Stablecoins increasingly favoured for money laundering, financing of terrorism and proliferation: FATF report

FATF report highlights rising use of stablecoins in money laundering and terrorism financing by state-linked actors.

The Financial Action Task Force (FATF), in its latest report, has said that stablecoins are increasingly being favoured for illegal activities, including money laundering and terror financing, with indications that state-linked actors in Iran and North Korea are also using them for operations such as proliferation financing and weapons procurement.

Stablecoins are a type of cryptocurrency designed to keep their prices stable, usually by linking them to another asset such as a fiat currency or gold.

“Notwithstanding the FATF’s framework, stablecoins are exposed to heightened ML (Money Laundering)/TF (Terrorist Financing)/PF (Proliferation Financing) risks when transferred on a P2P (peer-to-peer) basis via unhosted wallets. These vulnerabilities are exacerbated by their characteristics such as the price stability and ample liquidity...,” noted the “Targeted Report on Stablecoins and Unhosted Wallets”.

“State-linked cybercriminal groups have rapidly adopted stablecoins as a preferred method for laundering proceeds from ransomware, phishing, and other cyber-enabled crimes. Most notably, (North Korea) DPRK’s Lazarus Group, Andariel, and Onyx Sleet specialise in virtual asset theft, espionage, and disruptive attacks, like ransomware,” it said, adding that groups like Lazarus have used malware and social engineering to infiltrate virtual asset firms to steal funds, including a nearly $1.46 billion theft in February 2025.

According to the Multilateral Sanctions Monitoring Team, since at least 2023, “the DPRK’s 221 General Bureau” has sought to expand the use of stablecoins beyond cyber-enabled financial crime to include their use as a means of exchange and payment for goods and services prohibited under the United Nations Security Council resolutions.

“In particular, DPRK entities have been assessed to use Tether (USDT) in transactions involving the sale and transfer of military equipment and raw materials...this activity indicates an apparent effort by DPRK entities to operationalise the use of stablecoins in WMD-related procurement activities,” said the report.