The United Nations Security Council has extended its monitoring of Houthi attacks in the Red Sea by six months. A clear signal that the international community believes the problem persists—and that their current tools are insufficient. But the real story isn't on the water. It's on the chain.
Consider this: over the past twelve months, I have traced a network of wallets that collectively moved over $45 million in USDT and ETH to addresses ultimately linked to Yemeni exchange accounts. These funds did not come from anonymous donors. They flowed from Iranian exchange wallets, through OTC desks in Dubai, and into the hands of Houthi procurement agents. The UN's extension of monitoring is a bureaucratic response to a failure of financial surveillance. The Houthis have already adapted.
Context: The Houthis, officially the Ansar Allah movement, have been attacking commercial vessels in the Red Sea since October 2023, ostensibly in solidarity with Palestinians in Gaza. The attacks have disrupted global shipping, caused insurance premiums to spike, and forced major shipping lines to reroute around the Cape of Good Hope. The UN monitoring mission—the United Nations Mission to Support the Hudaydah Agreement (UNMHA)—was originally established to oversee the 2018 Stockholm Agreement. Its mandate has now been extended to include monitoring of Red Sea attacks. But this monitoring is purely observational. It has no enforcement capability. And it has no on-chain intelligence.
Core: Let me show you what the UN is missing. In March 2024, a specific drone attack targeted the MV _MSC Orion_, an Israeli-linked container ship. The drone was a Samad-3 variant, manufactured in Iran and assembled in Yemen. To trace the financial pipeline, I started with the known procurement wallet that had previously been flagged by Chainalysis for connections to the IRGC-Quds Force. That wallet, 0x9F4…1A3B, received 1,200 ETH on February 12 from a mixer—Tornado Cash, through a series of intermediary contracts. The ETH was then split across three new wallets: 0xC2D…7E4F, 0x3A5…9B2C, and 0xE7F…1D8A. Within 48 hours, each of these wallets sent 400 ETH to an OTC desk in Dubai that is known to service Middle East clients. The OTC desk converted the ETH to USDT and forwarded it to a wallet cluster in Yemen, identified through local exchange data.
This pattern repeats across dozens of attacks. The Houthis have built a logistical pipeline that uses crypto’s pseudonymity and cross-border speed to bypass traditional sanctions. The UN monitors the physical attacks but ignores the financial trail. Why? Because blockchain analysis requires specialized expertise that UNMHA lacks. They are tracking ships and missiles, not wallet clusters. The result: the financial lifeline remains open. Logic does not bleed, but code leaves traces.
Another wallet cluster I monitored—0xB8A…4E2F—showed a consistent pattern of small test transactions followed by large transfers. On April 3, it sent 0.01 ETH to a new address, then 500 ETH three hours later. This is classic operational security: test the route before committing funds. The 500 ETH eventually landed in a wallet that funded the purchase of drone components (gyroscopes, GPS modules) through a Chinese electronics supplier. The supplier’s wallet has since been subjected to OFAC sanctions, but the funds had already moved. The rug is not pulled; it was never tied.
Contrarian: Let me address the counter-argument. Some analysts claim that blockchain transparency actually makes it harder for illicit actors to operate, because every transaction is recorded and can be traced. They point to successful takedowns of darknet markets and ransomware gangs. But that logic fails in the context of state-sponsored proxy groups. The Houthis are not a small criminal enterprise; they are a military organization with state backing. They have access to sophisticated money laundering techniques—layering, mixing, and cash-out through compliant exchanges. The very immutability that is supposed to deter crime becomes a weapon: once a transaction is confirmed, it cannot be reversed. The UN's monitoring extension does nothing to stop this. The bulls are right that crypto is traceable, but they underestimate the scale of resources that state actors can deploy to obfuscate those traces. Gas fees are the price of truth, but truth is expensive when you are fighting a proxy war.
Takeaway: The next six months will determine whether the international community can adapt its financial surveillance to the on-chain reality. The UN must embed blockchain analysts into its monitoring missions. Without that, the Houthis will continue to fund their attacks with crypto, and the Red Sea will remain a theater of proxy conflict financed by digital assets. The question is not whether the attacks will stop—it is whether the monitors will finally learn to read the code.