Overview of the Sanction
On April 24, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated two cryptocurrency wallets as property of the Central Bank of Iran. This action is notable as it marks the first time OFAC has sanctioned wallets directly linked to the Iranian central bank, which has connections to the Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF) and Hizballah.
Details of the Frozen Assets
According to TRM Labs, OFAC coordinated with Tether and U.S. law enforcement to freeze approximately $344.2 million across these two addresses. The wallets had received around $370 million through nearly 1,000 transactions since March 2021. Notably, one wallet has no recorded outbound transfers, while the other has moved less than $16 million against more than $228 million in inflows.
The accumulation of funds in these wallets appears to have concluded by late 2023, after which the balances remained largely dormant until the recent sanctions. This behavior is consistent with that of sovereign reserve storage rather than active operational deployment.
The timing is part of the story. Inflows ran from March 2021 and had largely stopped by late 2023, while the designation itself came on April 24, 2026. An address can sit quiet for years before it is publicly named, so a screening result describes what was known at assessment time rather than settling the question for good.
On-Chain Evidence and Behavioral Analysis
The on-chain analysis indicates that both wallets functioned primarily as terminal repositories, accumulating funds and consolidating them between themselves. Outbound activity from these wallets totaled approximately $25 million in USDT, which is less than 7% of the total volume received. The largest outbound transfer was an $8.6 million transaction between the two designated wallets in January 2022.
- About $344.2 million in USDT frozen across the two designated addresses.
- Roughly $370 million received through nearly 1,000 transactions since March 2021.
- One address with no recorded outbound transfers at all.
- The other moved less than $16 million against more than $228 million in inflows.
- Around $25 million sent out in total, under 7% of the volume received.
- The largest single outbound transfer, $8.6 million, moved between the two designated addresses in January 2022.
TRM Labs has previously documented a pattern of crypto-enabled sanctions evasion by Iran, including the designation of exchanges like Zedcex and Zedxion in January 2026. These exchanges were linked to IRGC-controlled wallets and facilitated significant crypto transactions, further integrating cryptocurrency into Iran's financial system.
Implications for Compliance and Future Actions
The recent sanctions have significant compliance implications for organizations operating within the cryptocurrency space. Entities with exposure to these wallets should conduct thorough reviews of their counterparty and transaction-level exposure to identify any indirect connections to the broader network associated with these wallets.
This action indicates that sovereign-level actors are now directly engaging with crypto settlement rails, which may prompt further scrutiny and regulatory actions in the future. Organizations should remain vigilant and adapt their compliance frameworks accordingly.
If an address from this case turns up in your own history, start with the narrowest question you can answer: was there a direct transfer, or a connection several hops away? Both matter for a review, which is why the guidance above points at counterparty and transaction-level exposure rather than direct contact alone. You can pull address-level context with the wallet checker, compare public risk labels in the sanctions directory, and check the original listing before drawing a conclusion.
- Terminal repository wallet
- A wallet used mainly to accumulate and hold funds, with limited outbound activity compared with its inflows.
For address-level context, use TrustSniffer’s wallet-risk checker and treat the result as a screening signal rather than proof of ownership, intent, or wrongdoing.
Known public risk labels can also be reviewed in the TrustSniffer sanctions directory, with the original authority checked before a decision is made.
