The freeze that started it
On 14 July 2026 the U.S. Treasury sanctioned the Central Bank of Iran and named four cryptocurrency wallets. Within the hour the stablecoin issuer froze all four on TRON, locking roughly $130 million in USDT on-chain. Frozen funds are visible but permanently immobile. The obvious next question for any analyst is: where did that money come from, and where was it going? So we followed it — one wallet at a time — using our on-chain risk engine.
How we traced it
This is standard blockchain graph analysis, not a black box. For each of the four wallets we pulled its full USDT transfer history on TRON, mapped every counterparty, and enriched each one against our own registry of sanctioned addresses and labelled exchange wallets — so we could tell a private pass-through wallet apart from a Binance hot wallet at a glance. We then followed the largest flows outward, backward toward the source and forward toward the cash-out, filtering out high-traffic exchange wallets that everyone touches so they couldn't create false links.
The four sanctioned wallets
The four wallets split cleanly into two roles — two are active conduits that move money in and out, and two are cold vaults that received a large deposit and simply held it until the freeze. Each links to its live TrustSniffer verdict:
- TXGHxdYbGy574z5hBu4LNzq9NzjZQ9bhUf — conduit. Took in $108.6M and pushed $85.5M to TFQb.
- TFQbqaNbmq2xsVor2NbufLkYZvxFC9wC7k — cold storage. Received $85.5M and never moved a cent of it.
- TAhwhFv3JpK39Nc2m8W5LPCcoTisutiRfp — conduit. Funded with $56.5M by a payment processor; distributed the rest downstream.
- TJdgB1k6ot3f2nLuZug6D8eD3HavTmzmSK — holding. Received $33M and held ~$30.6M until the freeze.
Upstream — where the money came from
The inflows did not arrive directly. They came down a chain of consolidation wallets, each a near-perfect pass-through (money in ≈ money out, net roughly zero) — a textbook layering pattern designed to put distance between an origin and its destination:
- A source hub moved $145.3M into a first pass-through wallet.
- That wallet ($156M through it, net ~$0) forwarded $96.9M to a second consolidation wallet.
- The second consolidation wallet ($122M through it, net ~$0) pushed $108.6M into the sanctioned conduit TXGH.
- Separately, a crypto payment processor's hot wallet fed $56.5M straight into the sanctioned conduit TAhw.
Downstream — the cash-out
The forward trail is where sanctioned money tries to become spendable. The conduit TAhw sent $18.2M to a single distribution hub that, in turn, cycled $134M across 266 wallets and funnelled it toward deposit addresses our engine attributes to mainstream exchanges — five separate Binance hot wallets, plus MaskEX and 88EX. These are the off-ramps: the point where illicit flows attempt to convert to fiat, and exactly where an exchange's compliance team is positioned to freeze the deposit.
Key findings
- The four sanctioned wallets are one operator's cluster — they transact among themselves and share deliberate vanity address patterns, linked by dust transfers.
- Money entered through layering — chained pass-through wallets ($145M → $156M → $122M) plus a payment processor ($56.5M).
- Money exited toward mainstream exchanges — the strongest, most actionable signal: the cash-out reaches Binance, MaskEX and 88EX deposit addresses.
- Two wallets were pure cold storage (~$116M sitting still), two were the working conduits.
Why it matters
A sanctions designation names a wallet; on-chain analysis reveals the network around it — the funding path that fed it and the off-ramps it was reaching for. That network view is what turns a static blacklist into something actionable: the same tracing that mapped these flows runs on every address you can check in our directory, and the aggregate picture lives in the Risk Index. If there's a hidden connection or a fraudulent transaction, we sniff it out.
