That solves the literal "how to pay" but so does an envelope full of cash via FedEx. That's not the actual complicated part of legally paying someone for contract work in a foreign possibly-hostile nation.

In the early days Meta (Facebook back then) used to pay bounties by physically mailing pre-paid debit cards, so you are not far off with the idea of envelopes full of cash.

I'm pretty sure the legal way to pay someone in a sanctioned country is: you can't. Full stop. Especially not for hacking services.

I'm not actually sure how HackerOne skirts around this.

Accountability firewalls, probably. They won't pay a sanctioned country, but they'll turn a blind enough eye to anyone who says they're from a different one.