Chainalysis traces $344M Iran-linked USDT flow

Chainalysis reported that $344 million in USDT moved from brokers through intermediary wallets, cross-chain bridges and decentralized finance protocols into addresses linked to the Central Bank of Iran. The firm published the analysis in a blog post dated April 27 and said the funds were frozen after coordination between Tether and U.S. authorities.

According to Chainalysis, the sequence began with fiat used to buy stablecoins through broker networks. Those tokens then passed to intermediary on‑chain wallets, crossed bridges that transfer assets between blockchains, and entered DeFi venues where swaps and liquidity pools altered identifiable flow. The tokens later returned to accounts tied to the Central Bank of Iran and to organizations linked to the Islamic Revolutionary Guard Corps.

Chainalysis tied the freeze to actions by U.S. sanctions authorities. The Office of Foreign Assets Control added two Central Bank of Iran–linked crypto addresses to its sanctions list, and Chainalysis reported those wallets were frozen on April 23 with balances consistent with the $344 million in USDT reported seized.

The firm referenced earlier disclosures. It cited leaked documents from late 2025 attributed to Babak Morteza Zanjani that included cryptocurrency addresses he said were linked to the Central Bank of Iran. Chainalysis identified connections to Alireza Derakhshan, who coordinated more than $100 million in crypto purchases tied to Iranian oil sales between 2023 and 2025.

In its blog, Chainalysis wrote: “Iran’s digital asset networks provide the critical financial infrastructure needed to launder the billions of dollars generated by these shadow fleet vessels back to the IRGC and Iran‑aligned terrorist organizations across the region.” The report added that Central Bank funds moved through several bridge and DeFi protocols before returning to mainstream Iranian crypto channels.

The analysis also described commercial and security concerns near the Strait of Hormuz. Chainalysis noted reports that scammers posing as Iranian agents targeted shipping firms that attempted to pay tolls demanded by Iranian authorities, with some companies paying fraudulent actors and later being confronted by Iranian naval vessels when payments did not reach official recipients. Payment methods in those incidents remain under investigation; Chainalysis said stablecoin flows would match the on‑chain patterns it observed if they were used.

Chainalysis said the timing of wallet freezes, intermediary routing and sanctions designations were linked in the same enforcement picture and that on‑chain traceability played a role in identifying the flow of funds. Investigations into the full scope of actors and methods are ongoing.