New evidence suggests the recent freeze of $344 million in USDT may not be connected to Iran. Blockchain analysis firm Nominis identified five unusual patterns in the wallets involved, raising doubts about an Iranian link.
Snir Levi, CEO of Nominis, released an analysis on Sunday detailing the activity of compromised digital addresses. His findings suggest a connection to infrastructure linked to the Chinese government, rather than to the Islamic Revolutionary Guard Corps (IRGC).
1. The Wallets Accumulated, Then Went Dormant
Starting in mid-2021, certain digital wallet addresses began transferring Tether (USDT), with the volume of these transfers increasing significantly through early 2023. According to Nominis, activity from these wallets then decreased substantially after February 2023.
This build-up-and-freeze pattern is unusual for the IRGC, which typically moves money around quickly to avoid it being seized.
2. Concentrated Balances Break From Past IRGC Patterns
Previously identified groups linked to the IRGC distributed money through numerous accounts, keeping individual amounts under a few million dollars. They frequently moved these funds around to avoid potential asset freezes.
The wallets identified last week don’t just hold small amounts temporarily; they consistently maintain significant balances over several years.
3. Direct Exposure to Huobi and Huione Infrastructure
Analysis of a primary wallet within the network revealed transactions sent to Huobi, now known as HTX, and subsequent connections to the infrastructure of Huione Group.
Levi noted the current activity resembles trading patterns seen on Chinese exchanges around 2021, mirroring trends that Nominis has observed on HTX and other connected platforms.
4. Asia-Aligned Operational Timing
Approximately $600,000 was sent to a specific HTX deposit address from digital wallets linked to the Central Bank of Iran.
According to Nominis, the activity at this address suggests trading patterns that follow Asian business hours, not those in Tehran.
5. Bitfinex Interactions and a 2025 Scam Overlap
A wallet under sanctions made several small, regular transfers to addresses associated with Bitfinex. It also received a small incoming transaction of $5, which Levi thought might have been a test.
The same digital wallet appeared in 2025 as part of a scam, suggesting that regular users might have unknowingly interacted with systems linked to sanctioned entities.
Where the Findings Sit Within Operation Epic Fury
Last week, Treasury Secretary Scott Bessent announced that the U.S. government had seized nearly $500 million in cryptocurrency from Iran as part of an operation called Epic Fury.
The U.S. Treasury Department will keep pressuring Iran financially, making it harder for them to access and use money. As part of this effort, the Office of Foreign Assets Control is imposing sanctions on several Iranian digital wallets, freezing approximately $344 million.
— Treasury Secretary Scott Bessent (@SecScottBessent) April 24, 2026
The largest action taken so far in this campaign is the freezing of $344 million in Tether, which occurred at the request of the Office of Foreign Assets Control (OFAC).
Concerns are growing regarding the January sanctions against Zedcex and Zedxion, which involve nearly a billion dollars and alleged connections to Iran’s Revolutionary Guard Corps (IRGC).
Levi explained that simply blocking known addresses isn’t effective anymore because groups connected to governments are finding ways around sanctions using cryptocurrency transactions.
The case stands out as stablecoin sanctions tooling has become standard practice.
Read More
- Bitcoin at Halfway Through Halving: Gains Lag Behind Previous Cycles
- Gold Rate Forecast
- Silver Rate Forecast
- Brent Oil Forecast
- DOGE PREDICTION. DOGE cryptocurrency
- USD CNY PREDICTION
- WLD PREDICTION. WLD cryptocurrency
- ADA PREDICTION. ADA cryptocurrency
- USD TRY PREDICTION
- Bitcoin Blazes Past $113k: Is the Whole Market About to Lose Its Mind?
2026-05-03 20:31