OFAC Sanctions Crypto Addresses Associated with the Central Bank of Iran, Freezes USD 344 Million
Key takeaways
- OFAC designated two wallets associated with the Central Bank of Iran for the first time, with linkages to the IRGC-Qods Force and Hizballah
- Tether coordinated with OFAC and US law enforcement to freeze approximately USD 344.2 million across the two addresses
- The wallets received roughly USD 370 million across approximately 1,000 transactions since March 2021; one carries zero outbound transfers on record, the other moved less than USD 16 million out against more than USD 228 million in, according to TRM data
- Accumulation concluded largely by late 2023, after which both balances sat dormant until this week’s action — a profile consistent with sovereign reserve storage, not operational deployment
{{horizontal-line}}
OFAC targeting the Central Bank of Iran
OFAC designated two wallets as property of the Central Bank of Iran, with linkages to the IRGC-Qods Force and Hizballah. Tether coordinated with OFAC and US law enforcement to freeze approximately USD 344.2 million across the two addresses, according to their press release — the largest on-chain freeze of Iranian sovereign crypto reserves on public record.
The on-chain record
The two wallets collectively received approximately USD 370 million across nearly 1,000 transactions over more than five years, with inflows beginning in March 2021, according to TRM data. The behavioral profile of both addresses marks them as reserve infrastructure rather than operational wallets.
TRM analysis shows outbound activity across both addresses totaled roughly USD 25 million in USDT over their lifetimes — less than 7% of the volume received. One address moved approximately USD 9.7 million out against USD 141 million in. The other moved USD 15.7 million out against USD 229 million in. The outflows that did occur were almost entirely directed back into the same infrastructure: a single USD 8.6 million transfer moved directly between the two designated wallets in January 2022, and the largest outbound destination from the second wallet — approximately USD 11 million across four transfers in early 2023 — was another related address, not an exchange. Neither wallet shows outbound flows to identified exchange deposit addresses.
The bulk of accumulation concluded by late 2023, and from that point forward the balances sat largely undisturbed until this week's action. These addresses functioned as terminal repositories — accumulating funds, consolidating it between themselves, and holding it.
Iran’s broader crypto ecosystem
Today’s action is consistent with a pattern TRM has tracked across Iran’s crypto-enabled sanctions evasion for several years.
In January 2026, OFAC designated Zedcex and Zedxion — two UK-registered exchanges TRM identified and attributed prior to the action — as the first-ever OFAC designation of IRGC-linked digital asset exchange infrastructure. TRM’s on-chain analysis showed approximately USD 1 billion routed through that platform, with direct exposure to IRGC-controlled wallets, designated terrorist financiers, and Nobitex. As TRM documented ahead of that designation, the IRGC had embedded itself within exchange-branded stablecoin infrastructure, exploiting low transaction costs, high throughput, and widespread regional adoption to move value entirely outside the correspondent banking system.
TRM’s prior analysis of the Central Bank of Iran’s on-chain activity identified a repeatable institutional typology: large deposits, structured bridge-outs to Ethereum and Binance Smart Chain multisig custody, DeFi-based token transformation, fragmentation, and eventual routing toward centralized exchanges. The wallets designated today sit at the intake layer of a workflow whose downstream components TRM has documented separately.
TRM has also identified Nobitex as the central node connecting Iran’s domestic crypto economy with regime-linked actors, IRGC infrastructure, and designated terrorist financing networks. Iran’s crypto volumes measured USD 11.4 billion in 2024 and USD 10 billion in 2025, according to TRM’s analysis — sustained levels that reflect deep integration of crypto into the regime’s financial system.
Enforcement outlook
Today’s action has compliance implications beyond sanctions list matching. The designated wallets received funds through a settlement architecture extending across multiple platforms and intermediaries. Organizations with exposure to these flows should review counterparty and transaction-level exposure for indirect connections to the broader network to which these wallets belong. The designation also signals that sovereign-level actors operate directly within crypto settlement rails — Treasury is now reaching into the reserve layer, not only the intermediary layer.
{{horizontal-line}}
Frequently asked questions (FAQs)
1. What did OFAC designate in this action?
OFAC designated two wallets as property of Iran’s Bank Markazi — the Islamic Republic’s central bank — with linkages to the IRGC-Qods Force and Hizballah. Tether coordinated with OFAC and US law enforcement to freeze approximately USD 344.2 million across the two addresses.
2. Why are these wallets considered reserve infrastructure rather than operational?
The behavioral profile of both addresses reflects accumulation rather than active deployment. One carries no outbound transfer history. The other moved less than USD 16 million out against more than USD 228 million in. Accumulation concluded by late 2023, after which both balances sat largely dormant until this week — behavior consistent with sovereign reserve storage.
3. How does this action connect to TRM’s prior Iran analysis?
TRM has tracked the Central Bank of Iran’s on-chain activity for several years, identifying a repeatable institutional typology: intake of large USDT deposits, structured bridge-outs to multisig custody, DeFi-based token transformation, and eventual routing toward centralized exchanges. The wallets designated today sit at the intake layer of that workflow.
