated and in some cases state-enabled payment rail for military procurement.

This pivot towards crypto reflects more than an effort to conceal wealth. It is a functional response to the collapse of conventional payment channels. With US dollar and euro settlement systems largely closed and with banks in nominally friendly jurisdictions increasingly sensitive to secondary sanctions, stablecoins have emerged as a critical medium of exchange. In particular, US dollar-pegged stablecoins such as Tether (USDT) and Over-the-Counter (OTC) brokers have become indispensable for cross-border settlement. At the same time, the development of bespoke, rouble-backed stablecoins such as A7A5 points to a deliberate effort to construct a parallel financial infrastructure insulated from Western oversight.

This paper provides a comprehensive analysis of the role of cryptocurrency in Russian wartime procurement. It examines the movement of CHPIs through global trade networks, the financial architectures that facilitate these purchases, including the Garantex–Grinex–A7A5 nexus and the methodologies required to expose them. The paper demonstrates crypto-enabled procurement is no longer a marginal phenomenon. It has become a central pillar of Russia’s sanctions evasion strategy.

Shifts in Trade Flows of High Priority Items to Russia

To understand the role of cryptocurrency in Russian procurement, it is first necessary to examine what goods are being acquired and how those goods continue to reach Russia despite extensive export controls. The US, UK, EU and international partners have collectively identified a list of CHPIs as components critical to Russian weapons systems and military production. These items underpin Russia’s ability to manufacture and sustain advanced military capabilities, including missiles, drones, armoured vehicles and communications systems.

The CHPI List comprises 50 Harmonised System (HS) codes grouped into four tiers, covering dual-use and advanced technology items whose export has been restricted due to their demonstrated use in Russian weapons systems. The list spans a wide range of inputs, from integrated circuits and discrete electronic components to optical equipment and Computer Numerical Control (CNC) machine tools. Despite these controls, trade data covering 2022 through the first half of 2025 shows Russia has continued to import CHPIs at scale, primarily via indirect trade routes and transshipment jurisdictions.

In the period following the introduction of sanctions – a response to the full-scale invasion of Ukraine in 2022 – Russia’s procurement networks adapted rapidly to the loss of direct access to Western suppliers. Heightened diplomatic engagement and growing exposure to secondary sanctions reshaped the trade environment. Against this backdrop, CHPI exports to Russia increased sharply via a limited set of intermediary jurisdictions. Trade flows became heavily concentrated through a small number of countries that experienced rapid growth in exports to Russia, notably several Eurasian and Asian economies whose export profiles shifted sharply towards CHPI categories over a short period, reflecting the swift reorientation of procurement away from direct suppliers and towards indirect routes.

By 2024, this pattern had begun to fragment. As scrutiny of prominent transshipment hubs intensified and compliance expectations hardened, export activity through several previously dominant intermediary jurisdictions declined, while a wider set of countries emerged as significant suppliers. Rather than a uniform contraction in supply, the data shows a redistribution of trade, with Russia increasingly sourcing CHPIs through a broader and more geographically diverse group of partners.

This shift becomes more pronounced when CHPI flows are examined by tier. Exports of Tier 1 items, including integrated circuits, are concentrated among a small number of jurisdictions, with Hong Kong and Mainland China accounting for the largest share in 2024. At the same time, Tier 1 exports from several intermediary countries that featured more prominently in earlier years declined, indicating greater sanctions sensitivity around the most advanced components. Notably, Thailand emerged more clearly in Tier 1 trade during this period, reinforcing its role as an increasingly important electronics sourcing and transshipment hub despite not being a traditional focal point of sanctions designations.

Lower-tier CHPIs display a different pattern. Exports of Tier 2 and Tier 3 items are distributed across a wider range of jurisdictions, suggesting procurement networks have adapted by shifting emphasis towards categories perceived as less exposed to enforcement or less likely to trigger escalation by sanctions authorities. In these tiers, no single intermediary dominates trade flows and Russia’s sourcing appears more diffuse and flexible. Countries such as India, Thailand and several Southeast Asian states feature prominently across these tiers, reflecting their growing integration into Russia-linked supply chains for communications, navigation and electronic components.

Across higher-end industrial inputs, particularly CNC machine tools, similar dynamics are visible. While some traditional suppliers reduced exports in response to increased diplomatic pressure and regulatory guidance, other jurisdictions expanded their role as alternative sources. Trade in CNC machine tools, which are essential for the manufacture of artillery shells, vehicle components and other heavy equipment, became increasingly diversified across Eurasian and Asian market suppliers during 2023 and 2024, with Kyrgyzstan, Thailand and Vietnam standing out as jurisdictions where export volumes rose sharply relative to earlier years, despite limited historical involvement in this category of trade with Russia.

Taken together, these developments illustrate a deliberate diversification of Russia’s CHPI procurement routes. Export flows have shifted away from a small number of heavily scrutinised intermediaries towards a broader range of jurisdictions, reducing reliance on any single transit country. While China remains the largest supplier by value across multiple tiers, the data shows Russia’s procurement networks have become increasingly globalised and adaptable in response to diplomatic pressure, sanctions enforcement and the growing risk of secondary sanctions.

As sanctions efforts have reshaped the physical routes used for CHPI procurement, they have also increased the difficulty of settling cross-border payments through conventional financial channels. Even where goods can still move, international banks have become more cautious in processing Russia-linked transactions in order to preserve access to US, EU and UK correspondent networks. The resulting delays, rejections and terminations have pushed Russian importers and intermediaries to seek alternative means of settlement that offer speed and sustainability with fewer compliance touchpoints. This shift has accelerated the use of cryptocurrencies and stablecoins in procurement-related transactions, providing an important link between the trade patterns described above and the financial mechanisms examined in the following sections.

The Illicit Appeal of Crypto for Sanctions Evasion

The use of crypto in sanctions evasion is often associated with capital flight and asset concealment, whether linked to oligarch wealth protection, ransomware laundering, or other illicit activities. That focus can obscure a more immediate national security risk: the use of stablecoins and crypto-enabled payment services to settle purchases of dual-use goods and CHPIs. In this sense, crypto is not only being used to move and hide money, but also to spend it on supply chains that sustain weapons production.

The shift towards cryptocurrency in Russian procurement is best understood as a functional response to sanctions pressure rather than an ideological or technological preference. Prior to the full-scale invasion in 2022, Russia had in fact sought to ban crypto entirely. However, crypto offers a set of characteristics that are particularly attractive in environments where access to conventional financial channels is constrained. Transactions can be conducted across borders without relying on correspondent banking relationships, settlement can occur rapidly and the linkage between on-chain activity and real-world actors is often difficult to establish without additional intelligence. Together, these features reduce friction at precisely the points where sanctions enforcement is intended to apply pressure.

Although blockchain transactions are recorded on a public ledger, transparency does not equate to accountability. Wallet addresses do not reveal beneficial ownership, commercial purpose, or the identity of counterparties. In practice, this creates space for layered payment structures and intermediary arrangements that obscure the origin of funds and the nature of the underlying transaction. Payments can therefore move quickly, while attribution and enforcement lag behind.

Enjoy our analysis and research? Ensure it shows up first on Google

Help your search results show more from RUSI. Adding RUSI as a preferred source on Google means our analysis appears more prominently.

These characteristics have clear relevance for sanctions evasion. As international banks have tightened controls to preserve access to US, EU and UK correspondent networks, sanctioned actors have increasingly sought payment methods that minimise exposure to screening, enhanced due diligence and relationship termination. Crypto, and stablecoins in particular, provide a means of moving value across borders with fewer institutional checkpoints, even where the underlying trade involves restricted or high-risk goods.

Stablecoins, particularly Tether, sit at the centre of this dynamic. Unlike volatile cryptocurrencies, stablecoins allow counterparties to transact in instruments pegged to the US dollar without engaging directly with the regulated banking system. Their widespread acceptance, price stability and ease of transfer make them especially suitable for cross-border settlement when traditional banking channels are inaccessible for sanctions evaders. As a result, they have become a preferred medium for transactions that would otherwise be delayed, rejected, or flagged by compliance controls.

In the Russian context, these features intersect directly with the procurement patterns described in the previous section. As CHPI supply chains have diversified geographically and shifted towards jurisdictions with varying enforcement standards, the ability to settle payments outside conventional banking channels has become increasingly important. Crypto does not replace trade intermediaries or logistics networks, but it reduces the financial friction associated with paying them, as it obscures the relationship between Russian importers and foreign counterparties, complicating monitoring and attribution.

This combination of factors has enabled crypto to move from the margins of sanctions evasion into a more operational role. What began as an ad hoc workaround has increasingly become embedded within procurement practices, particularly for dual-use goods and CHPIs. The following section examines how these dynamics translate into concrete payment arrangements and institutional structures that support Russia’s war economy.

Spending Money via Crypto for the War Machine

The growing operational role of crypto in Russian sanctions evasion becomes most visible at the point of payment. Beyond its use as a store of value or a tool for asset concealment, crypto has been integrated into the mechanics of procurement, enabling Russian importers to settle transactions for dual-use goods and CHPIs when conventional financial channels are delayed, disrupted, or unavailable.

Subscribe to the CFS Newsletter

Receive a monthly newsletter and emails about upcoming events hosted by the Centre for Finance and Security Research Group

Subscribe to the RUSI Newsletter

Get a weekly round-up of the latest commentary and research straight into your inbox.

This ecosystem extends from basic cash-for-crypto exchanges to more structured arrangements, including rouble-backed stablecoins such as A7A5 and platform-based settlement services that replicate core banking functions while remaining outside the reach of Western regulators. Collectively, these mechanisms form a parallel financial infrastructure designed to preserve Russia’s ability to pay for goods critical to its war effort despite sustained sanctions pressure.

Russian Crypto Exchanges: Under the Spotlight

Russian-based crypto exchanges and their successors sit at the heart of the country’s crypto-enabled procurement ecosystem. Long before the emergence of bespoke rouble-backed tokens or structured payment platforms, these exchanges provided the primary interface between domestic rouble liquidity and cross-border crypto settlement. Their continued operation, adaptation and reconstitution under sanctions pressure has been central to Russia’s ability to pay for goods and services outside the formal banking system.

Recent US designations illustrate why this infrastructure matters in practice. The sanctioning of KB Vostok, a Russian drone developer, highlighted how crypto-enabled financial services can support the procurement of components and services linked to unmanned systems production. The US has also sanctioned OKO Design Bureau, another Russian drone developer, reinforcing enforcement attention has extended beyond financial intermediaries to include defence-adjacent actors operating within and benefitting from, crypto-enabled payment ecosystems.

Rather than eliminating this infrastructure, sanctions have tended to reshape it. Exchanges have been sanctioned, disrupted, or closed, only for functionally similar entities to emerge in their place, often drawing on the same personnel, technical infrastructure and client networks. This has produced a resilient ecosystem in which exchange-based conversion remains a foundational layer underpinning more sophisticated settlement arrangements.

Case 1: Garantex and Grinex

Garantex has been a central node in Russia’s crypto ecosystem since well before the full-scale invasion of Ukraine. Operating from the Federation Tower in Moscow City, Garantex specialised in high-volume conversion of roubles into crypto assets, with a particular focus on stablecoins. Its client base included traders, intermediaries and commercial actors engaged in foreign trade and illicit activities, allowing rouble-denominated funds to be transformed into instruments usable beyond the traditional financial system.

Despite being designated by the US, EU and UK, Garantex did not disappear. Instead, enforcement pressure triggered a process of fragmentation and reconstitution. Infrastructure, personnel and client relationships migrated to successor platforms, most notably Grinex, which replicated Garantex’s core functions under new branding and corporate arrangements. This transition preserved access to liquidity and continuity of service, underscoring a recurring enforcement challenge: sanctions against individual exchanges have tended to disrupt operations temporarily rather than dismantle the underlying ecosystem.

quote
Despite the continuation of its activity, sanctions have a material impact on cyber actors and the designation of Garantex imposed real costs on the actors behind these networks

This infrastructure has been directly linked to procurement activity. The US identified crypto-enabled services connected to Garantex-era infrastructure as facilitating financial transactions for Russian defence-linked entities, including KB Vostok, a drone developer sanctioned for supporting Russia’s unmanned systems programme. The case illustrates how exchange-based rouble-to-crypto conversion can support payments for components, services and intermediaries involved in weapons production. In 2025, the US also exposed the use of Russian-linked crypto services to move funds between Russia and Iran-connected networks supporting the Houthis, highlighting how the same exchange ecosystem can be leveraged both for procurement-related transactions and for broader forms of military and security assistance.

Despite the continuation of its activity, sanctions have a material impact on cyber actors and the designation of Garantex imposed real costs on the actors behind these networks. The seizure of their domains and servers and the freezing of over $26 million in illicit funds damaged the exchange and efforts to rebrand, restructure and migrate infrastructure are resource-intensive and operationally inefficient, even for well-adapted illicit service providers. Garantex functioned as a major hub within the Russian crypto ecosystem, with broad reach across both mainstream and illicit markets. While successor platforms such as Grinex have been able to absorb portions of this activity, they operate at a more limited scale and largely within a closed ecosystem of Russian users and Russia-adjacent services, rather than serving as comparable global nodes. This underscores sanctions can degrade, even if they do not fully eliminate, crypto-enabled evasion networks.

Case 2: Exved Agent

In parallel with exchanges, platform-based payment agents have emerged to further abstract crypto use behind conventional trade documentation. Exved is a prominent example, operating as a payment facilitator linked to infrastructure and personnel associated with the Garantex ecosystem.

Under its model, Russian importers transfer roubles domestically to an intermediary agent. The foreign leg of the transaction is executed separately through offshore entities, with settlement occurring in crypto or local currency. Contracts and invoices are structured to remove explicit references to Russia and to obscure the use of crypto, allowing transactions for dual-use goods to proceed with reduced compliance risk. In practical terms, Exved functions as an abstraction layer, separating the Russian rouble payment from the cross-border transfer and embedding crypto conversion within a framework that resembles legitimate trade finance.

Case 3: A7A5 Stablecoin

As pressure on illicit exchanges like Garantex and Grinex intensified, Russia’s crypto ecosystem evolved further. The emergence of A7A5 between 2024 and 2025 marked a shift from reliance on exchanges alone towards tokenised settlement infrastructure designed to operate under sustained sanctions pressure.

quote
While blockchain transactions are publicly recorded, the linkage between wallet addresses and real-world actors is frequently opaque

A7A5 is a rouble-backed stablecoin issued through an entity incorporated in Kyrgyzstan and reportedly backed by rouble deposits held at Promsvyazbank, a Russian state-owned bank subject to multiple sanctions regimes. The token allows roubles to be converted into a digital instrument that can circulate beyond Russia’s banking system before being exchanged for globally accepted stablecoins. Reflecting its role in sanctions evasion, A7A5 has since been sanctioned by the US, EU and the UK, alongside related entities and infrastructure.

Operationally, A7A5 served as a bridging asset, whereby Russian actors deposit roubles domestically, receive A7A5 tokens and then swap those tokens for USDT on connected platforms. This sequence enables funds to enter the stablecoin ecosystem used for international settlement without passing through traditional correspondent banking channels. Public reporting indicates A7A5 processed approximately $93.3 billion in transactions in less than one year, highlighting its rapid uptake and use at scale.

Strategically, A7A5 does not replace exchanges such as Garantex or Grinex. Instead, it complements them by adding an additional layer of insulation between rouble liquidity and foreign counterparties, reducing exposure to enforcement at the point of conversion while preserving access to stablecoin-based settlement.

Over-The-Counter Exchanges: The Blindspot

As exchanges and branded platforms have come under growing regulatory and enforcement scrutiny, Over-The-Counter (OTC) brokers have assumed an increasingly central role in Russia’s sanctions evasion ecosystem. The core vulnerability exploited by OTC brokers lies in the separation between blockchain traceability and attribution.

While blockchain transactions are publicly recorded, the linkage between wallet addresses and real-world actors is frequently opaque. OTC brokers capitalise on this gap. Unlike regulated virtual asset service providers that conduct Know Your Customer checks, illicit OTC desks operate through informal, trust-based networks that allow clients to convert fiat currency into cryptocurrency without creating a traceable banking footprint.

These OTC networks have become central not only to Russian capital flight, but also to procurement-related payments. They frequently operate in jurisdictions with weak regulatory oversight or through nested arrangements, whereby illicit brokers control accounts at otherwise legitimate exchanges. In such cases, a single exchange account can be used to process large volumes of transactions for unscreened clients, effectively laundering funds before they exit the platform and are used for cross-border settlement.

In operational terms, OTC desks are often the mechanism that converts Russian funds into procurement-ready stablecoins. Unlike online exchanges, many OTCs rely on in-person interaction and trusted couriers rather than digital onboarding. This physical dimension sharply limits the effectiveness of remote monitoring and automated compliance tools.

quote
As traditional routes have come under scrutiny and compliance expectations have hardened, Russia’s procurement networks have reconfigured both where goods move and how transactions are settled

To further obscure attribution, OTC desks use thousands of rotating deposit addresses and layered wallet structures that fragment transaction trails. Without active probing techniques, wallet attribution remains extremely challenging. This helps explain why apparent “declines” in measured crypto crime can reflect reduced visibility rather than a genuine contraction in activity.

Critically, addressing this blind spot requires more than improved analytics. Effective intelligence collection on OTC activity depends on on-the-ground investigation, human intelligence and the systematic collection of raw data that does not appear on-chain, including ownership structures, courier networks, physical locations and service relationships. At present, such collection is uneven and limited in scale, leaving a significant gap between the sophistication of OTC-based evasion and the tools used to detect it.

Understanding crypto-enabled procurement networks therefore requires moving beyond aggregate transaction flows to forensic-level analysis that integrates blockchain data with off-chain intelligence. While the evasion methodology relies on obfuscation and fragmentation, effective detection depends on attribution, targeted investigation and sustained intelligence collection across both digital and physical domains.

Conclusion and Recommendations

Sanctions have had a tangible impact on Russia’s procurement environment. Measures aimed at disrupting access to critical items have reshaped physical supply chains, forcing Russia to divert trade flows away from direct suppliers and towards a wider set of intermediary jurisdictions. While these efforts have increased costs, complexity and risk, they have not halted procurement. Instead, they have driven adaptation. As traditional routes have come under scrutiny and compliance expectations have hardened, Russia’s procurement networks have reconfigured both where goods move and how transactions are settled.

It is within this context crypto has emerged as a critical enabling mechanism. As sanctions enforcement has increased friction within the traditional financial system, payment settlement has become a primary point of vulnerability for Russian importers, even where physical trade can still occur. Crypto-enabled payment systems have increasingly been used to bridge this gap, allowing procurement to continue outside sanctions-compliant banking channels. The result is a complex, crypto-enabled procurement ecosystem that links diverted physical supply chains with alternative settlement mechanisms designed to blunt the disruptive effects of sanctions. Addressing this challenge will require complementing sanctions designations with dynamic, intelligence-led enforcement that targets enabling infrastructure, payment mechanisms and procurement-linked actors together. The international sanctions coalition targeting Russia’s war efforts should consider the following recommendations.

quote
If sanctions are to remain an effective tool of economic statecraft, they must evolve in step with the systems they are intended to disrupt

  1. Sustain coordinated pressure on circumvention networks: Sanctions should systematically assess whether restrictions on physical trade are being offset by alternative financial settlement mechanisms. Diplomatic engagement and enforcement action should integrate trade data on CHPIs with financial intelligence on crypto-based payments to identify and apply pressure where physical rerouting and financial circumvention take place, ensuring sanctions are not neutralised by the parallel evolution of crypto-enabled payments.
  2. Enhance intelligence collection on OTC brokers: The intelligence gap regarding OTC operations in high-risk jurisdictions remains significant. Governments should invest in mechanisms that integrate on-the-ground intelligence, human sources and physical surveillance with financial and blockchain analysis. Reliance on remote analytics and transaction heuristics alone is insufficient to identify ownership structures, courier networks and service relationships that underpin OTC-based procurement payments.
  3. Improve structured private-public information sharing on attribution: A dedicated and operationally focused mechanism should be established to enable the sharing of raw wallet data, attribution insights and investigative leads between virtual asset service providers, blockchain analytics firms, financial intelligence units and sanctions authorities. This should prioritise procurement-relevant activity and help counter misleading narratives about declining crypto crime that stem from attribution gaps rather than reduced activity.
  4. Target enabling infrastructure and successor entities, not only named firms: Enforcement efforts should explicitly address the reconstitution of sanctioned exchanges, payment agents and service providers under new names and corporate structures. Sanctions designations have had material impact on major targets like Garantex but this pressure should be applied on a network basis, taking into account shared infrastructure, personnel, technical dependencies and client continuity, rather than treating each entity as an isolated case.
  5. Apply coordinated diplomatic and regulatory pressure on permissive jurisdictions: Jurisdictions hosting exchanges, OTC brokers, payment agents, or token issuers linked to Russian sanctions evasion should be prioritised for targeted engagement. This should include awareness raising, technical assistance and, where necessary, adopting sanctions and severing access to international financial systems.
  6. Target bridging assets and settlement mechanisms: Sanctions should prioritise the assets and instruments that enable conversion and settlement, particularly A7A5 and widely used stablecoins such as USDT. While the EU, UK and US designations targeting A7A5 represent an important step, effective implementation requires sustained cooperation with platforms hosting these assets and clearer expectations for stablecoin issuers to freeze wallets linked to sanctions evasion with the same urgency applied in terrorist financing cases.
  7. Expand targeting beyond financial intermediaries to procurement-linked vendors and agents: Sanctions and export control enforcement should systematically include vendors, OTC brokers and intermediaries supplying dual-use goods. Wallets associated with such entities should be mapped and monitored, with payments from unidentified or high-risk sources triggering enhanced due diligence, transaction blocking, or follow-on investigations.
  8. Adopt active attribution and probing techniques within appropriate legal frameworks: Law enforcement and intelligence agencies should develop the capacity to use active techniques, including controlled probing and clustering methods, to map evasion networks associated with exchanges, OTC brokers and payment agents. Passive observation is increasingly inadequate given the use of obfuscation tactics such as rotating deposit addresses and layered wallet structures. Where necessary, licenses and updated legal authorities should be considered to support this work.

If sanctions are to remain an effective tool of economic statecraft, they must evolve in step with the systems they are intended to disrupt. Russia’s turn to crypto to sustain procurement reflects a deliberate effort to shift the centre of gravity away from the regulated financial system and towards alternative payment infrastructures that are harder to monitor and interrupt. Allowing this ecosystem to consolidate unchecked risks eroding the deterrent and disruptive power of sanctions over time. Policymakers should therefore act now to close the gaps and align export controls, asset freezes and intelligence collection into a coordinated framework. Only through such integration can sanctions move beyond reshaping how Russia procures restricted goods and instead materially constrain its ability to sustain the supply chains that underpin its war effort.

© RUSI, 2026.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.


WRITTEN BY

Gonzalo Saiz Erausquin

Research Fellow

Centre for Finance and Security

View profile


Footnotes


Explore our related content