On this page
Cryptocurrency was born from a cypherpunk philosophy of individual sovereignty — money outside state control. But nation-states have not been passive observers. They hack it (North Korea), adopt it (El Salvador), sanction it (US vs. Tornado Cash), evade sanctions with it (Russia, Iran), and build their own versions of it (CBDCs). The relationship between crypto and nation-states is one of the defining geopolitical stories of our time — and it's just beginning.
North Korea: crypto as a state revenue stream
, North Korea's state-sponsored hacking unit, has become one of the most prolific crypto thieves in the world. By the mid-2020s, UN sanctions monitors and industry researchers estimated that North Korea had stolen $3–5 billion in cryptocurrency since 2017 — a cumulative total that the record Bybit theft of February 2025 pushed higher still — funding a significant fraction of the country's nuclear and ballistic missile programs.
Notable North Korean crypto hacks include:
- Ronin Bridge (2022): $625M — at the time the largest crypto theft ever, carried out via social engineering of an Axie Infinity engineer. The record now also belongs to North Korea: the February 2025 Bybit hack, worth an estimated $1.4–1.5 billion, is the largest cryptocurrency theft to date. See the Bridge Hacks deep dive.
- Harmony Bridge (2022): $100M.
- KuCoin exchange (2020): $281M.
- WannaCry ransomware (2017): Bitcoin ransom demands.
North Korea's approach is sophisticated: it trains elite hackers at universities like the Kim Chaek University of Technology, deploys them to steal crypto from exchanges and DeFi protocols, and launders the proceeds through mixers (including Tornado Cash, before it was sanctioned) and chain-hopping bridges. The stolen crypto is converted to fiat through OTC brokers, primarily in China.
El Salvador: the first Bitcoin nation
In September 2021, became the first country to adopt Bitcoin as legal tender, under President Nayib Bukele. The “Ley Bitcoin” required all businesses to accept Bitcoin for goods and services where technologically feasible. The government:
- Launched the Chivo wallet, a state-run custodial Bitcoin wallet.
- Gave every citizen $30 in Bitcoin as a signup bonus.
- Began purchasing Bitcoin at the sovereign level — holding it as a reserve asset.
- Planned a “Bitcoin City” funded by Bitcoin-backed bonds (though this has been delayed).
The reception was mixed. Many Salvadorans found Bitcoin confusing or unnecessary and continued using dollars. The IMF opposed the move, warning of fiscal risks. Bukele's BTC purchases were underwater during the 2022 bear market but turned profitable when Bitcoin rose in 2023–2024. And in January 2025, as part of a loan arrangement with the IMF, the law was substantially rescinded: Bitcoin remains legal tender, but businesses are no longer required to accept it. The long-term impact on El Salvador's economy remains uncertain, but the experiment is historically significant: the first time a nation-state adopted a cryptocurrency as official money.
The timeline
Tap any event to expand its story.
North Korea's state-sponsored hacking unit, the Lazarus Group, begins targeting cryptocurrency exchanges as a source of hard currency for the sanctioned regime. Over the following years, North Korean hackers would steal an estimated $3–5 billion in crypto by the mid-2020s — a total that February 2025's record Bybit theft would push higher still — funding a significant fraction of the country's weapons program.
El Salvador, under President Nayib Bukele, becomes the first country to adopt Bitcoin as legal tender. The "Ley Bitcoin" requires businesses to accept Bitcoin for goods and services — a mandate rolled back in January 2025, when the law was amended to make acceptance voluntary under El Salvador's IMF loan program. The government launches the Chivo wallet, gives every citizen $30 in Bitcoin, and begins purchasing BTC at the sovereign level.
The US Treasury's OFAC sanctions Tornado Cash, an Ethereum privacy protocol — making it illegal for US persons to interact with the protocol's smart contracts. This is the first time the US government has sanctioned a piece of open-source software, sparking a major debate about code as speech and the limits of sanctions authority.
As Western sanctions tighten on Russia after the invasion of Ukraine, Russia and Iran both explore crypto as a way to bypass the traditional financial system. Iran legalizes crypto mining for industrial use (with mixed results). Russia considers accepting Bitcoin for oil and gas exports. Neither fully implements crypto-based trade, but the exploration signals crypto's geopolitical relevance.
A group of Tornado Cash users, backed by Coinbase, files a lawsuit (Van Loon v. Department of the Treasury) challenging the OFAC sanctions; civil-liberties groups including the Electronic Frontier Foundation file amicus briefs in support rather than joining as co-counsel. In November 2024, a US appeals court rules that OFAC exceeded its authority by sanctioning immutable smart contracts — a major victory for the "code is speech" argument. In March 2025, Treasury removes Tornado Cash from the sanctions list. The case establishes that not all software can be sanctioned as if it were a person or entity.
Over 130 countries are exploring CBDCs (Central Bank Digital Currencies). China's e-CNY is the largest live deployment. The EU's digital euro is in preparation. In January 2025, the US moves from uncommitted research to prohibition: an executive order (EO 14178) bans the establishment of a US CBDC. The split between state-issued digital money and permissionless digital money becomes clearer.
Tornado Cash: sanctions meet code as speech
In August 2022, the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned — an Ethereum privacy protocol that used zero-knowledge proofs to break the link between sender and recipient. The sanction made it illegal for US persons to interact with Tornado Cash's smart contracts.
The sanction was unprecedented: Tornado Cash is not a person or a company — it's open-source software running on Ethereum. It has no operator, no bank account, no jurisdiction. OFAC argued that because Lazarus Group had used Tornado Cash to launder stolen crypto, the protocol itself was a sanctioned entity. Critics argued that sanctioning software is sanctioning speech — code is expression, and making it illegal to interact with specific smart contracts is censorship of mathematical operations.
In November 2024, a US appeals court ruled that OFAC exceeded its authority. The court held that immutable smart contracts (which no one controls) are not “property” that can be sanctioned under the International Emergency Economic Powers Act. The ruling was a major victory for the “code is speech” position, and in March 2025 the Treasury removed Tornado Cash from the sanctions list — but the broader tension between privacy tools and sanctions enforcement remains unresolved (the criminal case against developer Roman Storm, for example, continued).
Tornado Cash is a perfect microcosm of a fundamental tension in crypto: privacy tools are dual-use. They protect legitimate users (dissidents, people in oppressive regimes, ordinary people who don't want their finances public) and enable criminals (money launderers, state-sponsored hackers). The same technology that lets a Venezuelan dissident hide their crypto from the government lets North Korea launder stolen funds. There is no clean way to allow one and prevent the other — which is why this debate will persist. For the privacy side, see the Privacy Coins module.
Sanctions evasion: Russia and Iran
As Western sanctions tightened on Russia (after the 2022 invasion of Ukraine) and Iran (ongoing), both countries explored crypto as a way to bypass the traditional financial system:
- Iran legalized crypto mining for industrial use in 2019, requiring miners to sell to the central bank. The experiment had mixed results — illegal mining strained the power grid, and the regulatory framework was inconsistent.
- Russia considered accepting Bitcoin for oil and gas exports (to bypass SWIFT sanctions) and legalized crypto for cross-border payments in 2024. Full implementation is still nascent, but the direction is clear: sanctioned states see crypto as a potential lifeline.
The irony: the same censorship-resistant properties that make Bitcoin attractive to dissidents and individuals make it useful for sanctioned states. This is the inherent double-edged nature of permissionless money — it doesn't care who you are or why you want it.
CBDCs: the state's answer to crypto
While some nation-states adopt or fight crypto, others are building their own digital currencies: Central Bank Digital Currencies (CBDCs). A CBDC is a digital currency issued directly by a central bank — digital fiat, not cryptocurrency. Over 130 countries are exploring CBDCs as of 2024. Key examples:
- China (e-CNY): The largest live CBDC deployment. Piloted since 2020, used for billions in transactions. Centrally controlled and surveilled.
- EU (digital euro): In preparation, with a decision expected in 2025–2026.
- US: After years of research without commitment, prohibited the establishment of a US CBDC by executive order in January 2025 (EO 14178).
- India, Brazil, Nigeria, and others: Various stages of pilot and launch.
CBDCs and cryptocurrency represent fundamentally different visions of digital money:
- CBDC: Issued and controlled by the state. Programmable and centrally governed — features that can enable things like instant fiscal transfers, but also mean the issuer can freeze, censor, or time-limit balances.
- Cryptocurrency (Bitcoin, etc.): Issued by a decentralized protocol, designed so that no single party can freeze balances or inflate the supply (for Bitcoin). Supporters see that as censorship resistance; critics note it also means less recourse when something goes wrong.
The CBDC-vs-crypto split poses a genuine question about digital money: how much control should the issuer of money have? CBDCs and cryptocurrencies represent very different answers. For more, see the CBDC module.
Key takeaways
- Nation-states interact with crypto in four ways: hacking it (North Korea's Lazarus Group, an estimated $3–5B stolen to fund the regime by the mid-2020s), adopting it (El Salvador as legal tender), sanctioning it (US vs. Tornado Cash), and building alternatives (CBDCs).
- El Salvador (2021) was the first country to adopt Bitcoin as legal tender; under its IMF program, the law was amended in January 2025 to make acceptance by businesses voluntary. The experiment's long-term impact is uncertain, but it was historically significant — the first nation-state crypto adoption.
- The Tornado Cash sanction (2022) was the first US sanction of open-source software. A 2024 appeals court ruling found OFAC exceeded its authority, and the Treasury delisted the protocol in March 2025 — a major victory for “code is speech,” though the broader privacy-vs-compliance tension persists.
- Sanctioned states (Russia, Iran) are exploring crypto for sanctions evasion. This is the double-edged nature of permissionless money: it serves dissidents and sanctioned states alike.
- CBDCs are the state's answer to crypto: programmable, centrally controlled digital fiat. The CBDC-vs-crypto split is the sovereign-money question of our time — state-controlled digital money vs. permissionless digital money.