Iran’s Central Bank Used $507M in USDT to Evade Sanctions

Blockchain intelligence firm Elliptic has mapped a network of cryptocurrency wallets used by Iran’s Central Bank (CBI) to acquire at least $507 million in Tether’s USDT stablecoin over the past year. According to leaked documents analyzed by Elliptic, the CBI executed two major purchases in April and May of last year, paying in UAE dirhams via an entity suspected to be a crypto broker called Modex. Elliptic co-founder Tom Robinson noted that other over-the-counter brokers were likely involved, suggesting the identified $507 million figure is a ‘lower bound’ that excludes wallets not attributed to the CBI with high confidence.

The primary objective behind this accumulation, as detailed in Elliptic’s report, was twofold. Domestically, the CBI sought to stabilize the plummeting Iranian rial on foreign exchange markets. The routing of substantial USDT volumes to Iran’s largest crypto exchange, Nobitex, indicates a clear strategy of injecting US dollar liquidity into the local market to prop up the national currency. Internationally, facing exclusion from the SWIFT financial messaging system due to sanctions, Iran aimed to use USDT to settle cross-border trades, effectively treating the stablecoin as ‘digital off-book eurodollar accounts’ outside the reach of U.S. authorities.

The CBI’s strategy underwent a significant shift following a major security breach in June 2025, when pro-Israel hackers drained over $90 million in crypto from Nobitex. In response, as tracked by Elliptic, CBI-linked wallets began moving their USDT holdings away from the exchange. They utilized a cross-chain bridge service to convert their TRON-based USDT into Ethereum-based USDT. This technical maneuver was likely an attempt to enhance obfuscation and liquidity access.

The converted funds were then sent to various decentralized exchanges (DEXs), swapped into other digital assets, and moved across different blockchains and to centralized exchanges. This complex laundering process continued until the end of 2025, by which time the entire identified $507 million in USDT had exited the wallets directly tied to the CBI. Tom Robinson confirmed to Decrypt that no USDT remains in those specific wallets, though he acknowledged the CBI may control other, unidentified wallets.

Despite Iran’s attempts to leverage the pseudo-anonymous nature of crypto, Elliptic’s research underscores how the inherent transparency and programmability of blockchain networks and stablecoins can empower sanctions enforcement. In a pivotal demonstration of this, Tether, the company behind USDT, acted on intelligence to disable wallets associated with the Iranian central bank in June of last year, freezing approximately $37 million in assets.

In a statement to Decrypt, Tether reiterated its zero-tolerance policy towards the illicit use of its tokens, highlighting its collaboration with global law enforcement. The company reported it has worked with over 310 law enforcement agencies across 62 countries and frozen more than $3.8 billion in assets linked to criminal activity to date. This action against the CBI wallets illustrates a critical paradox: while digital assets offer new avenues for sanctioned states, they also create an immutable, traceable ledger that can be monitored and acted upon more swiftly than traditional, opaque financial channels.

Elliptic’s blog concludes that the very features of stablecoins and blockchain that Iran sought to exploit—speed, global reach, and decentralization—may ultimately ‘enable even more powerful sanctions enforcement.’ The case of the CBI’s $507 million USDT operation serves as a landmark study in how geopolitical financial conflicts are migrating to the digital asset space, where every transaction leaves a forensic trail for firms like Elliptic to follow.