The number that should have stopped the wire services cold was the one almost none of them printed. When the presidential decree appeared in the final days of September 2025, every dispatch led with the same two figures — an authorized establishment of 2,441,630 personnel, of whom 1,550,500 are designated serving military — and every headline treated the new ceiling as the milestone. The figures were repeated with martial precision, the context of a fourth expansion since the invasion appended, and the story filed.
What almost no one did was subtract. The subtraction is 50,500. That is the entire net addition to Russia's uniformed strength in this decree, and it is less than a third of the increments that preceded it — roughly 169,000 in the 2023 expansion, roughly 180,000 in 2024. A record-high ceiling, approached by the smallest step in three years. The headline and the arithmetic point in opposite directions, and it is the arithmetic, not the headline, that tells you where this war is actually going.
I learned to trust subtractions over headlines in a much smaller room. In 2018, half-consumed by the ICO mania, I volunteered three months of my life to auditing the smart contracts of a fledgling DeFi prototype called EtherTrust. The marketing site promised "trustless, guaranteed" donation flows. The code promised something else — a reentrancy window in the donation logic, small enough that the team's own test suite never tripped it, and wide enough that a patient attacker could have drained an estimated $200,000 in a single afternoon. The fix took four days. The realization took longer: that a system's self-description and its actual behavior are two different documents, and that the difference between them is where all the danger lives. I spent nights in silence after that, reading the moral architecture of a contract rather than its gas efficiency. The same discipline applies to a decree. A presidency's description of its own military and the military's deployable strength are two different documents. The gap between them is not cynicism; it is where analysis begins.
Context: what an establishment number actually is
Let me be precise about the figures, because imprecision is where the propaganda both lives and hides.
The 2,441,630 number is an establishment ceiling — an authorized strength written into law, the paper size of the armed forces as an institution. The 1,550,500 figure is the subset of that establishment classified as military personnel. The difference — roughly 891,000 human beings — is civilians: logistics staff, ministry bureaucracy, academies, hospitals, construction brigades, and the vast administrative tail that every large military drags behind it. Reading 2.44 million as soldiers is a category error of nearly a million people. Reading 1.55 million as front-line troops is a second error of comparable size, because it includes everyone from the general staff in Moscow to the conscript scrubbing a depot floor outside Krasnoyarsk.
The genuinely novel thing in this decree is not its headline number but its form. Previous expansions were also decrees, but this one folds the manpower appetite of an ongoing war into the permanent statutory baseline of the state. It converts a temporary emergency requirement into a standing institutional expectation — and in doing so, it raises the political cost of any future de-escalation, because shrinking a legal establishment back down becomes its own visible capitulation. The decree does not merely ask for more soldiers; it legislates the assumption that the confrontation is permanent. A ministry that has written a war-sized army into law has told its own future leadership, and the world, that it does not expect the war-sized problem to go away.
Now set that against the environment in which the decree must be financed and equipped. Russia operates under the broadest sanctions architecture ever assembled against a major economy. Its war economy nonetheless runs on a parallel supply chain that has matured over three years: Iranian-designed loitering munitions assembled domestically, North Korean artillery and shells moving by rail and sea, Chinese machine tools and dual-use electronics routed through third countries with accommodating customs regimes. None of this is secret. What is under-examined is where digital assets sit inside that chain — because the popular Western imagination places crypto at the center of sanctions evasion, while the forensic record places it, stubbornly and repeatedly, at the margin.
That gap between imagination and record is the real subject here. Before I can defend it, I have to map the rails.
Core: the four rails, and the one that is loudest and smallest
Value moves across a sanctioned border along four broad rails. Three of them are boring, and boring rails move nearly all the money.
The first is correspondent banking. Even under sanctions, the global financial plumbing leaks — through non-sanctioned banks in third countries, through trade-finance instruments, through the ordinary correspondent relationships that connect a bank in Almaty or Dubai to the dollar system. This rail is enormous, opaque in the aggregate, and almost impossible to police at the transaction level, because doing so would require the dollar system to interrogate itself.
The second is mirror trade and false invoicing. A shipment of machine tools is declared as agricultural equipment; an invoice is inflated or deflated to move value alongside the goods; an intermediary in a friendly jurisdiction takes a margin for its silence. This is not a cryptocurrency phenomenon. It is a trade-finance phenomenon, and it predates the blockchain by a century.
The third is physical: cash, gold, precious metals, and the courier networks that carry both. Gold has no counterparty, no ledger, and no transaction history that any regulator can subpoena.
The fourth rail — the loud one — is digital assets. And here is the forensic finding that the panic narrative keeps rediscovering and keeps forgetting: crypto is a real but modest slice of sanctions evasion, dwarfed by fiat correspondent channels and trade-based laundering. On-chain analytics firms have documented meaningful flows — hundreds of millions rather than hundreds of billions — tied to sanctioned entities, procurement networks, and ransomware. Meaningful is not the same as decisive. The decree I am analyzing will be financed in yuan, rupees, and dirhams against discounted crude, not in stablecoins. The war's balance sheet is not a blockchain.
Where crypto genuinely appears, it appears in four narrower places, and each is worth naming precisely.
It appears in procurement. Intermediaries buying dual-use components — optical systems, chips, precision parts — frequently need to pay small suppliers and freelancers who cannot or will not accept a sanctioned bank transfer. Stablecoins, most often dollar-denominated tokens moving on high-throughput chains, settle those micro-payments quickly. When I spent 2020 as a junior community liaison at a lending protocol called LendPool, I watched a permissionless system genuinely help people that traditional banks had refused — and I also watched the same rails, with no identity layer and no friction, become a convenience for exactly the kind of intermediary payment that sanctions are meant to stop. Both things were true at once, and the emotional exhaustion of holding that contradiction sent me to a cabin in the Alps for two weeks. I came back unwilling to describe permissionless finance as purely liberating or purely abusive. It is a rail. Rails carry what they carry.
It appears in paying individuals — recruiters, couriers, foreign fighters, fixers. These are small sums by state standards and enormous sums by personal ones. They move through informal escrow ecosystems that any observer of the Russian-language internet knows well: guarantor services that hold funds until both parties confirm delivery. Functionally, these are escrow smart contracts operated by humans who will adjudicate disputes for a fee. Annoyingly, this works.
It appears in remittances. Families separated by mobilization, borders, and currency controls use digital assets to move value to relatives in jurisdictions where opening a bank account is slow, expensive, or politically fraught. This is the least scandalous and most human use of the entire technology, and it is the one least discussed at security conferences.
And it appears in the extraction economy: ransomware, crypto-jacking, and the laundering chains that turn illicit proceeds into spendable funds. This is the part that generates the headlines, and it is also the part where blockchain's transparency cuts against the criminal rather than for them — a subject I will return to, because it is the crux of the contrarian case.
Set beside those four narrow uses stands the digital ruble, and it deserves its own paragraph, because it reveals the architecture that the state actually wants. A central bank digital currency is not crypto. It is the opposite of crypto. A CBDC is a ledger the issuer reads completely — where every transaction is visible to the state by design, where programmability can be used to restrict where money may be spent and when, and where the boundary between surveillance and monetary policy dissolves. The digital ruble pilot has been framed as a response to sanctions and a route to settlement outside the dollar system. Yes, and it is also the most efficient instrument of financial visibility ever proposed by a sovereign. One rail exists to hide value from the state; the other exists to show the state everything. They are not cousins. They are opposites. I have said this before and I will keep saying it: a CBDC and a privacy-preserving cryptocurrency cannot coexist as equals within the same monetary space, because the second one is defined by what it refuses to show the first.
Bitcoin occupies a strange place in this map. It is the asset most often invoked in sanctions discourse and the one least suited to moving sovereign-scale value. Here I have to be honest about an unpopular conclusion I reached the hard way. The Lightning Network — the second-layer system meant to make Bitcoin usable for everyday payments — has been, for seven years, a beautiful partial failure. Routing failures are common at precisely the moments you need reliability. Inbound liquidity is a persistent chore. Channel management demands a level of operational discipline that ordinary users, let alone a state treasury, will not sustain. To move meaningful volume reliably, you end up trusting custodial hubs — which are exactly the regulated, identity-checked institutions from which an evading entity is trying to escape. Lightning solved a problem it turned out almost no one needed solved at scale, and the market quietly routed around it. The practical result is that Bitcoin functions in this conflict as a store of value and a political statement far more than as a settlement rail. That is not a failure of Bitcoin. It is a failure of the story we told about it.
So where does that leave the forensic layer? Here I have to return to the discipline I learned from auditing. In 2021, amid the NFT frenzy, I spent weeks tracing the on-chain metadata of a prominent generative art project, CryptoSculptures, and found that its promise of permanent, decentralized ownership rested on metadata stored on centralized servers — servers that could vanish, be seized, or simply expire. The exposé went further than I expected, and the backlash was severe enough that some accused me of killing the culture. A small number of developers thanked me. The lesson was not that decentralization is a lie. It was that the gap between the promise and the plumbing is always where the truth is, and that this gap is precisely what on-chain forensics can now measure.
Applied to sanctions, that insight reverses the popular fear. Blockchain analytics is one of the few genuinely effective tools the West has developed against illicit finance, precisely because the ledger is public. A supervised chain is a confession waiting to be read; a cash courier is not. The sanctioned state knows this, which is why its major flows avoid transparent rails and why its crypto exposure concentrates in the places where traceability is hardest — mixers, bridges, and chains with thin compliance. The narrative that crypto is a sanctions-busting superweapon has it almost exactly backwards. The more transparent the chain, the more it helps the investigator. The state's real advantage has never been cryptography. It has been the boring opacity of correspondent banking and the ambiguity of trade invoices.
And under all of this sits the human layer that the numbers erase. The 891,000-person gap between establishment and serving military is not a rounding error; it is a workforce, a bureaucracy, and a supply chain made of people. The 50,500 net addition is not a spike; it is the marginal signal of a system testing its own ceiling. Behind every increment are conscription offices, incentive payments, exemptions bought and sold, and families deciding whether a son is better used at the front or in a hospital. In a mobilization economy, identity itself becomes contested — who is eligible, who is exempt, who is real. AI-generated mobilization notices and synthetic casualty reports have already begun to blur what citizens can trust, a problem I confronted directly when I helped launch a protocol called SynthVoice in 2026 and wrote a manifesto arguing that, in an age of synthetic media, cryptographic identity is the last bastion of human authenticity. I called it the Proof of Soul. It was not a marketing slogan. It was a statement that a verifiable human identity, anchored to something a machine cannot forge, may become the most politically consequential primitive of the next decade.
The contrarian angle: the reflex that punishes the wrong people
Now the counter-intuitive part, and I want to argue it carefully rather than provocatively.
Yes, sanctions evasion through digital assets is real, and yes, it should be policed. And here is the problem with the policing reflex as currently practiced: the Western response to the crypto-evasion narrative has been to demand more surveillance, more identity verification, more de-banking, and — increasingly — its own central bank digital currencies. Each of these instruments lands hardest not on the sanctioned state, but on the individual at the margins. It lands on the refugee who cannot open an account. On the dissident whose wallet is frozen because it touched a tainted address three hops upstream. On the remittance sender whose family waits a week for a transfer that used to take an hour. On the teenager in Milan who is learning, for the first time, that money can work without permission — a lesson I have watched transform how young people think about their own agency.
Meanwhile the sanctioned state's largest flows — discounted crude settled in dirhams and yuan, dual-use components routed through tolerant customs regimes, gold in a courier's bag — sit almost entirely outside the architecture we keep building. We are hardening the rail that carries the least value and leaving the rails that carry the most exactly as they were, and we are congratulating ourselves for the hardening. That is not a strategy. It is a habit.
There is a second misreading embedded in the panic, and it concerns whom crypto actually serves at scale. The technology was never designed to move a sovereign treasury's war budget. It was designed — imperfectly, but genuinely — to let an individual hold value without asking anyone's permission. When that design fails to become the sanctions-busting superweapon, the failure is not evidence of weakness. It is evidence that the tool remained, stubbornly, what it was built to be: personal infrastructure, not state infrastructure. Crypto was never the escape hatch for a mobilization economy. It was the escape hatch for an individual inside one. Confusing the two is not a technical mistake; it is a moral one, because it justifies building a surveillance apparatus to solve a problem the technology does not actually pose.
Takeaway: the increments will keep narrowing
So watch the subtractions, not the ceilings. If the next expansion arrives with an increment smaller than 50,500 — or with a negative sign, which would be a first — the constraint will have moved decisively from equipment to people, and the war's arithmetic will have begun to speak louder than any decree. If the increment jumps sharply, the parallel supply chain has matured past another threshold, and the sanctions architecture has lost ground it will not easily regain.
Either way, the surveillance built in the name of stopping a flow that never dominated the ledger will outlive the emergency that justified it. The real question is not whether the establishment reaches 2.5 million people on paper. It is whether the conscript, the remittance sender, and the dissident still hold a ledger no ministry can read — and whether we will have the clarity to defend that ledger while the numbers above it keep climbing.
