Loading story…
Tether said it helped US authorities freeze nearly $550 million in USDT during 2026 from wallets authorities linked to the Central Bank of Iran and sanctions-evasion networks. The disclosure coincided with Treasury’s April Iran-related designations and was supported by on-chain Tron records showing two wallet blacklists in April and four in July tied to the Central Bank of Iran sanctions entry. Tether said it has assisted in freezing more than $4.9 billion in assets globally.
A Senate Permanent Subcommittee on Investigations minority-staff report questioned the adequacy and timeliness of Tether’s sanctions controls, alleging that some illicit wallets were blacklisted late or not at all. The report found that 84% of 846 wallets sanctioned or targeted for seizure over alleged Iran and regional-proxy links used USDT exclusively or almost exclusively, while cautioning that this statistic does not represent USDT’s share of all Iranian payment activity. Tether did not reconcile its $550 million figure with Chainalysis’s earlier estimate of nearly $475 million in Central Bank of Iran-related wallet freezes.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Tether said it had helped U.S. authorities freeze approximately $550 million in USDT during 2026 across wallets linked by authorities to Iran's central bank and sanctions-evasion networks. The disclosure coincided with a Senate minority-staff report alleging shortcomings and delays in Tether's blacklisting of illicit wallets.
Tether blacklisted four additional Tron wallets holding more than $130 million in USDT. OFAC added those addresses to the Central Bank of Iran sanctions entry in the same update.
Chainalysis reported that freezes affecting Central Bank of Iran wallets totaled almost $475 million.
OFAC added the two previously blacklisted Tron addresses to its Central Bank of Iran sanctions entry.
Tether blacklisted two Tron addresses holding more than $344 million in USDT, preventing the wallets from spending or sending their USDT balances. The wallets were identified as linked to Iran's central bank and sanctions-evasion networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourceofac.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tether froze more than **$344 million** in **USDT** held in two **Tron** wallet addresses after U.S. authorities identified the funds as tied to unlawful conduct. The company said the action was coordinated with the **Office of Foreign Assets Control (OFAC)** and U.S. law enforcement, blocking further movement of the assets once the addresses were flagged. The freeze adds to Tether’s broader enforcement activity as the stablecoin issuer reports more than **$2.1 billion** frozen in cooperation with U.S. authorities and over **$4.4 billion** frozen globally. Tether said it works with more than **340 law enforcement agencies** across **65 countries** and has supported over **2,300 cases** worldwide, including more than **1,200** involving U.S. agencies, as it expands compliance efforts through initiatives such as the **T3 Financial Crime Unit** with Tron and TRM Labs amid rising U.S. regulatory pressure on stablecoin issuers.
Jun 29, 2026
The U.S. Treasury Department’s Office of Foreign Assets Control expanded sanctions on the **Central Bank of Iran** by adding four cryptocurrency wallet addresses as identifiers under an existing designation that also covers the **National Development Fund of Iran**. Treasury had previously sanctioned the bank and fund for providing financial support to the Islamic Revolutionary Guard Corps-Qods Force and other activities tied to Iran’s regional operations. Blockchain analysis cited in reporting said the newly listed wallets received more than **$165 million** in stablecoins, and **Tether** froze about **$131 million** linked to those addresses after the designation update. The action highlights U.S. efforts to disrupt alleged sanctions evasion through digital assets, with reporting stating that wallets attributed to the Central Bank of Iran have been used to move funds to regional partners including **Hezbollah** and that Tether has now frozen nearly **$475 million** tied to OFAC-identified Central Bank of Iran addresses.
Jul 16, 2026
The U.S. Treasury sanctioned crypto settlement provider **Shelbit**, founder **Siavash Kayvanpour**, affiliated entities in the **UAE, Poland, and Georgia**, and Iran-based exchange **Aban Tether** for allegedly facilitating Iran-linked illicit finance tied to **IRGC-controlled wallets**, sanctioned Iranian platforms, and laundering connected to a Persian-language gambling network. TRM Labs said Shelbit processed more than **$6.3 billion** in blockchain flows between May 2024 and March 2026, operating primarily on **TRON** using **USDT-TRC20** and behaving less like a conventional exchange than a rapid settlement conduit, with near-zero retained balances and tightly matched inflows and outflows. The sanctions action aligns with broader reporting that Iran has built a large crypto-enabled sanctions-evasion and threat-finance system that relies heavily on **Tether on TRON** when traditional banking channels are blocked. Separate analysis alleged that more than **$3 billion** flowed into IRGC-associated addresses in 2025 and mapped links from Iranian leadership and front companies to verified wallet addresses, Dubai exchange houses, shadow-fleet tankers, ransom payments, sanctioned oil sales, and drone-component procurement. Investigators also reported Shelbit’s direct exposure to the IRGC, a wallet later designated by Israel as Hamas infrastructure, and Russian sanctions-evasion services including **A7**, while warning that the underlying illicit finance network may continue despite the platform’s shutdown.
Aug 11, 2026