US Treasury Secretary Scott Bessent introduced sanctions on a network of Iran-linked Bitcoin crypto wallets this week, freezing $344 million in crypto. This is one of the largest single enforcement actions focusing Tehran’s on-chain infrastructure.
The move occurred amid as the Trump administration increases economic pressure on Iran during active nuclear negotiations, and it alerts that the Treasury is no longer treating crypto as a peripheral sanctions enforcement problem.
Iran’s crypto ecosystem was valued at more than $7.78 billion last year, increasing rapidly than in 2024, and the Islamic Revolutionary Guard Corps now accounts for half of all on-chain activity.
How Iran Changed USDT and State Bitcoin Mining Into a Sanctions Bypass Machine
The Central Bank of Iran bought more than $500 million in USDT last year. Allegedly and systematically routing reserves by a US dollar-pegged stablecoin to circumvent SWIFT-relies banking rails. Elliptic flagged the purchases in a January report, calling it part of a deliberate strategy to access dollar liquidity without touching the correspondent banking system.
USDT’s appeal is structural. It contains dollar stability without needing a US bank account, commits on public blockchains in minutes, and moves freely across borders. Iran has been exploiting that window intensely.
Geopolitical flashpoints like the Strait of Hormuz dispute have only increased the incorporation: in early April, Iranian authorities declared that they would need oil ships transiting the strait to pay tolls in bitcoin, standardizing crypto’s role in sovereign trade infrastructure.
On-Chain Loopholes Multiplying?
OFAC tied the frozen $344 million particularly to USDT wallets to Iran’s oil payment masking operations, with Tether blacklisting the flagged addresses.
But the gaps stays visible in the transaction data. Between February 28 and March 2, following US-Israel strikes, on-chain analytics identified $10.3 million in crypto asset outflows from Iran connected Bitcoin wallets. Chainalysis validates that some of those wallets had historical exposure to IRGC-identified addresses, demonstrating state-level fund movement in real time.
Before Israel’s 12-day war in June 2025, TRM Labs detected a 150% spike in outflows from Nobitex. Within minutes of the first strike, persisting volumes increased 700%. Even when $90 million was stolen from Nobitex in a June 18 cyberattack connected to Israel-connected group Predatory Sparrow, the platform’s 11 million users kept trading. The ecosystem absorbed the hit.
Martin stated regulators “are coming to understand” that cryptocurrencies are being used at scale for sanctions evasion, and more designations are coming. If Treasury coordinates its next wave of actions with DOJ and FinCEN to target virtual asset service providers processing Iranian flows, and pressures stablecoin issuers to implement proactive blocking instead of reactive blacklisting.
