Bitcoin and permissionless cryptoasset networks

Bitcoin and permissionless cryptoasset networks can transfer native digital assets without a central account operator. State and non-state actors can use those rails, while governments act through sanctions, law enforcement, virtual-asset service providers and other perimeter controls. The protocol, native asset, custodian, exchange, bridge, mixer and stablecoin issuer are different objects and must be analysed separately.

Network structure and control points

Bitcoin combines cryptographic keys, public transaction records, peer-to-peer propagation and proof-of-work block production. It has no central protocol administrator able to freeze a balance by ordinary administrative instruction. That does not mean every transaction is guaranteed access or inclusion. Users, peers, miners, mining pools, wallet software, custodians and exchanges can reject, delay, decline or fail to relay a transaction in different circumstances.

Permissionless participation is not anonymity. Addresses and transactions are public, but attribution depends on clustering methods, off-chain records, user error, service-provider cooperation and access to devices or keys. Custodial balances are claims on an intermediary, not native protocol balances. Centralised stablecoins can include issuer-administered freezing and should not be used as evidence of Bitcoin protocol control.

Direct state nexus

The strongest documented state nexus is the Democratic People's Republic of Korea's attributed cyber theft and laundering. On 26 February 2025 the Federal Bureau of Investigation attributed the theft of approximately USD 1.5 billion in virtual assets from the Bybit exchange to DPRK TraderTraitor actors. The FBI said the actors converted some stolen assets into Bitcoin and other virtual assets dispersed across multiple blockchains. The event was not a compromise of the Bitcoin protocol.

The Multilateral Sanctions Monitoring Team's 2025 report covers January 2024 to September 2025 and uses participating-state analysis with private analytics support. It connects specified DPRK cyber and information-technology-worker activity to sanctions evasion and revenue generation. Attribution should preserve the report's method and confidence rather than treating every North Korea-linked address as a direct government operation.

Countermeasures and evidential limits

Governments and regulated intermediaries can act at exchanges, custodians, bridges, mixers, wallet interfaces and fiat off-ramps. Address designation, service delisting, criminal charge, conviction, civil forfeiture and technical seizure are different actions. The United States Treasury removed Tornado Cash sanctions on 21 March 2025, so the earlier designation is not current.

The Financial Action Task Force and Financial Stability Board set international expectations for virtual-asset activities and service providers. The European Union's Markets in Crypto-assets Regulation distinguishes issuers, asset-referenced tokens, e-money tokens and service providers. These frameworks regulate actors around networks rather than giving a government direct administrative control over Bitcoin balances.

Private estimates of illicit activity require a provider, method, covered assets, period, denominator and valuation date. A low estimated illicit share and a large absolute value can coexist. FinCEN's ransomware figures derive from Bank Secrecy Act reports and are not a complete global census. No source supports the claim that all ransomware uses cryptoassets or that all cryptoasset activity is illicit.

This record remains in the main sequence because official multilateral and United States records establish specified DPRK state-linked use, while countermeasures operate through traceable service and custody control points.

See also

North Korean cryptocurrency theft campaign (2017-present) · Lazarus Group · Blockchain analytics platforms (Chainalysis, Elliptic, TRM) · Crypto exchanges as chokepoints (fiat on/off-ramps) · Issuer-controlled dollar stablecoins (USDT and USDC) · Cryptocurrency mixers and tumblers (Tornado Cash, Blender.io)

Sources

• Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008).
• Federal Bureau of Investigation, "North Korea Responsible for USD 1.5 Billion Bybit Hack" (26 February 2025).
• Multilateral Sanctions Monitoring Team, The DPRK's Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities, MSMT/2025/2 (2025).
• Financial Action Task Force, Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (26 June 2025).
• United States Department of the Treasury, "Tornado Cash Delisting" (21 March 2025).
• United States Departments of State, Treasury, Homeland Security and Justice, Guidance on the North Korean Cyber Threat (15 April 2020).
• United States Financial Crimes Enforcement Network, Ransomware Trends in Bank Secrecy Act Data Between 2022 and 2024 (4 December 2025).
• United States Department of Justice, "Two Arrested for Alleged Conspiracy to Launder USD 4.5 Billion in Stolen Cryptocurrency" (8 February 2022).
• European Parliament and Council, Regulation (EU) 2023/1114 on markets in crypto-assets (31 May 2023).
• Sarah Meiklejohn and others, "A Fistful of Bitcoins: Characterizing Payments Among Men with No Names," Internet Measurement Conference 2013, 127-140.
• Sean Foley, Jonathan R. Karlsen and Talis J. Putnins, "Sex, Drugs, and Bitcoin: How Much Illegal Activity Is Financed through Cryptocurrencies?," Review of Financial Studies 32, no. 5 (2019), 1798-1853.
• Bank for International Settlements, The crypto ecosystem: key elements and risks, report submitted to the G20 (July 2023).
• Financial Stability Board, Global Regulatory Framework for Crypto-asset Activities (17 July 2023).