Iran's $3 Billion Crypto War, Traced Wallet by Wallet.
The IRGC built a shadow treasury on digital assets, and Treasury has now struck at its core. We mapped the network, the seized wallets, and the facilitators behind them. An intelligence reading of the threat, built for the compliance officers and institutional crypto risk teams who carry the exposure.
Published May 7, 2026 · Updated July 1, 2026 · Open-source attribution and federal court filings · Verified against the blockchain-analytics record
$3B+
Minimum IRGC-linked crypto volume attributed for 2025
$344M
USDT frozen in one Tether action under Economic Fury, April 23, 2026
$1B
IRGC-linked funds processed by two UK-registered exchanges since 2023
7
IRGC-linked wallets named in the September 2025 DOJ-Israel seizure action
Bottom Line
Iran's Islamic Revolutionary Guard Corps runs a sanctions-evasion treasury on cryptocurrency. Attribution firms tracked about $3 billion in IRGC-linked flows for 2025, and that figure marks a floor, not a ceiling.
US and Israeli enforcement no longer treats crypto as a side channel. The record now holds direct seizures, exchange-level sanctions, a criminal case against an al-Qaeda-linked cluster, and a $344 million stablecoin freeze coordinated with OFAC. For any firm touching stablecoins, OTC desks, or cross-border settlement, the exposure sits two and three hops from the sanctioned address. Wallet-level screening no longer covers the risk.
The Scale
What the IRGC controls and moves
The roughly $3 billion figure counts only wallets tied to the IRGC through sanctions designations and seizure orders.1 Shell companies, brokers, and wallets still unidentified fall outside the count. Treat the number as a lower bound that rises as new disclosures surface. It tracks flows through a fraction of the network. It does not describe a balance. No authoritative estimate of the Guard's actual crypto holdings has ever been published.
IRGC-linked addresses took more than half of all value received in Iran's crypto economy by the fourth quarter of 2025.1 Iran's total crypto ecosystem moved between $7.8 billion and $10 billion over the same period, depending on the analytics firm and its method.2 The Guard does not dabble in this market. It dominates it.
The Network
The exchanges behind the flows
Two channels carry most of the documented volume: a pair of UK-registered shell exchanges, and Iran's dominant domestic platform.
Zedcex & Zedxion
Two exchanges tied to sanctioned financier Babak Zanjani processed about $1 billion in IRGC-linked funds since 2023. IRGC-linked flows rose from 13 percent of their volume to 87 percent in 2024.3 OFAC designated both on January 30, 2026, the first time it sanctioned an exchange for operating in Iran's financial sector.4
Nobitex
Iran's largest exchange claims about 11 million users. Reuters traced it to a family central to the Islamic Republic's elite, and the IRGC and the central bank have both moved funds across it. Nobitex holds no US sanction, and no public evidence shows it as an instrument of IRGC procurement.5
Enforcement Record
From oil and banks to wallets and exchanges
In under a year, US and Israeli authorities built a graduated enforcement record against Iran-linked crypto. Each action below is documented in public filings.
First IRGC-focused crypto seizure
Israel's Ministry of Defense, with the DOJ, publicized 187 IRGC-linked wallets that received about $1.5 billion, leaving roughly $1.5 million at the time of the order.6
Treasury sanctions Iranian financiers
OFAC designated two Iranian financiers and more than a dozen Hong Kong and UAE entities for coordinating oil-sale funds, including crypto, for the IRGC-Qods Force and the Ministry of Defense.7
First exchange-level designation
OFAC sanctioned Zedcex and Zedxion for processing funds tied to IRGC-linked counterparties, publishing seven associated TRON addresses.4
Economic Fury stablecoin freeze
Tether, coordinating with OFAC and US law enforcement, froze more than $344 million in USDT across two addresses tied to Iran's central bank.8
Entity Matrix
Who moves the money
| Entity | Role | Documented 2024–2025 activity |
|---|---|---|
| IRGC & affiliated networks | Coordinate sanctions evasion, procurement, and proxy finance | Tracked addresses received more than $3 billion in 2025 |
| Central Bank of Iran | Accumulates USDT; uses digital assets for reserves and trade | At least $507 million in USDT acquired through 2025; $344 million frozen in 2026 |
| Nobitex | Largest domestic exchange and internal settlement hub | Handles a large share of Iran's crypto flows; tied to regime elite |
| Zedcex / Zedxion | UK-registered shell exchanges used by the Zanjani network | About $1 billion in IRGC-linked funds since 2023; sanctioned January 2026 |
| Foreign OTC desks & brokers | Convert crypto to fiat in Turkey and other hubs | Documented in seizure and sanctions filings; totals unknown |
Exposure Analysis
Where compliant firms carry the risk
A sanctioned wallet rarely touches a regulated exchange directly. The money travels. It peels through a mixer, clears an over-the-counter desk, or sits inside a shell exchange registered in a friendly jurisdiction. By the time funds reach a clean-looking counterparty, the sanctioned address sits two or three transactions back.
Screening tools that block only named addresses miss that pattern. The Zedcex case proved the point. Two exchanges with a London address passed as ordinary businesses while most of their volume traced back to the Guard. A firm that settled with them carried sanctions exposure and never saw a flagged wallet.
The exposure runs widest for stablecoin platforms, OTC desks, and any business settling across borders. The enforcement perimeter has moved from individual wallets to the facilitators behind them.
Red flags to screen for
- Counterparties registered in the UK or UAE with thin operating history
- Heavy TRON-based USDT volume with rapid pass-through
- Exposure to addresses on the OFAC SDN list within three hops
- Settlement through Turkish or Gulf OTC desks
- Volume spikes timed to Iranian capital-flight events
Policy & Compliance
What the record demands of you
The GENIUS Act
Signed July 2025, the first US federal framework for payment stablecoins. It binds issuers to AML and sanctions programs and the technical ability to freeze or block transactions on lawful order.9
Treasury & FinCEN
A proposed rule advances the Act's sanctions and AML regime for stablecoin issuers, including the block-and-freeze requirement.10 The framework continues through rulemaking.
Expanded Monitoring
Designated addresses now mark the floor, not the ceiling. Firms need entity-level attribution and multi-hop tracing to evidence a defensible sanctions program.
Source Documents
The reports and the ledger
Every figure on this page traces to the record below. View the primary wallet ledger in the panel, or open any of the three reports directly.
How we built this
We assembled the record from open sources and checked each claim against a primary document before it entered the report.
- Federal court filings and DOJ seizure orders
- OFAC designations and the Specially Designated Nationals list
- Blockchain-analytics reporting from TRM Labs, Elliptic, and Chainalysis
- Direct on-chain verification of published wallet addresses
- Major-outlet reporting from Reuters, the Washington Post, and the Wall Street Journal
Why Treadstone 71
Intelligence tradecraft, applied to threat finance
Treadstone 71 has practiced cyber intelligence, counterintelligence, and cognitive-warfare tradecraft since 2002. We trace adversary money with the same structured analytic methods we teach to government and enterprise intelligence teams. We do not sell a vendor feed. We sell tradecraft, run by analysts who have worked these problems for two decades.
Our Certified Cyber CounterIntelligence Analyst program covers cryptocurrency investigations directly, including the blockchain-tracing methods behind this report.
Common Questions
What people ask about Iranian crypto
-
How much cryptocurrency does the IRGC control or move?
Attribution firms tracked about $3 billion in IRGC-linked flows for 2025. The figure is a lower bound, not a balance. It captures only wallets tied to the IRGC through sanctions designations and seizure orders, and excludes shell companies, brokers, and wallets not yet identified.
-
What are Zedcex and Zedxion?
Zedcex and Zedxion are two UK-registered crypto exchanges OFAC designated on January 30, 2026 for operating in Iran's financial sector and processing funds tied to IRGC-linked counterparties. It was the first time the United States designated an exchange specifically for that reason.
-
How does Iranian crypto create sanctions exposure for compliant firms?
Exposure now reaches two and three hops from a designated address. A mixer peel, an OTC desk, or a shell exchange can carry sanctioned funds into a clean-looking counterparty. Wallet-level screening that only blocks named addresses misses this indirect contamination.
-
What is the GENIUS Act and how does it affect stablecoins?
The GENIUS Act, signed in July 2025, is the first US federal framework for payment stablecoins. It requires issuers to maintain anti-money-laundering and sanctions programs and the technical ability to freeze or block transactions when lawfully directed. Treasury and FinCEN are implementing it through rulemaking.
Work With Us
Need this tradecraft on your own desk?
Request a briefing on Iranian threat finance, or train your team to run these investigations in-house.
Sources
1TRM Labs, 2026 Crypto Crime Report, Iran's IRGC doubled crypto use to $3 billion in 2025
2TRM Labs, What On-Chain Data Reveals About Iran's Use of Crypto
3 OFAC Designates Crypto Exchanges for Operating in the Iranian Financial Sector
4US Treasury, Sanctions on Iranian Regime Officials and Digital Asset Exchanges, January 30, 2026
5TRM Labs, Nobitex: Iran's Dominant Crypto Exchange
6US Department of Justice, Forfeiture of USDT Tied to Iranian National
7US Treasury, Sanctions on Iranian Financiers and Hong Kong and UAE Entities, September 2025
8Tether, Freeze of More Than $344 Million in USDT, April 23, 2026
9Congress.gov, Text of S.1582, the GENIUS Act
10US Treasury, Proposed Rule on Illicit Finance and Sanctions for Stablecoin Issuers
The roughly $3 billion figure counts only IRGC-attributed flows tracked through sanctions designations and seizure orders. It marks a lower bound, not a holdings balance. Statistics current as of the dates shown.
