Sanctioned entities received $15.8 billion in crypto in 2024, accounting for 39% of all illicit crypto transactions, according to the 2025 Crypto Crime Report by blockchain analytics firm Chainalysis.The report highlighted how increasing geopolitical tensions and financial restrictions drove nations like Iran and Russia to turn to digital assets to evade sanctions.The US Treasury’s Office of Foreign Assets Control (OFAC) ramped up efforts to dismantle financial networks supporting sanctioned states, moving beyond targeting individuals to disrupting core financial infrastructures.OFAC issued 13 designations involving crypto addresses, the second-highest total in the past seven years, despite a decrease in overall sanctions.Iran’s reliance on cryptoIran’s growing reliance on crypto was evident, with centralized exchanges (CEXs) in the country showing increased activity and capital outflows.Outflows surged to $4.18 billion in 2024, up 70% year-over-year, as residents turned to digital assets amid the steep depreciation of the Iranian rial and inflation hovering around 40-50%.The Iranian government’s abrupt halt of withdrawals from exchanges indicates its attempts to curb financial outflows. Many Iranians turned to crypto as a hedge against economic instability and to preserve wealth, often using digital assets to bypass government-imposed financial controls.Meanwhile, in February, the Trump administration issued the National Security Presidential Memorandum (NSPM-2), reinstating the “maximum pressure” campaign on Iran.The directive outlined aggressive measures for the US Department of Justice (DOJ) to target Iranian-linked financial networks and disrupt sanctions evasion activities. These measures included investigating Iranian financial networks, impounding illicit oil cargoes, seizing Iranian governmental assets, and prosecuting leaders of Iranian-funded terrorist groups.Russia’s growing ecosystemIn Russia, lawmakers enacted legislation legalizing crypto mining and allowing digital assets for international payments to mitigate the economic strain of Western sanctions.The policy shift aimed to ease financial pressure by enabling global trade through cryptocurrencies, and Russia strengthened ties with BRICS nations — Brazil, Russia, India, China, and South Africa — to explore alternative financial systems that bypass the US dollar.Russia’s Central Bank has been driving efforts to integrate crypto into the country’s financial system under regulatory oversight, highlighting a significant departure from the country’s previous stance against digital assets.Western agencies launched significant operations against Russian-linked crypto entities in 2024. On August 23, OFAC sanctioned Russian UAV developer KB Vostok OOO for soliciting crypto donations and likely facilitating drone sales to Russian forces in Ukraine.The German Federal Criminal Police seized infrastructure from 47 no-KYC crypto exchanges involved in ransomware and darknet transactions on Sept. 19 as part of “Operation Final Exchange.”Meanwhile, OFAC sanctioned Russia-based crypto exchange Cryptex and its operator, Sergey Sergeevich Ivanov, on Sept. 26 for laundering billions through fraud shops and darknet markets during “Operation Endgame.”The crackdown continued on Dec

British police have arrested and charged two men in connection with a crypto scam that resulted in a 75-year-old Aberdeenshire pensioner losing a six-figure sum.The male victim reported the fraud in July 2024, leading to an investigation by Police Scotland.Officers from the force’s North East division commuted to England yesterday to make the arrests, working in conjunction with West Midlands and South Yorkshire Police.They arrested a 54-year-old man in Coventry and a 36-year-old in Mexborough, with both individuals being charged on the same day.In a statement on the arrests, Detective Sergeant David Williamson—of North East division’s Cyber-Enabled Crime Team—warned members of the public “to be mindful of activity which appears fraudulent and to report this to police.”Police Scotland’s statement provides no further detail, but the large sum involved suggests that the fraud was a pig butchering scam, in which fraudsters develop an online relationship with their victim(s) in order to coax them into sending money.Williamson has investigated similar cases in recent years, with one 2021 fraud leading to a Yorkshire man, Benjamin Riley, receiving a 12-month community payback order in March 2024.Speaking in March, Williamson described how Riley had opened a social media account through which he promoted a fictitious proprietary trading bot, and through which he was able to gain a £10,000 investment from a 30-year-old Aberdeen man.Williamson said, “the investor noticed that the investment channel had been deleted and he was not able to access his money or get a hold of Riley.”Scams on the riseMore generally, pig butchering scams have become the fastest growing variety of cryptocurrency fraud, with Chainalysis’ 2025 Crypto Crime Report finding that revenue from such exploits increased by 40% in 2024.While it remains the second-biggest kind of crypto fraud behind high-yield investment scams (also known as Ponzi schemes), it already accounts for a third of all fraudulent revenue.And according to James Toledano, the chief operating officer at Unity Wallet, it’s not just a threat within the cryptocurrency market and industry.“Fraudsters use social media, dating-platforms or other digital touchpoints to cultivate long-term relationships with their prey,” he told Decrypt. “The financial and emotional toll on victims is profound, with many losing substantial portions of their life savings, being saddled with debt, living with extreme feelings of guilt and shame which in some cases can lead to suicide.”Given the enormous potential cost involved, Toledano advised retail investors to show a heightened degree of vigilance, and to adopt the old adage of “if it’s too good to be true,” then it’s probably not true.He also called on exchanges and platforms to step up more, explaining, “the industry also needs to implement robust protective measures where they present victims with cautionary information before allowing them to proceed with a transaction—all banking apps in the UK do this already and this should be required in DeFi also.”Toledano stressed the importance of thoroughly researching and verifying the legitimacy of any investment platforms or channels a new contact urges you to use, while also speaking with trusted family and friends before proceeding with any doubtful investments or transfers.While conceding that, "It is challenging to eliminate exposure to ‘pig butchering’ scams entirely," Toledano said that retail crypto investors can mitigate their risk by "exercising caution with unexpected messages or friend requests, especially those that quickly transition into discussions about investments or personal finances."Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more

Decrypt’s Art, Fashion, and Entertainment Hub. Discover SCENEIf you're on an Apple macOS device right now, you might want to keep reading.Researchers from Microsoft Threat Intelligence have uncovered a new variant of malware that can target crypto wallets.XCSSET was first detected back in 2020—and allows malicious actors to take screenshots, record what users are doing, and steal data from Telegram.This updated version can also target data in Apple's Notes app, and uses obfuscation techniques that make the malware harder to detect.Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. While we’re only seeing this new XCSSET variant in limited attacks at this time, we’re sharing this information… pic.twitter.com/oWfsIKxBzB — Microsoft Threat Intelligence (@MsftSecIntel) February 17, 2025Enhanced persistence mechanisms mean the malicious payload is deployed every time the Launchpad is activated from the macOS dock.And given it has the capability of encrypting files, there's a real risk of XCSSET being used for ransomware attacks.Microsoft says the latest variant has only been detected in "limited attacks" so far, and was sharing this information to help organizations protect themselves.When the XCSSET malware first emerged, researchers at Trend Micro said it primarily appeared to target developers.Even back then, XCSSET had the theoretical capability to manipulate what the end user sees on their browser. This could include modifying or replacing Bitcoin and other crypto addresses, meaning funds aren't sent to their desired destination.It tends to be disseminated through infected Xcode projects, which consist of the files used to create apps for macOS.The researchers added that Microsoft Defender for Endpoint on Mac has the capability to detect this latest variant of XCSSET.The researchers added that users “must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects. They should also only install apps from trusted sources, such as a software platform’s official app store.”The evolving ransomware spaceChainalysis recently noted that the ransomware space is rapidly evolving, with payments to hackers falling 35% in 2024 compared with the year before. Increased action from law enforcement and a "growing refusal by victims to pay" were some of the key factors behind the drop.But the blockchain intelligence firm went on to warn that attackers are starting to shift their tactics by deploying new ransomware strains, and starting to ask for payments just hours after data is encrypted