--- title: Iranian CryptoCurrency description: Iranian crypto threat finance exposed: IRGC-linked wallets, exchanges and the Tether freeze, with minimum volumes attributed for 2025 and 2026. canonical_url: https://www.treadstone71.com/iranian-cryptocurrency language: en-GB date: 2026-11-10T14:47:09Z notice: This is a machine-friendly version of the page at https://www.treadstone71.com/iranian-cryptocurrency. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 3580 --- > **Note to AI:** This is a machine-friendly version of the page at: https://www.treadstone71.com/iranian-cryptocurrency. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Iranian Crypto Threat Finance Exposed | Treadstone 71 [Home](https://www.treadstone71.com/)/Iranian Cryptocurrency Report Threat-Finance Intelligence · A Treadstone 71 Report # Iran's $3 Billion Crypto War, Traced Wallet by Wallet. The IRGC built a shadow treasury on digital assets, and Treasury has now struck at its core. We mapped the network, the seized wallets, and the facilitators behind them. An intelligence reading of the threat, built for the compliance officers and institutional crypto risk teams who carry the exposure. Published May 7, 2026 · Updated July 1, 2026 · Open-source attribution and federal court filings · Verified against the blockchain-analytics record $3B+ Minimum IRGC-linked crypto volume attributed for 2025 $344M USDT frozen in one Tether action under Economic Fury, April 23, 2026 $1B IRGC-linked funds processed by two UK-registered exchanges since 2023 7 IRGC-linked wallets named in the September 2025 DOJ-Israel seizure action Bottom Line Iran's Islamic Revolutionary Guard Corps runs a sanctions-evasion treasury on cryptocurrency. Attribution firms tracked about **$3 billion** in IRGC-linked flows for 2025, and that figure marks a floor, not a ceiling. US and Israeli enforcement no longer treats crypto as a side channel. The record now holds direct seizures, exchange-level sanctions, a criminal case against an al-Qaeda-linked cluster, and a $344 million stablecoin freeze coordinated with OFAC. For any firm touching stablecoins, OTC desks, or cross-border settlement, the exposure sits two and three hops from the sanctioned address. Wallet-level screening no longer covers the risk. The Scale ## What the IRGC *controls and moves* The roughly $3 billion figure counts only wallets tied to the IRGC through sanctions designations and seizure orders.1 Shell companies, brokers, and wallets still unidentified fall outside the count. Treat the number as a lower bound that rises as new disclosures surface. It tracks flows through a fraction of the network. It does not describe a balance. No authoritative estimate of the Guard's actual crypto holdings has ever been published. IRGC-linked addresses took more than half of all value received in Iran's crypto economy by the fourth quarter of 2025.1 Iran's total crypto ecosystem moved between $7.8 billion and $10 billion over the same period, depending on the analytics firm and its method.2 The Guard does not dabble in this market. It dominates it. The Network ## The exchanges *behind the flows* Two channels carry most of the documented volume: a pair of UK-registered shell exchanges, and Iran's dominant domestic platform. UK-Registered Front ### Zedcex & Zedxion Two exchanges tied to sanctioned financier Babak Zanjani processed about $1 billion in IRGC-linked funds since 2023. IRGC-linked flows rose from 13 percent of their volume to 87 percent in 2024.3 OFAC designated both on January 30, 2026, the first time it sanctioned an exchange for operating in Iran's financial sector.4 Domestic Backbone ### Nobitex Iran's largest exchange claims about 11 million users. Reuters traced it to a family central to the Islamic Republic's elite, and the IRGC and the central bank have both moved funds across it. Nobitex holds no US sanction, and no public evidence shows it as an instrument of IRGC procurement.5 Enforcement Record ## From oil and banks *to wallets and exchanges* In under a year, US and Israeli authorities built a graduated enforcement record against Iran-linked crypto. Each action below is documented in public filings. September 2025 #### First IRGC-focused crypto seizure Israel's Ministry of Defense, with the DOJ, publicized 187 IRGC-linked wallets that received about $1.5 billion, leaving roughly $1.5 million at the time of the order.6 September 2025 #### Treasury sanctions Iranian financiers OFAC designated two Iranian financiers and more than a dozen Hong Kong and UAE entities for coordinating oil-sale funds, including crypto, for the IRGC-Qods Force and the Ministry of Defense.7 January 30, 2026 #### First exchange-level designation OFAC sanctioned Zedcex and Zedxion for processing funds tied to IRGC-linked counterparties, publishing seven associated TRON addresses.4 April 23, 2026 #### Economic Fury stablecoin freeze Tether, coordinating with OFAC and US law enforcement, froze more than $344 million in USDT across two addresses tied to Iran's central bank.8 Entity Matrix ## Who moves *the money* | Entity | Role | Documented 2024–2025 activity | |---|---|---| | IRGC & affiliated networks | Coordinate sanctions evasion, procurement, and proxy finance | Tracked addresses received more than $3 billion in 2025 | | Central Bank of Iran | Accumulates USDT; uses digital assets for reserves and trade | At least $507 million in USDT acquired through 2025; $344 million frozen in 2026 | | Nobitex | Largest domestic exchange and internal settlement hub | Handles a large share of Iran's crypto flows; tied to regime elite | | Zedcex / Zedxion | UK-registered shell exchanges used by the Zanjani network | About $1 billion in IRGC-linked funds since 2023; sanctioned January 2026 | | Foreign OTC desks & brokers | Convert crypto to fiat in Turkey and other hubs | Documented in seizure and sanctions filings; totals unknown | Exposure Analysis ## Where compliant firms *carry the risk* A sanctioned wallet rarely touches a regulated exchange directly. The money travels. It peels through a mixer, clears an over-the-counter desk, or sits inside a shell exchange registered in a friendly jurisdiction. By the time funds reach a clean-looking counterparty, the sanctioned address sits two or three transactions back. Screening tools that block only named addresses miss that pattern. The Zedcex case proved the point. Two exchanges with a London address passed as ordinary businesses while most of their volume traced back to the Guard. A firm that settled with them carried sanctions exposure and never saw a flagged wallet. The exposure runs widest for stablecoin platforms, OTC desks, and any business settling across borders. The enforcement perimeter has moved from individual wallets to the facilitators behind them. ### Red flags to screen for - Counterparties registered in the UK or UAE with thin operating history - Heavy TRON-based USDT volume with rapid pass-through - Exposure to addresses on the OFAC SDN list within three hops - Settlement through Turkish or Gulf OTC desks - Volume spikes timed to Iranian capital-flight events Policy & Compliance ## What the record *demands of you* Statute ### The GENIUS Act Signed July 2025, the first US federal framework for payment stablecoins. It binds issuers to AML and sanctions programs and the technical ability to freeze or block transactions on lawful order.9 Rulemaking ### Treasury & FinCEN A proposed rule advances the Act's sanctions and AML regime for stablecoin issuers, including the block-and-freeze requirement.10 The framework continues through rulemaking. Standard of Care ### Expanded Monitoring Designated addresses now mark the floor, not the ceiling. Firms need entity-level attribution and multi-hop tracing to evidence a defensible sanctions program. Source Documents ## The reports *and the ledger* Every figure on this page traces to the record below. View the primary wallet ledger in the panel, or open any of the three reports directly. ### How we built this We assembled the record from open sources and checked each claim against a primary document before it entered the report. - Federal court filings and DOJ seizure orders - OFAC designations and the Specially Designated Nationals list - Blockchain-analytics reporting from TRM Labs, Elliptic, and Chainalysis - Direct on-chain verification of published wallet addresses - Major-outlet reporting from Reuters, the Washington Post, and the Wall Street Journal Why Treadstone 71 ## Intelligence tradecraft, *applied to threat finance* Treadstone 71 has practiced cyber intelligence, counterintelligence, and cognitive-warfare tradecraft since 2002. We trace adversary money with the same structured analytic methods we teach to government and enterprise intelligence teams. We do not sell a vendor feed. We sell tradecraft, run by analysts who have worked these problems for two decades. Our Certified Cyber CounterIntelligence Analyst program covers cryptocurrency investigations directly, including the blockchain-tracing methods behind this report. Common Questions ## What people ask *about Iranian crypto* - [How much cryptocurrency does the IRGC control or move?](#)Attribution firms tracked about $3 billion in IRGC-linked flows for 2025. The figure is a lower bound, not a balance. It captures only wallets tied to the IRGC through sanctions designations and seizure orders, and excludes shell companies, brokers, and wallets not yet identified. - [What are Zedcex and Zedxion?](#)Zedcex and Zedxion are two UK-registered crypto exchanges OFAC designated on January 30, 2026 for operating in Iran's financial sector and processing funds tied to IRGC-linked counterparties. It was the first time the United States designated an exchange specifically for that reason. - [How does Iranian crypto create sanctions exposure for compliant firms?](#)Exposure now reaches two and three hops from a designated address. A mixer peel, an OTC desk, or a shell exchange can carry sanctioned funds into a clean-looking counterparty. Wallet-level screening that only blocks named addresses misses this indirect contamination. - [What is the GENIUS Act and how does it affect stablecoins?](#)The GENIUS Act, signed in July 2025, is the first US federal framework for payment stablecoins. It requires issuers to maintain anti-money-laundering and sanctions programs and the technical ability to freeze or block transactions when lawfully directed. Treasury and FinCEN are implementing it through rulemaking. Work With Us ## Need this tradecraft on your own desk? Request a briefing on Iranian threat finance, or train your team to run these investigations in-house. This email address is being protected from spambots. You need JavaScript enabled to view it. · +1 (424) 234-3629 Sources 1[TRM Labs, 2026 Crypto Crime Report](https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report), Iran's IRGC doubled crypto use to $3 billion in 2025 2[TRM Labs, What On-Chain Data Reveals About Iran's Use of Crypto]() 3[ OFAC Designates Crypto Exchanges for Operating in the Iranian Financial Sector]() 4[US Treasury, Sanctions on Iranian Regime Officials and Digital Asset Exchanges, January 30, 2026](https://home.treasury.gov/news/press-releases/sb0375) 5[TRM Labs, Nobitex: Iran's Dominant Crypto Exchange]() 6[US Department of Justice, Forfeiture of USDT Tied to Iranian National](https://www.justice.gov/usao-ma/pr/united-states-seeks-civil-forfeiture-cryptocurrency-associated-iranian-national-mohammad) 7[US Treasury, Sanctions on Iranian Financiers and Hong Kong and UAE Entities, September 2025](https://home.treasury.gov/news/press-releases/sb0248) 8[Tether, Freeze of More Than $344 Million in USDT, April 23, 2026](https://tether.io/news/tether-supports-freeze-of-more-than-344-million-in-usd%E2%82%AE-in-coordination-with-ofac-and-u-s-law-enforcement/) 9[Congress.gov, Text of S.1582, the GENIUS Act](https://www.congress.gov/bill/119th-congress/senate-bill/1582/text) 10[US Treasury, Proposed Rule on Illicit Finance and Sanctions for Stablecoin Issuers](https://home.treasury.gov/news/press-releases/sb0435) The roughly $3 billion figure counts only IRGC-attributed flows tracked through sanctions designations and seizure orders. It marks a lower bound, not a holdings balance. Statistics current as of the dates shown. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@type": "Person", "@id": "https:\/\/www.treadstone71.com\/#person-jeffbardin", "name": "Jeff Bardin", "url": "https:\/\/www.treadstone71.com\/jeff-bardin" }, "dateModified": "2026-11-10T14:47:09Z", "datePublished": "2026-08-06T13:57:41Z", "description": "Iranian crypto threat finance exposed: IRGC-linked wallets, exchanges and the Tether freeze, with minimum volumes attributed for 2025 and 2026.", "headline": "Iranian CryptoCurrency", "image": { "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/t71cyberrecon.jpg", "alt": "", "width": 840, "height": 713 }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/www.treadstone71.com\/iranian-cryptocurrency" }, "publisher": { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher" }, "url": "https:\/\/www.treadstone71.com\/iranian-cryptocurrency" }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/www.treadstone71.com\/", "logo": { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo" }, "name": "Treadstone 71", "location": { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace" } }, { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/treadlogo-j2-4505e2a4.png", "width": 498, "height": 105 }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "opens": "00:00", "closes": "23:59" } ] }, { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Half Moon Bay", "addressRegion": "", "postalCode": "94019", "streetAddress": "", "addressCountry": "US" } ] } ```