Elliptic experts uncovered a network of crypto wallets allegedly linked to the Central Bank of Iran, holding 507 million USDT. The firm suggested these funds were used to support the rial’s value amid international sanctions.
The study was based on two known tranches in which the regulator bought USDT with dirhams in April and May 2025. Using these as a starting point, the experts identified a broader cluster of interconnected wallets.
The report says the Central Bank of Iran systematically and deliberately accumulated crypto assets. Until June 2025, these funds were routed to the local exchange Nobitex.
However, later — after the exchange was hacked — USDT began to be moved via a cross-chain protocol from the TRON network to Ethereum. They were then converted into other tokens through decentralized and centralized exchanges, and partially bridged out to other blockchains. According to Elliptic, this process continued through the end of 2025.
As a reminder, the Nobitex hack was carried out by the pro-Israel group Gonjeshke Darande. The damage is estimated at up to $90 million. The stated reason was that the exchange is allegedly a tool used by Iranian authorities to evade sanctions and to finance the Islamic Revolutionary Guard Corps.
According to the report, the regulator used USDT for two purposes:
The first thesis is supported by the fact that the USDT purchases align with periods of accelerated rial devaluation.
Summing up the report, the firm’s experts emphasized that blockchain transparency makes it possible to trace and block such financial flows.
Earlier, Israel’s National Bureau for Counter Terror Financing (NBCTF) published a list of 187 cryptocurrency addresses linked to the Corps. USDT worth $1.5 billion passed through them.


