The regime stole at least $2.8 billion in virtual assets between January 2024 and September 2025, funds the paper says are assumed to support its weapons programme. Authors Allison Owen and Noémi També focus on the point where that money turns into cash, rather than the well-documented journey through decentralised services.
That overlap is the problem the paper puts to compliance teams, because once the regime's proceeds enter criminal ecosystems the markers of proliferation finance become hard to separate from ordinary laundering.
Mules and small amountsThe accounts doing the cashing out usually belong to someone else, with mules recruited mainly in the Philippines, Indonesia and China, where credentials sell cheaply enough to buy in bulk and open accounts at scale. Interviewees said mules told whom they are actually working for generally want no further part in it.
Conversion happens in small pieces, with actors selling roughly $7,000 of stablecoins at a time on peer-to-peer marketplaces, under the thresholds that trigger bank review, while ZeroShadow found larger sums broken into $30,000 chunks so that a freeze "would not be overly impactful." Behaviour at the exchange itself offers further signals, from Astrill VPN logins to the 50 to 70 support tickets launderers now file to get a single held transaction released.
Reaching cashFiat rarely arrives by simple bank transfer, with proceeds from over-the-counter brokers often deposited into North Korean-controlled accounts using UnionPay cards issued by Chinese banks. The paper lists 19 Chinese banks that the Multilateral Sanctions Monitoring Team identified last year as used by the regime and its proxies.
Of the roughly $1.5 billion taken from Bybit, 95% moved through decentralised services, and the monitoring team reported that all of it had been converted into fiat or hard currency by September 2025.
The authors call for regulatory guidance on correspondent relationships between exchanges, standardised onboarding questionnaires, secure intelligence-sharing channels, and a VASP identifier in payment messages so receiving banks can spot them.
