Breaking the Crowdfunding Myth: The Digital Architecture Funding Iran’s Proxy Wars
Far from simply fundraising donations, Iran and its proxies are operating exchange networks and blockchain pipelines embedded in the financial architecture of the regime’s Resistance Economy.
For years, Iran’s use of cryptocurrency was written off as pocket-change militant fundraising. A slew of enforcement actions now shows something far more consequential: Tehran and its terror allies have woven digital assets into the core financial architecture that bankrolls their war machines.
By integrating crypto into their control of currency exchange houses and shadow-banking networks, Tehran and its proxies are turning cryptocurrency into a scalable tool for sanctions evasion, state revenue mobilization, and terror-group financing, not simply using it for crowdfunding.
Sanctions designations, law-enforcement seizures and crypto analysis show that Iran and its proxies are leveraging these currency exchanges as crypto brokers, custodians, and conversion hubs. Networks of digital financial hubs allow Iran and its associated terror groups to operate a hybrid financial pipeline capable of moving state revenue and militant financing through mechanisms designed for obscurity, volume, and resilience.
The digital ledger of blockchain allows transactions to be traced along an immutable arc of financial provenance. But while U.S. crypto platforms are increasingly held to the same know-your-customer requirements as banks—fostering financial transparency—anonymity on foreign platforms provides cover for illicit transactions.
The emerging architecture represents a strategic evolution of Iran’s long-standing sanctions-evasion model rather than a departure from it. For decades, Tehran and its proxies—notably Hezbollah and Hamas—relied on regional exchange houses, front companies, and commodity brokers to move oil revenue and fund militant groups to sidestep Western banking controls.
The stakes have sharpened dramatically as the United States and Iran now confront each other in direct military conflict, turning what once was presented as peripheral financial maneuvering into strategic battlefield infrastructure. Such risks are underscored by Iran’s Ministry of Defense Export Center adding cryptocurrency to the options buyers can use to pay for missiles, drones and other advanced military-grade weaponry.
In the immediate aftermath of the Oct. 7, 2023 Hamas attack on Israel, much of the crypto industry moved quickly to downplay the role of digital currency in terrorist finance, framing militant use primarily as small-dollar crowdfunding. Industry advocates—worried that high-value estimates could fuel a regulatory crackdown—argued that reported transfers to terror groups through crypto channels were overstated.
As several of the digital wallets seized by Israeli authorities appeared linked to money-service businesses, based on transaction patterns and heavy trading volume, many in the crypto industry dismissed those transaction levels as indicative of terror funding.
That analysis rested on a critical assumption: that Iran and its proxies were not using those exchange intermediaries as financial hubs for large-scale fund movements. That view ignored the fact that exchange houses are part of the core architecture that Iran and its proxies have used for decades to move billions of dollars in sanctioned oil trade, pay for arms shipments, and finance their military and terror activity across the globe.
Seizures, sanctions, and blockchain tracing—both before the Oct. 7, 2023 attack and through to last month—challenge that view. Instead, they reveal a financial strategy resembling Tehran’s traditional sanctions-evasion playbook—one that has helped the regime withstand one of the most comprehensive financial pressure campaigns in modern history.
Instead of relying solely on fiat currency or gold, Iran is controlling and leveraging money-service businesses operating in the crypto realm—transforming digital liquidity into the same shadow capital that has long financed the so-called Resistance Economy and its regional proxy terror networks.
In January, for example, blockchain analysis firm TRM Labs reported the discovery of two U.K.-based front companies, Zedcex and Zedxion, that it said processed around $1 billion through crypto wallets linked by Israeli authorities last year to the Islamic Revolutionary Guard Corps, the terror-designated militia that oversees Iran’s banned weapons programs and directs and finances Hezbollah, Hamas, the Houthis, and other terrorist proxies.
TRM said the blockchain ledger—the permanent digital record of crypto transactions—shows that the Zedcex/IRGC wallets functioned as “operational exchange infrastructure,” including routing funds to offshore intermediaries and domestic Iranian crypto services such as Nobitex, Wallex, and Aban Tether.
“It illustrates a more mature risk: a sanctioned military organization operating exchange-branded crypto infrastructure offshore, embedded directly in global stablecoin markets, moving value persistently and at scale,” TRM said. “This is not episodic abuse of crypto rails; it is infrastructure-level control.”
U.K. corporate records tie the front companies’ activities to Babak Morteza Zanjani, an Iranian businessman sanctioned by Western powers more than a decade ago for his role in helping Iran’s government sidestep oil sanctions. “His direct connection to the corporate trail behind Zedcex underscores that this activity is not opportunistic crypto abuse, but the continuation of a well-established state-aligned financial network adapting to new rails,” said TRM.
The U.S. Treasury Department in late January sanctioned the exchanges, saying Zedcex alone had processed over $94 billion in transactions since its inception in August 2022. In a separate U.S. civil case filed last March, blockchain tracing tied nearly $350,000 in stolen crypto assets to wallets at Zedxion—allegations that underscore how the exchange infrastructure has been used to custody and move illicit funds.
One of the clearest windows into Iran’s growing crypto architecture came in June 2025, when hackers breached Nobitex, the country’s largest cryptocurrency exchange, exposing source code and internal infrastructure that blockchain analysts say revealed far more than simply retail trading activity. Forensic analysis of the breach showed an exchange engineered to operate in defiance of sanctions, surveillance, and regulatory oversight that was deeply integrated into Iran’s domestic fiat payment ecosystem.
“The exchange’s large inflows and connections to other sanctioned and illicit actors, both within and beyond Iran, underscore its significance in facilitating state-linked sanctions evasion,” Jonathan Levin, Chainalysis’s chief executive, told the Senate banking committee last July.
Chainalysis, one of the firms that initially characterized Iranian proxy financing through crypto as crowdfunding, now recognizes that Iran has a crypto ecosystem worth billions of dollars.
“Particularly noteworthy is the IRGC’s growing dominance within Iran’s cryptocurrency landscape,” the firm says. “These addresses include not only IRGC operatives working in Iran, but also facilitators in numerous countries and networks that move commodities and illicit oil, launder money, transfer funds and arms to Iran’s web of regional militia proxies, and help Iran evade sanctions.”
Late last year, the U.S. Treasury Department sanctioned two Iranians it said facilitated the purchase of over $100 million worth of cryptocurrency for oil sales for Tehran. Those figures only represented a fraction of the $600 million in total inflows their sanctioned crypto addresses handled, however.
Notably, one of the ways Zedcex markets its products is as a crude-oil linked cryptocurrency. Referencing oil prices positions digital assets as synthetic proxies, enabling oil revenue to move outside traditional banking channels through crypto platforms.
Separately, Treasury said the two Iranian businessmen also worked with an Iranian currency exchanger who did business for Iran’s Ministry of Defense and Armed Forces Logistics. They also dealt with Al-Qatirji Company, a Syrian conglomerate responsible for generating hundreds of millions of dollars in revenue for the IRGC’s Qods Force—the group that orchestrates, funds, and supplies Hezbollah and Tehran’s other terror proxies—and the Houthis.
U.S. officials said one of the Iranian businessmen was also involved in transactions worth millions of dollars with Tawfiq Muhammad Sa’id al-Law, another money changer who provided Hezbollah with access to digital wallets in order to receive funds related to Quds Force commodity sales, and who conducted cryptocurrency transfers on behalf of the Al-Qatirji Company.
Al-Law has similarly conducted cryptocurrency transfers for other sanctioned Hezbollah officials, Treasury said, including Muhammad Ja’far Qasir and Muhammad Qasim al-Bazzal, and has provided financial services to a senior Houthi financial official, Sa’id al-Jamal and his network. Treasury accompanied its sanctioning of al-Jamal last April with the designation of eight digital asset wallets that it said were used by the Houthis to transfer funds for its war machine and that Chainalysis determined to have moved $1 billion in illicit funds.
Those crypto-linked financial networks extend across the globe, into China, Russia, and Latin America. Argentinian authorities, for example, last year arrested four individuals they said were suspected of financing Hezbollah through crypto, linking them to $1.8 million in transactions through one of Al-Law’s seized wallets. Western analysts last year tied a top Hezbollah operative in Latin America to a Venezuela-based crypto financial firm BCI Technologies.
“BCI’s operations reflect a broader trend: the use of local crypto firms in sanctioned or economically unstable jurisdictions to build informal financial architecture that supports illicit actors,” said illicit-finance analyst Adam Rousselle in a recent Global Network on Extremism & Technology post. “These firms often operate through OTC brokers, cash-to-crypto networks, and anonymous wallets—tools that provide the discretion and deniability militant-linked facilitators require.”
Analysts now say they’ve seen Iranian crypto flows totaling more than $11 billion, with IRGC-affiliated flows hitting more than $3 billion last year based solely on the crypto addresses targeted by U.S. and Israeli authorities. Those figures represent sizable chunks of Iran’s total exports, which totaled around $59 billion in the first six months of the year.
“Importantly, even these extraordinary figures are a lower-bound estimate,” Chainalysis said last month. “We expect this figure will increase as more IRGC-affiliated wallets are publicly disclosed, and larger parts of their laundering network are exposed.”
#FlipFlopDownTheRabbitHole
#FlipFlopDownTheRabbitHole