$130 Million USDT Frozen: OFAC Expands Crackdown on Iran's Crypto Financial Network

OFAC has frozen 130 million USDT across four new TRON addresses linked to the Central Bank of Iran, targeting both crypto holdings and payment channels.

Written by: BlockSec

On July 14, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) updated its sanctions list against the Central Bank of Iran (CBI), adding four new TRON addresses associated with the entity. Subsequently, Tether blacklisted these four addresses, rendering approximately 130 million USDT unable to be transferred or redeemed.

BlockSec utilized the on-chain tracking investigation platform MetaSleuth to fully reconstruct the flow of funds associated with these four addresses. The analysis revealed that they are not isolated wallets: the four addresses can be divided into two clusters of funds, with upstream connections to payment or liquidity service providers and downstream links to multiple centralized exchanges. Some funds were also converted to BTC through cross-chain paths before being frozen.

On July 29, OFAC sanctioned HormuzSafe, an Iranian maritime service provider that accepts payments in Bitcoin and other digital assets. While there is no publicly disclosed direct financial relationship between the two actions, they reflect a similar policy direction: the U.S. is increasingly focusing on Iran's crypto financial activities, extending its scrutiny from wallets holding funds to business entry points that may continue to generate digital asset income.

OFAC Adds Four TRON Addresses to CBI Sanctions List

This action is not the first time OFAC has linked cryptocurrency addresses to the Central Bank of Iran. On April 24, 2026, OFAC first added two TRON addresses to the existing sanctions against CBI, resulting in approximately 344.2 million USDT being frozen by Tether. Less than three months later, on July 14, OFAC updated the entry again, adding four new TRON addresses, increasing the publicly listed CBI-associated addresses from two to six. This round saw approximately 130.11 million USDT subsequently frozen by Tether.

The scale of the freeze, roles, and active periods of the four new addresses are as follows:

Figure 1｜Scale of USDT frozen and roles of the four new CBI-associated addresses (Data source: BlockSec MetaSleuth)

The complete forms of the four addresses are as follows, which can be directly used for list comparison and internal blacklist synchronization:

• Group One · Upstream Receiver TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp
• Group One · Downstream Collector TJdgB1k6ot3f2nLuZug6D8eD3HavTmzmSK
• Group Two · Fund Transfer TXGHxdYbGy574z5hBu4LNzq9NzjZQ9bhUf
• Group Two · Passive Collector TFQbqaNbmq2xsVor2NbufLkYZvxFC9wC7k

All four addresses were blacklisted by Tether at the same time, and based on their balances at that time, a total of approximately 130.11 million USDT was frozen. The relevant tokens remain in the original addresses but can no longer be transferred.

For virtual asset service providers, the speed at which such list updates are implemented directly determines their risk exposure. OFAC's sanctioned addresses will enter BlockSec's risk tagging system, allowing Phalcon Compliance users to not only identify these four addresses but also see the upstream and downstream counterparties involved in fund flows.

Four Addresses Form Two Clusters of Funds

Based on the financial flow relationships between the addresses, the four addresses can be further divided into two clusters. Both groups exhibit characteristics of funds entering from external service providers, accumulating between associated addresses, and then flowing to exchanges or other blockchain networks.

Group One: Approximately 56 Million USDT Inflow, of which 32.27 Million USDT Frozen

There is a clear upstream and downstream relationship between TAhwhF and TJdgB1.

This group of addresses has cumulatively received approximately 56 million USDT from funds categorized under the dtcpay address system, of which approximately 32.27 million USDT was frozen in this round of action.

Among the funds transferred out before freezing:

1. Approximately 4 million USDT flowed to centralized exchanges such as Binance;
2. Approximately 1.2 million USDT was converted to BTC via cross-chain paths;
3. The remaining funds continued to circulate through other addresses.

It should be noted that dtcpay is the classification of the source of these funds within the on-chain tagging system, indicating that the funds come from addresses controlled by that service provider, and does not imply that the institution participated in or was aware of any sanction evasion activities. Address ownership and transaction purposes still require account-level evidence.

This structure indicates that this cluster is not simply used for long-term storage of stablecoins. After entering through payment or settlement channels, funds first accumulate between associated addresses, with some entering exchanges and others leaving the TRON network to convert to BTC.

Figure 2｜Fund Flow of Group One: dtcpay Address System → TAhwhF → TJdgB1 (Source: BlockSec MetaSleuth)

Group Two: Approximately 97.84 Million USDT Frozen in Transfer and Collection Addresses

TXGHxd and TFQbqa form another group of upstream and downstream addresses.

Most of the funds in this group come from a service provider whose identity has not yet been confirmed, with the two addresses cumulatively freezing approximately 97.84 million USDT. Portions of the funds transferred out before freezing had flowed to centralized exchanges such as HitBTC and Binance.

The two addresses have certain functional differences. TXGHxd has been active for a longer time and has undertaken more fund transfer functions; TFQbqa began concentrating on receiving funds in April 2026 and has not been observed to engage in active outflows, making it more akin to a passive collection or reserve address.

TFQbqa was frozen with approximately 85.53 million USDT, the largest frozen amount among the four addresses, accounting for two-thirds of the total amount frozen in this round.

Figure 3｜Fund Flow of Group Two: Transfer and Collection Relationship between TXGHxd and TFQbqa (Source: BlockSec MetaSleuth)

• TXGHxd Fund Flow: https://metasleuth.io/result/tron/TXGHxdYbGy574z5hBu4LNzq9NzjZQ9bhUf?source=746ba6bb-da37-4c41-9c93-cb9a5c0d3544
• TFQbqa Fund Flow: https://metasleuth.io/result/tron/TFQbqaNbmq2xsVor2NbufLkYZvxFC9wC7k?source=43037291-6b24-4234-a43a-ffc8b7719c7a

Total USDT Frozen Related to CBI Approximately $474 Million

July 14 was not the first time Tether froze funds attributed to CBI.

In April 2026, Tether had already frozen approximately 344.2 million USDT of CBI-associated assets. Adding this round of approximately 130.11 million USDT, the two actions cumulatively locked approximately 474.31 million USDT, close to $474 million.

These actions demonstrate the dual nature of centralized stablecoins. USDT can flow rapidly between payment institutions, over-the-counter networks, and exchanges in different regions, providing dollar-denominated liquidity to entities constrained by traditional finance; however, its contracts are still controlled by the issuer, and balances in identified addresses can be directly frozen.

For law enforcement agencies, centralized stablecoin issuers thus become important nodes in sanction enforcement. However, this control primarily covers funds that remain in known addresses in USDT form and cannot automatically recover assets that have already entered exchanges, been converted cross-chain, or transferred to other addresses. The whereabouts of these funds can only be supplemented by on-chain tracking—the path of approximately 1.2 million USDT converted to BTC in this round was reconstructed through MetaSleuth's cross-chain tracking.

OFAC Has Previously Extended Actions to Iranian Local Exchanges

CBI addresses are not the only targets of recent U.S. actions against Iran's crypto financial activities.

On June 2, 2026, OFAC listed four Iranian digital asset exchanges—Nobitex, Wallex, Bitpin, and Ramzinex—on its sanctions list. The U.S. Treasury stated that Nobitex had assisted the Central Bank of Iran in obtaining hundreds of millions of dollars in stablecoins to support the depreciating Iranian rial and helped insiders of the Iranian regime access international digital asset exchanges to evade sanctions. Nobitex was sanctioned for being identified as providing support to the Islamic Revolutionary Guard Corps (IRGC) and operating in the Iranian financial sector; Wallex, Bitpin, and Ramzinex were listed under Executive Order 13902 for operating in the Iranian financial sector. The Treasury also noted that these three platforms had processed or facilitated transactions related to the IRGC, Iranian government-supported financial institutions, and sanction evasion activities.

If CBI addresses represent the holding, accumulation, and transfer layer of stablecoins, then Iranian local exchanges serve the functions of asset exchange, domestic circulation, and connection to external markets.

The fund flows from the four addresses also indicate that centralized exchanges remain important downstream nodes. Exchanges like Binance and HitBTC appear in the historical paths of the relevant addresses.

However, transferring addresses to exchanges does not imply that the platforms participated in or were aware of sanction evasion activities. On-chain tagging can only indicate that funds have entered the address systems controlled by the platforms, while account ownership and transaction purposes still require account-level evidence.

HormuzSafe: OFAC Begins to Focus on New Digital Asset Income Entry Points

On July 29, the U.S. Treasury sanctioned HormuzSafe Marine Services Authority and Persian Gulf Marine Insurance Company.

Figure 4｜U.S. Treasury's July 29, 2026, sanction announcement regarding HormuzSafe (Source: U.S. Treasury)

The U.S. Treasury described HormuzSafe as a digital insurance agency developed by the Iranian Ministry of Economy. The agency promotes insurance, traffic control, safety, and emergency services for vessels passing through the Strait of Hormuz and accepts payments in Bitcoin and other digital assets.

The U.S. Treasury stated that HormuzSafe represents the IRGC in generating revenue, attempting to strengthen the Iranian regime's control over shipping activities. OFAC included HormuzSafe in its sanctions list based on its operations in the financial sector of the Iranian economy under Executive Order 13902.

Currently, there is no public evidence indicating that HormuzSafe has direct financial interactions with the four new CBI addresses added on July 14. OFAC has also not disclosed any BTC, TRON, or other cryptocurrency addresses for HormuzSafe.

Therefore, HormuzSafe cannot be described as part of the same confirmed financial chain as the four CBI addresses. However, the two actions reflect different levels of sanction focus:

1. The CBI address action targets stablecoin holdings accumulated on-chain;
2. The HormuzSafe sanctions target business entry points that may continue to generate digital asset income.

The former can be understood as

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.