Publications

Iran’s Sanctions Evasion Framework

To sustain state revenues and maintain regime stability, Iran has developed a sophisticated, multi-layered toolkit to circumvent international restrictions. Its key components include: the use of front companies and complex intermediary networks; shadow banking systems and informal financial transfer mechanisms; oil smuggling operations, including ship-to-ship transfers; manipulation of shipping registries and the use of flags of convenience; barter agreements and nondollar-denominated trade; and gold-based transactions and alternative settlement systems.

The key strategic insight is clear: increasing economic pressure on Iran does not necessarily require additional sanctions, but rather improved enforcement and the dismantling of existing evasion infrastructure. Without consistent enforcement, sanctions risk becoming a manageable operational cost rather than an effective strategic constraint.

This is particularly true for Hezbollah, which works alongside Iran through coordinated mechanisms to evade sanctions. The Lebanese organization also constitutes a central component of Iran’s ability to circumvent Western sanctions, thereby generating substantial revenues for its own activities and for the broader Axis.

While Hezbollah continues to receive substantial financial support from Iran, estimated at approximately $700 million annually, and reaching up to $1 billion in recent years, the organization has actively diversified its funding sources. Several factors drive this shift: rising military expenditures, including advanced weapons systems and force expansion; increased social welfare commitments within Lebanon’s Shiite population; and preparation for potential fluctuations in Iranian financial support.

As a result, Hezbollah has established parallel financial networks across Latin America, West Africa, and other regions. These networks frequently intersect with illicit trade and organized crime structures.

This diversification both reduces Iran’s direct financial burden and strengthens the resilience of its broader proxy network.

Venezuela as a Strategic Platform

Meanwhile, the Iran–Venezuela relationship, initiated under President Hugo Chávez and further strengthened under Nicolás Maduro, has evolved into a mutually beneficial partnership focused on sanctions resilience.

For Iran and Hezbollah, Venezuela offers several strategic advantages: a relatively insulated channel for oil cooperation; access to gold and other natural resources; alternative financial pathways outside Western oversight; and a permissive operating environment characterized by limited enforcement.

Iranian and Hezbollah-linked actors have leveraged relationships with Venezuelan political and military elites, local business networks, and Shiite diaspora communities to establish a strong operational and financial presence within the country.

Gold mining and energy cooperation are particularly critical, as they enable value extraction outside the traditional dollar-based financial system. The financial networks described above operate within a broader political and logistical ecosystem shaped by longstanding ties between Hezbollah-linked actors and elements of the Venezuelan state.

Hezbollah’s footprint in Venezuela expanded significantly during Chávez’s presidency, as his administration forged close political and economic ties with Iran. These relationships facilitated the expansion of Iranian and Hezbollah-linked networks throughout Latin America.

Under Maduro, these ties have deepened further. Investigations and intelligence reporting have identified links between Hezbollah-affiliated individuals and Venezuelan political figures involved in economic and security institutions.

Notable individuals associated with these networks include:

• Tareck El Aissami – Former Vice President and Interior Minister of Venezuela, linked to Hezbollah-affiliated diaspora networks.
• Ghazi Nasreddine – Lebanese-Venezuelan diplomat sanctioned by the U.S. Treasury for supporting Hezbollah and facilitating engagement with Venezuelan authorities.

Additionally, logistical infrastructure appears to support these networks. Venezuela’s state-owned airline Conviasa has been cited in investigations examining Hezbollah-linked activities in Latin America, facilitating transport between Venezuela and Middle Eastern networks.

These overlapping political, commercial, and logistical relationships created an environment in which Hezbollah-linked financial facilitators could operate with relatively limited enforcement pressure.

For both Hezbollah and Iran, the use of cryptocurrency enables these operations, given the many advantages it offers them in their efforts to circumvent U.S. sanctions.

Why Iran and Its Proxies Use Cryptocurrency

Over the past decade, cryptocurrency has evolved from a niche technological innovation into a central component of the global financial system. Initially designed to facilitate peer-to-peer transactions without reliance on traditional banking institutions, the ecosystem has expanded significantly to include cross-border payments, digital asset markets, decentralized finance (DeFi), and the widespread adoption of stablecoins (cryptocurrencies designed to maintain a stable value).

For legitimate users, cryptocurrency offers several advantages: rapid international transfers, reduced friction in cross-border transactions, and access to dollar-denominated assets in environments characterized by inflation or financial instability. These features have contributed to its accelerated global adoption.

However, these same structural characteristics also create vulnerabilities. While blockchain transactions are publicly recorded (blockchain is the underlying technology that enables cryptocurrency trading), the identities behind wallet addresses remain pseudonymous. Moreover, cryptocurrency networks operate across jurisdictions and outside the traditional correspondent banking system, limiting regulatory oversight and enforcement capabilities.

As a result, sanctioned actors have increasingly incorporated digital assets into their financial architecture. Rather than replacing traditional financial mechanisms, cryptocurrency typically functions as an additional layer within existing illicit financial systems, enabling the cross-border movement of value under sanctions constraints.

In certain instances, cryptocurrency is used directly for fundraising. Individuals may unknowingly transfer digital assets to terrorist organizations under the belief that they are supporting humanitarian causes. Social media campaigns have demonstrated how groups such as Hamas have leveraged humanitarian narratives to solicit cryptocurrency donations.

More commonly, however, cryptocurrency appears at later stages in the financial value chain. Instead of serving as the origin of funds, digital assets function as a transport and redistribution layer within broader illicit financial ecosystems.

Recent intelligence assessments indicate that Iran-aligned networks, including actors affiliated with the Islamic Revolutionary Guard Corps (IRGC), have integrated cryptocurrency across multiple stages of their financial operations. According to NOMINIS analysis, cryptocurrency flows associated with Gaza-based actors exceeded $100 million in a single year — an amount significant relative to Gaza’s formal economy.

Cryptocurrency has also emerged within procurement networks. Evidence suggests that the IRGC accepts digital assets as payment for weapons and related materials sold online. In this context, cryptocurrency serves both as a financial instrument and as a transactional medium within illicit supply chains. These developments reflect a broader transformation: terror-linked networks are no longer merely recipients of cryptocurrency donations. They are actively integrating digital assets into procurement systems, operational financing, and cross-border financial transfers.

Unmasking the Money Trail

By using crypto-analysis intelligence tools, it is possible to reconstruct portions of the financial infrastructure used by Iran-aligned networks to transfer value across jurisdictions while circumventing traditional financial oversight mechanisms.

This analysis is based on a multi-source intelligence framework integrating open-source intelligence (OSINT), blockchain transaction analysis, and proprietary investigative data derived from the NOMINIS platform.

The research incorporates a broad range of open-source materials, including sanctions designations, intelligence assessments, court filings, investigative journalism, media reporting, and corporate registry records related to individuals and entities associated with Hezbollah financial networks and Iranian sanctions-evasion activities.

These sources were combined with advanced blockchain analytics that can trace transaction flows, identify clusters of related wallets, and detect behavioral patterns consistent with money laundering and financial obfuscation.

In addition to publicly available information, the analysis incorporates proprietary intelligence generated through the NOMINIS platform. NOMINIS applies advanced attribution methodologies designed to connect pseudonymous blockchain activity with real-world actors. These methodologies combine wallet clustering, transaction analysis, behavioral profiling, and cross-platform intelligence correlation to assess likely wallet ownership and account coordination.

This research identifies two distinct yet interconnected financial pipelines associated with the Iranian proxy ecosystem:

1. The Venezuela-based Gold Pipeline – A sanctions-evasion mechanism in which illicitly extracted Venezuelan gold is monetized and converted into cryptocurrency through intermediary financial facilitators linked to Hezbollah networks.
2. The Iranian Oil Revenue Pipeline – A parallel system in which proceeds from sanctioned Iranian oil sales are laundered through brokers, shell companies, and intermediary financial structures before being converted into digital assets associated with IRGC-linked financial infrastructure.

Although these pipelines originate from different commodity sectors, both ultimately converge within overlapping cryptocurrency ecosystems used to facilitate the international movement and redistribution of funds.

The Hezbollah Gold–Cash–Crypto Pipeline

The financial architecture identified in this research follows a structured value-conversion model that transforms illicit commodity extraction into portable digital assets that can cross borders with limited regulatory oversight.

Stage 1 – Gold Extraction

The pipeline originates in Venezuela’s Orinoco Mining Arc in Bolívar State, one of Latin America’s largest gold-producing regions. Mining zones, including El Callao, Nacupay, Ciudad Bolívar, and San Félix, have emerged as central hubs in Venezuela’s informal and illicit mining economy.

Mining operations in these areas are frequently controlled by criminal organizations such as Tren de Guayana, often operating with the cooperation — or tacit tolerance — of corrupt local intermediaries and officials. Hezbollah-linked facilitators embedded within the region generally do not directly manage mining operations. Instead, they derive revenue through profit-sharing agreements, commissions, and intermediary financial arrangements tied to gold production.

Stage 2 – Consolidation, Movement, and Smuggling

Following extraction, gold is consolidated through networks of brokers, trading houses, and commercial cover entities designed to obscure its origin. Agricultural, livestock, and import-export companies are frequently used as shell structures within this process.

The cities of San Félix de Guayana and Puerto Ordaz serve as key logistical aggregation hubs. From these locations, gold is prepared for cross-border transport using falsified customs documentation and layered commercial transactions intended to conceal provenance and ownership.

The gold is subsequently smuggled through land corridors into neighboring countries such as Brazil and Guyana, or transported by maritime and aviation routes to trading hubs in Turkey and the broader Middle East. Several of these logistical pathways overlap with routes historically associated with Iranian sanctions-evasion networks and IRGC-linked facilitation mechanisms.

Stage 3 – Conversion into Cryptocurrency

The next phase of the pipeline involves converting cash proceeds from gold sales into cryptocurrency. Portions of the proceeds are converted into cryptocurrency through a network of over-the-counter (OTC) brokers, digital asset exchanges, and intermediary financial facilitators. Funds are exchanged for high-liquidity digital assets, including Bitcoin and Ethereum, the two largest cryptocurrencies by market capitalization, as well as stablecoins — a category of digital assets designed to maintain a fixed value, typically pegged to the U.S. dollar.

The stablecoin of particular relevance here is USDT (Tether), transacted primarily over the TRON network, a blockchain protocol favored for its low transaction fees and high processing speed.

Blockchain intelligence and investigative reporting, as well as evidence presented in the Balva v Binance Lawsuit complaint, indicate that Syrian national Raed Abib Habib, also known as “El Turco Raeb,” plays a central coordinating role within this network. Habib is assessed to function as a regional financial organizer responsible for linking Venezuela’s physical commodity economy with the digital financial infrastructure utilized by Hezbollah-linked financiers operating abroad.

Through networks of intermediaries, shell entities, and exchange accounts, Habib allegedly facilitates the movement of proceeds generated from Venezuelan gold operations into cryptocurrency conversion channels. This structure enables rapid cross-border transfers while reducing reliance on the traditional banking system and limiting exposure to sanctions enforcement mechanisms.

The use of stablecoins — particularly USDT on TRON — appears particularly significant due to their liquidity, transfer speed, and widespread use within informal cross-border financial ecosystems associated with sanctions-evasion activity.

Another key figure connected to this cryptocurrency infrastructure is Tawfiq Muhammad Sa’id al-Law, a Syrian-Lebanese money exchanger designated by the U.S. Treasury for providing cryptocurrency services to Hezbollah and the IRGC-Quds Force. Al-Law allegedly provided digital wallets used by Hezbollah operatives to receive funds from commodity sales and redistribute them across a broader financial network.

Stage 4 – Redistribution to Proxy Networks

Once converted into cryptocurrency, funds are transferred through clusters of intermediary wallets designed to obscure transaction trails before reaching accounts associated with Hezbollah, the IRGC-Quds Force, and affiliated organizations, including Hamas and Palestinian Islamic Jihad.

This mechanism enables value generated from illicit gold extraction in Venezuela to be rapidly redistributed across jurisdictions and integrated into the broader financial infrastructure supporting Iran’s proxy network.

Ultimately, these funds are used to finance weapons procurement, operational logistics, and militant activities, thereby reinforcing these organizations' operational capabilities while reducing their exposure to traditional financial monitoring systems.

A Parallel Financial Pipeline: Iranian Oil Revenue and Cryptocurrency

While the Venezuela-based gold pipeline demonstrates how Hezbollah-linked facilitators generate revenue through illicit commodity extraction, a parallel sanctions-evasion architecture operates within Iran’s oil sector.

Iran’s energy exports have long been a primary target of international sanctions. In response, Iranian state-linked networks have developed increasingly sophisticated mechanisms to disguise oil shipments, route payments through intermediaries, and convert proceeds into alternative financial assets.

Recent investigations, including findings from the U.S. Department of the Treasury, indicate that a portion of these revenues is now being converted into cryptocurrency through networks of financial facilitators connected to the IRGC and its associated intermediaries.

Stage 1 – Sanctioned Oil Sales

The pipeline begins with the sale of Iranian crude oil through sanctions-evasion techniques designed to conceal the origin of shipments. These methods include Ship-to-ship transfers conducted in international waters; the use of “dark fleet” tankers operating with disabled tracking systems; falsified cargo documentation and manipulated shipping manifests; and reflagging vessels under flags of convenience.

Through these practices, Iranian oil is blended with other shipments or relabeled before entering global markets. Trading intermediaries and commercial brokers facilitate distribution to buyers across Asia and other regions.

However, blending or relabeling the physical barrels does not eliminate the underlying financial trail. Iranian oil remains inexpensive to produce and is sold on global markets in circumvention of sanctions, with the resulting proceeds ultimately moving back to Iran, including through blockchain-based payment networks.

In some cases, IRGC-linked oil financiers operate exclusively within the oil trade. By analyzing their internal ledgers and on-chain transaction patterns, investigators can identify and assess the value of oil-related proceeds, even when the physical cargo has been mixed, relabeled, or routed through intermediaries.

Stage 2 – Revenue Aggregation via Brokers and Shell Companies

Following the sale of oil shipments, revenues are routed through layered networks of intermediaries designed to obscure their origin.

These mechanisms typically involve front companies registered in jurisdictions such as the United Arab Emirates and Hong Kong; trading houses and brokerage firms acting as commercial cover; and informal financial systems and shadow banking networks.

At this stage, funds are consolidated through complex corporate structures that create distance between the proceeds and their sanctioned origin.

Stage 3 – Conversion into Cryptocurrency

Following the consolidation of funds, portions of the proceeds are converted into cryptocurrency through a network of over-the-counter (OTC) brokers, digital asset exchanges, and intermediary financial facilitators.

U.S. Treasury sanctions designations have identified key individuals involved in coordinating this conversion process. Among them is Alireza Derakhshan, an Iranian financial facilitator sanctioned for his role in converting proceeds from Iranian oil sales into cryptocurrency. According to Treasury findings, Derakhshan facilitated transactions totaling more than $100 million between 2023 and 2025 linked to Iranian oil revenues.

Another central figure is Arash Estaki Alivand, an oil broker who operated alongside Derakhshan within a network that acquired and transferred cryptocurrency derived from sanctioned oil sales.

Blockchain analysis has identified associated wallet activity across both the Ethereum and TRON networks. This activity suggests a preference for high-liquidity digital assets — particularly stablecoins — which enable rapid, low-friction transfers across jurisdictions and enhance the efficiency of cross-border value movement within sanctions-evasion frameworks.

Stage 4 – Integration into Proxy Financial Networks

Following conversion, funds are transferred through networks of intermediary wallets and financial facilitators connected to Iran’s broader proxy ecosystem.

Investigative findings indicate that Arash Estaki Alivand conducted multi-million-dollar transactions with Tawfiq Muhammad Sa’id al-Law, the Syrian-Lebanese money exchanger sanctioned by the U.S. Treasury for providing cryptocurrency services to Hezbollah and the IRGC-Quds Force.

This linkage highlights the convergence between the oil-revenue pipeline and the Hezbollah-linked cryptocurrency infrastructure described earlier in this analysis.

Through this integrated system, proceeds from sanctioned Iranian oil sales can be transferred across jurisdictions and incorporated into financial networks that support proxy organizations and regional operations.

Strategic Implications

Effectively constraining Iran’s regional activities and proxy-financing networks requires a shift from symbolic measures to operational enforcement. Four core principles are essential:

• Enforcement over symbolism – Strengthening monitoring of maritime activity, closing shipping loopholes, and enforcing secondary sanctions
• Targeting third-country facilitators – Focusing on jurisdictions and actors that enable sanctions-evasion infrastructure
• Disrupting revenue-conversion mechanisms – Specifically targeting gold trade, illicit energy transactions, front-company financial networks, and cryptocurrency conversion channels
• Prioritizing asset seizure and acting on attribution – While blockchain tracing and wallet-attribution technologies have existed for years, authorities should prioritize converting intelligence into enforcement action.

Iran has demonstrated a sustained ability to operate under sanctions. The critical strategic question is whether it can be denied the ability to monetize its evasion mechanisms effectively.

As long as alternative financial ecosystems remain intact, sanctions are likely to degrade into a persistent but manageable constraint rather than a decisive tool of economic leverage.

Maduro’s capture in January 2026 appears to have significantly disrupted, though not completely severed, the Iran–Venezuela relationship. This alliance had been built on shared sanctions resistance, oil cooperation, and logistical support networks, and Maduro’s fall threatened networks tied to illicit gold trade, crypto transfers, and covert shipping arrangements.

Under interim leader Delcy Rodríguez, Venezuela appears to have adopted a more cautious diplomatic position. Caracas still publicly supports Iran in some cases, but it has also tried to avoid confrontation with Washington. A less cooperative Venezuelan government could complicate evasion efforts to launder money, monetize gold, secure transport routes, and evade crypto-based sanctions. That said, the relationship has not fully collapsed. Iran continues to support Venezuela’s remaining leadership publicly and likely still seeks to preserve elements of the partnership where possible.

Meanwhile, Operation “Economic Fury”— the U.S. effort launched in April 2026 to cut off Iran’s revenue streams — has demonstrated that when law enforcement and sanctions authorities focus on identifiable digital assets and the infrastructure surrounding them, they can move beyond monitoring illicit transactions to freezing, seizing, and denying access to funds.

Not every attributed wallet will be immediately seizable, particularly where funds remain in self-custody or beyond the reach of cooperating jurisdictions. Nevertheless, recent enforcement activity shows that decisive action against accessible assets can materially disrupt Iran’s ability to monetize and repatriate illicit revenue.

Conclusions

The financial architecture outlined in this analysis demonstrates how Iran-aligned networks integrate traditional illicit commodity economies with modern digital financial infrastructure.

Two parallel revenue pipelines illustrate this model:

• The Venezuela–Hezbollah gold pipeline, where illicit gold extraction is monetized and converted into cryptocurrency before being redistributed through Hezbollah-linked financial networks.
• The Iranian oil-revenue pipeline, where proceeds from sanctioned oil sales are laundered through intermediaries and partially converted into digital assets linked to IRGC-associated financial systems.

Although these pipelines originate from different sectors, they share a common structural logic. Both rely on multi-jurisdictional intermediaries, informal financial mechanisms, and the conversion of physical commodities into portable digital value.

Within this framework, cryptocurrency functions as a critical transport layer, enabling sanctioned actors to move funds across borders while reducing reliance on the formal banking system.

The convergence of illicit commodity markets, transnational criminal networks, and emerging financial technologies underscores a key challenge: the effectiveness of sanctions will depend not only on their scope but on the ability to identify and disrupt the financial infrastructures that enable evasion.

Without addressing the intersection of illicit trade, sanctions-evasion networks, and cryptocurrency systems, sanctions are likely to remain a persistent — but ultimately limited — tool in constraining Iran’s proxy financial capabilities.