The Freeze of 130M USDT Helped BitOK Uncover Iran's Shadow Crypto Infrastructure

The United States blocked more than $130 million in cryptocurrency held in wallets linked to the Central Bank of Iran. The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned four TRON addresses, and stablecoin issuer Tether blacklisted them in the USDT contract the same day, July 14. Treasury Secretary Scott Bessent confirmed the action amid an escalation of the conflict in the Middle East.

Official statements and media reports revealed only a small part of the picture. The key questions remained unanswered: how Iran's stablecoin storage system was structured, where the funds came from, and why they were not moved in time. BitOK analysts examined the transaction history and uncovered numerous details that had previously gone unnoticed.

OFAC did not sanction a newly identified entity. Instead, it added four crypto addresses to the Central Bank of Iran’s existing entry on the SDN List, the U.S. register of individuals and organizations with whom transactions are prohibited.

The way the bank is classified in that entry is revealing: in addition to the Iran sanctions program, it is flagged for links to global terrorism and the Islamic Revolutionary Guard Corps, including the Quds Force and Hezbollah.

In other words, Washington views the Iranian regulator’s crypto wallets not merely as a tool for evading sanctions, but as part of the financing infrastructure for military and terrorist organizations.

"The U.S. Treasury is committed to disrupting and degrading Iran’s illicit financial activity, including its abuse of digital assets. We will continue to aggressively trace the flow of funds and deny the Iranian regime access to revenue from its illicit schemes," Bessent said on X.

All four addresses were added to the USDT contract blacklist at the same moment. The blockchain records show the freeze at 21:02:57 UTC on July 14, down to the exact second. This match indicates that the addresses had been assembled into a package in advance and the decision was executed as a single action. For investigators, this is one cluster rather than four independent cases.

The funds were distributed extremely unevenly: the three largest wallets held 99.01% of the frozen amount:

BitOK analysts emphasize the legal importance of precise terminology: the assets were blocked, not seized.

Transaction analysis showed that the four addresses were not independent balances, but two pairs with distinct functions:

The modular architecture simplified internal controls but created large, static targets for sanctions-based blocking.

The system followed a consistent pattern: TRX was deposited in advance to cover gas fees, small test transactions were sent, and large tranches followed.

Both reserve wallets also received TRX from the same address, labeled as an energy-rental service. This shared gas source became one of the key indicators linking the addresses within the cluster.

BitOK analysts reconstructed the key stages:

The historical portion of the graph reaches even further back. From October 2024 to January 2025, an address labeled as B2C2 transferred 167.29 million USDT to intermediary wallets. At least 122.06 million USDT was consolidated by a node that later sent 108.57 million USDT to the Iranian treasury.

The graph shows transactions involving addresses labeled as Binance, Poloniex, Bitso, HitBTC, OKX, Changelly, and Gate.io, as well as services used to transfer funds between blockchains, or cross-chain bridges. In particular, the treasury wallet made a series of payments totaling 1.88 million USDT to 17 addresses labeled as HitBTC, in tranches ranging from 61,000 to 500,000 USDT.

Investigator's note. Funds entered through Singapore-based payment and OTC provider dtcpay and UK-based institutional market maker B2C2. Additional incoming transfers were recorded from Binance, an international exchange; Poloniex, an exchange of U.S. origin; and Bitso, a Mexican crypto platform.

BitOK analysts caution that third-party service labels do not independently confirm who owns an address. Most of the transactions also occurred before the sanctions attribution, and a transactional link alone does not prove wrongdoing or awareness by a counterparty. Neither a single technical operator for both wallet pairs nor an on-chain bridge between them has been established. The cluster is connected solely through OFAC's official attribution.

There are no signs of an emergency evacuation of funds. The last significant transactions took place well before the freeze:

No urgent withdrawal was recorded during the final 24–72 hours before the blacklist event. Based on the on-chain data, the operators received no warning.

The July freeze follows an April precedent. On April 24, OFAC had already added two TRON addresses to the Central Bank of Iran's sanctions record:

The recurring pattern, BitOK analysts emphasize, points to systematic use of large stablecoin balances at the level of central-bank infrastructure rather than occasional crypto use by individual officials.

At the same time, against the backdrop of the freeze, the U.S. Treasury announced a separate wave of sanctions against the network of Mohammad Hossein Shamkhani, an Iranian businessman and son of Ali Shamkhani, an adviser to Iran’s Supreme Leader and former secretary of the Supreme National Security Council. More than 50 individuals, companies, and vessels linked to Iranian oil exports were designated.

Meanwhile, OFAC issued General License Z. The license applies to vessels blocked on July 14 and temporarily permits safe anchorage, entry into and departure from ports worldwide, emergency repairs, and the unloading of cargo taken aboard before that date. It does not authorize new contracts with sanctioned entities or remove the block from the crypto wallets. The purpose of the license is to halt the network’s revenues without causing vessels to stop chaotically at sea or creating accident risks. Public data shows no direct transactional link between the maritime sanctions package and the Central Bank of Iran addresses. However, both measures were introduced on the same day and form part of the same campaign targeting Tehran’s export revenues.

The report’s key conclusion extends beyond this specific case. USDT gives Iran access to dollar liquidity outside correspondent accounts and SWIFT, but preserves its dependence on a centralized issuer that complies with U.S. sanctions requirements.

Washington loses control at the level of banking intermediaries and regains it at the token-contract level. According to the official U.S. position, the Central Bank of Iran used stablecoins in part to support the rial’s exchange rate, and the freezes restrict that mechanism.
Consequences for Tehran:

The likely response will involve smaller balances, shorter holding periods, settlement through OTC channels and netting arrangements, and moving part of the reserves into assets without an issuer-level blocking function. The cost will be weaker liquidity, higher volatility, and more operational errors.

The central vulnerability of Iran's crypto strategy, BitOK analysts conclude, is not blockchain transparency itself, but the fact that the state-controlled system relied on a centralized digital dollar with an administrative off switch.

For anti-money laundering teams, the case highlights the weakness of screening solely against the current sanctions list: the most valuable signals emerge before and immediately after an official update. Monitoring should include:

A separate risk is the automatic re-rating of every address that received funds from a sanctioned wallet. A transactional link alone does not prove participation in sanctions evasion; the context of the transaction is essential.