They fire missiles at Tel Aviv and drones at Red Sea shipping lanes. They receive weapons from Iran and materiel from Russia. And they pay for all of it, increasingly, in cryptocurrency, through a sophisticated financial network that has moved nearly a billion dollars while evading the global sanctions architecture designed to stop them.
A new report exposing the Houthis' crypto financing operation has shed light on one of the most significant illicit finance stories of the current conflict, revealing a terror group that has evolved from a militia to a functioning financial state, running its treasury on the blockchain.
The Network
The core of the Houthi crypto operation runs on a specific and deliberate combination: USDT, the Tether stablecoin, transacted on the TRON blockchain. The choice is not accidental. USDT on TRON is the world's most popular stablecoin by on-chain volume, offering dollar stability, deep liquidity, low transaction fees, and broad acceptance by brokers and exchanges worldwide, including in jurisdictions where oversight is weak or nonexistent.
Blockchain intelligence firm TRM Labs reported that eight crypto addresses linked to the Houthi group moved over $900 million in cryptocurrency to high-risk entities, with funds likely spent on weapons and other military equipment. Those eight addresses were the ones the U.S. Treasury's Office of Foreign Assets Control sanctioned in April 2025, but analysts have identified additional infrastructure extending well beyond those eight wallets.
Where the Money Comes From
The Houthis' crypto income streams are multiple and mutually reinforcing. The Islamic Republic of Iran provides direct financial and military support to the Houthis, with Iranian-linked transfers forming the backbone of the network. Transaction flows from the sanctioned addresses connect directly to addresses associated with OFAC-sanctioned Iran-based financier Sa'id al-Jamal, a senior Houthi financial official backed by Iran's Islamic Revolutionary Guard Corps-Qods Force.
Beyond Iranian transfers, the Houthis have diversified. The group has been mining crypto to generate revenue, with evidence showing activity dating back to 2017, including through crypto mining services that allowed them to mine using Yemen's internet service provider, YemenNet.
The Red Sea itself has become a revenue source. The Houthis have leveraged their control of Yemen's northwestern coastline into an extortion operation against global shipping, imposing what amount to protection fees on vessels transiting the area, with proceeds channeled into the same financial network. Iran has separately experimented with collecting maritime tolls in digital assets at the Strait of Hormuz, suggesting the model is spreading across the axis of resistance.
How the Money Moves
The mechanics of the network are designed to defeat conventional financial monitoring. Funds flow through rotating wallet addresses, making blockchain tracing time-consuming and resource-intensive. The Houthis rely heavily on over-the-counter services both in Yemen and abroad, using brokers who operate outside regulated exchange infrastructure to convert crypto into usable cash and commodities.
Ansarallah has two-hop indirect transactions with Huione Pay, a payments and foreign exchange business that is part of the illicit Huione Guarantee Group, a Cambodian conglomerate that facilitates scams and launders their profits. The connection illustrates how the Houthi financial network is not isolated but deeply integrated with the broader global criminal financial ecosystem, including Southeast Asian money-laundering infrastructure.
On-chain analysis shows heavy fund movement between Houthi wallets, previously sanctioned financier Sa'id al-Jamal, Russian intermediaries, and OFAC-sanctioned exchange Garantex, with mainstream exchanges receiving more than $200 million in cash-outs. Russia's role as both a weapons supplier and a financial intermediary for the Houthis represents one of the most underreported dimensions of the conflict.
The Wider Iran Proxy Picture
The Houthi network does not exist in isolation. It is part of a coordinated, Iran-directed financial architecture spanning multiple proxy groups. Iran's state-sponsored financial system finances a web of regional militia proxies, including Lebanese Hezbollah, Hamas, and the Houthis, facilitating the movement of commodities, illicit oil, and arms at scales not seen on the blockchain before.
TRM Labs found that the Houthi-linked network shows exposure to the IRGC, Hamas, and sanctioned entities, highlighting overlap with other high-risk financial networks. The same rails being used to fund drone strikes on Israeli cities are being used to fund Hezbollah operations in Lebanon and Hamas reconstruction in Gaza.
In 2025, illicit addresses received at least $154 billion in crypto, a 162% increase year-over-year, with the primary driver being a 694% increase in value received by sanctioned entities, totaling $104 billion throughout the year. Nearly all of it flowed through stablecoins, with USDT dominant.
The Enforcement Problem
Washington has been sanctioning wallets. The problem is that the network rebuilds faster than sanctions can be applied. Flows to and from high-risk and no-KYC services and decentralized services increased by over 200% even as flows through centralized exchanges decreased by nearly 30%, reflecting the network's ability to route around regulated infrastructure as it comes under pressure.
Tether has the technical ability to blacklist addresses, having done so for more than 2,100 addresses holding over $1.3 billion in USDT. But enforcement requires knowing which addresses to target, and the Houthis rotate them specifically to avoid identification.
The ceasefire negotiations currently underway in Switzerland, the Iran MOU, the diplomatic process being driven by the Trump administration, address none of this. The financial infrastructure that funds the drones and missiles will survive any diplomatic agreement unless it is specifically targeted. And right now, it is running at scale.
