These concerns are urgent. DeFi already presents incredibly attractive financing opportunities for a range of illicit activities—four of which are explored in the following sections. From North Korea’s use of DeFi protocols to evade sanctions and launder funds to build its arsenal of nuclear warheads to the Sinaloa cartel’s use of digital currency in its fentanyl trafficking operations, nefarious actors’ access to unregulated platforms has allowed them to evade the tools that the United States relies on to identify, investigate, and ultimately bring them to justice.
1. U.S. adversaries are using cryptocurrency to finance weapons and war
By routing transactions through platforms that operate without gatekeepers or compliance infrastructure, sanctioned regimes and bad actors have gotten around the primary enforcement mechanism designed to isolate them from the international economic system. For example, Russian officials successfully used cryptocurrency to evade the unprecedented U.S. and allied sanctions imposed following Russia’s 2022 invasion of Ukraine. Despite comprehensive asset freezes and banking restrictions, Russian state actors have transferred billions of dollars in stolen wealth through cryptocurrency mixers and decentralized exchanges, maintaining access to global financial markets while funding the ongoing war effort. The United Kingdom’s Office of Financial Sanctions Implementation sanctioned the A7 crypto network that moved $90 billion into the Russian economy in 2025 alone. U.S. law enforcement investigations have traced billions of dollars in cryptocurrency transactions linked to Russian sanction evasion networks, with digital assets and DeFi protocols enabling rapid conversion of seized state resources into untraceable forms that cross borders practically instantaneously.
According to Financial Action Task Force assessments, Iranian state actors have similarly utilized cryptocurrency to circumvent sanctions and finance militant proxy networks in Iraq, Syria, and Lebanon. The Islamic Republic has become so comfortable using cryptocurrency that Iranian officials have recently requested bitcoin payments, rather than fiat currencies, for fees to pass through the Strait of Hormuz. And The Wall Street Journal has reported on the critical role that DeFi plays in Iran’s crypto financing: By moving coins through decentralized protocols, Iran was able to effectively move $3.84 billion in transactions.
But North Korea is perhaps the most egregious example of the national security dangers posed by the vulnerabilities of the cryptocurrency ecosystem. North Korea has carried out a highly sophisticated state-sponsored campaign of crypto theft and crypto laundering to fund its illegal weapons programs, including dozens of nuclear warheads and long-range ballistic missiles that could potentially hit the United States. A series of U.N. Security Council resolutions (UNSCRs) passed from 2006 to 2017—all of which remain in effect today—prohibit financial transfers to entities linked to the Democratic People’s Republic of Korea’s (DPRK) illegal weapons of mass destruction (WMD) and ballistic missile programs and impose asset freezes on the same.
To evade these sanctions, the DPRK has developed a highly capable cyber force that engages in increasingly brazen acts of cybercrime to generate revenue. According to the Multilateral Sanctions Monitoring Team, a group of 11 U.N. member states that monitor and report on violations and evasions of North Korea-related UNSCRs, DPRK cyber actors have stolen billions of dollars’ worth of crypto assets in recent years, including $1.4 billion from the Gulf-based crypto exchange Bybit in February 2025, perhaps the largest heist in history. After successfully stealing cryptocurrency, DPRK hackers have routed the funds through Uniswap and other decentralized exchanges, converting the stolen tokens into ethereum before moving the proceeds into the Tornado Cash mixer—an entity sanctioned by the U.S. Treasury in 2022 and then delisted in March 2025—to obscure their trail until finally converting the coins into fiat currency (frequently via Chinese banks). These funds have then been used for procurement activities and other transactions in support of the regime’s WMD and ballistic missile programs.
2. Terrorist networks use cryptocurrency to fund their operations
In the aftermath of the 9/11 terror attacks, intelligence emerged that al-Qaida had used the U.S. banking system to finance its terror. This led to the passage of amendments to the Bank Secrecy Act (BSA), which required banks to conduct rigorous know-your-customer (KYC) checks and to report any suspicious transactions. Such checks mean that terrorist groups around the world have had to navigate a challenging financial landscape, as compliance-heavy American banks were at the center of almost all major money transfers.
Currently, though, certain types of crypto platforms are not subject to such checks or compliance, increasingly making these the method of choice for terrorist organizations to finance their operations; they can now use crypto to gain, store, and move money, as well as obscure its illicit nature. For example, although the scope of Hamas’ digital financing has been debated, it is certain that it used at least some cryptocurrency in financing the October 7, 2023, attacks on Israel. This is not the only example: ISIS’ Afghanistan affiliate, the Islamic State Khurasan Province (ISKP), has financed a number of terror attacks around the globe using cryptocurrency, and African terrorist group Boko Haram uses crypto to purchase weapons.
3. Cryptocurrencies facilitate worldwide human trafficking and online child sexual exploitation
Transnational trafficking networks are increasingly exploiting digital assets to facilitate illicit transactions, transfer criminal proceeds, and bypass traditional financial oversight. A U.S. Department of Justice prosecution involved the unlawful shipment of firearms to customers in more than 10 countries through a darknet marketplace that accepted cryptocurrency. Comparable patterns are evident across other forms of trafficking. The Financial Crimes Enforcement Network (FinCEN) reported that BSA reports involving the use of cryptocurrency in human trafficking and online sexual exploitation increased from 336 in 2020 to 1,975 in 2021, with bitcoin identified as the predominant cryptocurrency. More recent independent estimates place the number of human trafficking services operating on cryptocurrency worldwide in the hundreds of millions.
Although transactions on public blockchains such as bitcoin are traceable, identifying the individuals behind wallet addresses (which are a series of numbers) often requires significant investigative resources, allowing trafficking networks to exploit the speed and cross-border nature of digital asset transfers. These practical limitations illustrate how gaps in regulatory oversight can weaken the effectiveness of financial intelligence gathering and law enforcement efforts.
4. Drug cartels use DeFi to conceal fentanyl trafficking profits
The U.S. Department of the Treasury has determined that drug trafficking organizations are making greater use of DeFi and digital assets to move and conceal illicit proceeds, increasing the sophistication of transnational criminal finance. Operation Dark HunTor, a joint international law enforcement effort across the United States, Australia, and Europe in 2021, demonstrated the operational scale of cryptocurrency-enabled drug trafficking, with international authorities arresting 150 alleged darknet traffickers and other criminals and seizing 234 kilograms of narcotics. In 2025, the Drug Enforcement Administration and FBI seized more than $10 million in cryptocurrency linked to Mexico’s Sinaloa cartel during an investigation in Miami. Together, these cases demonstrate that digital assets increasingly complement traditional cash-based methods, expanding the financial channels available to organized crime. As digital assets become more deeply integrated into cartel operations, they create new challenges for identifying, disrupting, and dismantling criminal networks.
The CLARITY Act would codify carve-outs for the worst offenders
These examples underscore the urgent need to strengthen commonsense, essential regulations for DeFi and other cryptocurrency platforms and close gaps in compliance. Platforms have a responsibility to prevent illicit financing and should be required to abide by the same U.S. laws as other financial institutions. This includes registering with FinCEN and complying with BSA requirements on anti-money laundering (AML) and combating terrorist financing.
Unfortunately, the CLARITY Act fails to meet this need. It would define crypto firms responsible for compliance with BSA requirements so narrowly—broadly excluding DeFi from compliance obligations—that it would effectively codify carve-outs. These carve-outs would allow the worst offenders to continue operating in an unregulated environment, for all intents and purposes sanctioning their ability to facilitate illicit transactions. It would also weaken the responsibility of the federal government to impose sanctions at a time when the Trump administration has demurred on enforcement: Acting Attorney General Todd Blanche announced in April (in his role as deputy attorney general) that the Department of Justice (DOJ) would not bring BSA/AML enforcement cases against crypto exchanges without evidence of willful intent, increasing the threshold for enforcement and leaving enforcement against other types of crypto businesses unaddressed. As ProPublica later reported, at the time Blanche issued the DOJ directive, he held between $159,000 and $485,000 in cryptocurrency.
Finally, the CLARITY Act lowers the bar on global regulatory measures. Because of the transnational nature of digital financial transactions (and the nature of national security concerns mentioned above), international coordination is critical to combating illicit finance. This legislation signals to the global community that the United States, as the world’s largest market for DeFi, is not serious about mitigating harm.
Congress has an essential role to play in passing legislation that ensures cryptocurrency exchanges and DeFi platforms share in the burden of responsibility for combating illicit financing and comply with the same rules that businesses using any other financial tool are required to follow. Congress also has a role to play in ensuring the U.S. government has the intelligence and law enforcement tools it needs to protect national security. Rather than pass the CLARITY Act, it should pursue comprehensive legislation that meets those imperatives.
The authors would like to thank Alex Thornton and Dan Herman for their close, substantive review, as well as Gabriel de Kergorlay and Sophia Robertson for their fact-checking support.