Loading story…
The U.S. Treasury Department’s Office of Foreign Assets Control expanded sanctions on the Central Bank of Iran by adding four cryptocurrency wallet addresses as identifiers under an existing designation that also covers the National Development Fund of Iran. Treasury had previously sanctioned the bank and fund for providing financial support to the Islamic Revolutionary Guard Corps-Qods Force and other activities tied to Iran’s regional operations.
Blockchain analysis cited in reporting said the newly listed wallets received more than $165 million in stablecoins, and Tether froze about $131 million linked to those addresses after the designation update. The action highlights U.S. efforts to disrupt alleged sanctions evasion through digital assets, with reporting stating that wallets attributed to the Central Bank of Iran have been used to move funds to regional partners including Hezbollah and that Tether has now frozen nearly $475 million tied to OFAC-identified Central Bank of Iran addresses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following the OFAC update, Tether froze $131 million in balances associated with the four wallet addresses added to the Central Bank of Iran designation. Chainalysis reported this brought Tether’s total frozen from OFAC-identified Central Bank of Iran wallets to nearly $475 million.
OFAC updated its sanctions designation for the Central Bank of Iran by adding four cryptocurrency wallet addresses as identifiers. Chainalysis said the wallets had received more than $165 million in stablecoins.
The U.S. Department of the Treasury announced sanctions on the Central Bank of Iran and the National Development Fund of Iran. This established the underlying sanctions designation later referenced in OFAC updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
chainalysis.com
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury's Office of Foreign Assets Control (**OFAC**) sanctioned four Tehran-based cryptocurrency exchanges—**Nobitex, Wallex, Bitpin, and Ramzinex**—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said **Nobitex**, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the **Islamic Revolutionary Guard Corps (IRGC)**, including IRGC-affiliated ransomware operators and other illicit finance activity. The designations, issued under the Trump administration's **Economic Fury** campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the **SDN** list, while reporting that **Ramzinex** alone processed more than **$2.45 billion** in transactions and that Iran's crypto ecosystem received nearly **$7.8 billion** in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Jun 29, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026
The U.S. Treasury expanded sanctions against Iranian businessman **Babak Morteza Zanjani** and a broader commercial network accused of helping **Zedcex Exchange Ltd.** and **Zedxion Exchange Ltd.** evade sanctions and move funds for Iran’s **Islamic Revolutionary Guard Corps**. The action designated four individuals and nine entities, including **Bahareh Morteza Zanjani**, **Solmaz Bani**, **Mehdi Rezazadeh**, **Sukhrob Oimakhmadov**, **ZEDX DMCC**, **ZedPay**, **BZ Diamond DMCC**, and multiple **Dot One** companies operating across the UAE, Turkey, and Iran. Treasury said the measures extend beyond the exchanges themselves to target a vertically integrated ecosystem spanning digital assets, payments, gold, transportation, aviation, rail, and travel. Reporting on the sanctions says the network used shared leadership, rotating corporate entities, and persistent digital infrastructure to support the exchanges and related commercial operations. TRM Labs previously said Zedcex and Zedxion processed **tens of billions of dollars** in cryptocurrency transactions, while separate reporting linked the exchanges to more than **$10 million** in transfers to **Sa’id Ahmad Muhammad al-Jamal**, a senior Houthi financial official. The sanctions freeze U.S.-based property and interests of the designated parties, prohibit U.S. persons from dealing with them, and expose foreign firms that continue assisting the network to secondary sanctions risk.
Jul 27, 2026