Israel claims Iran's revolutionary guard holds $1.5B in stablecoins
|What to know
-
Israel’s counter-terror bureau listed 187 crypto addresses it claims are tied to Iran’s Islamic Revolutionary Guard Corps, sanctioned by the U.S., EU, U.K. and Canada.
-
Blockchain analytics firm Elliptic said those addresses received $1.5B in USDT, but cautioned that some may belong to exchanges rather than directly to the IRGC.
-
Tether has already blacklisted 39 of the flagged wallets, freezing $1.5M, amid rising scrutiny of Iran’s alleged use of crypto to evade sanctions.
The National Bureau for Counter Terror Financing of Israel (NBCTF) has published a list of 187 cryptocurrency addresses it says are linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), a group sanctioned and designated as terrorist by the U.S., EU, U.K. and Canada.
According to blockchain analytics firm Elliptic, those addresses collectively received $1.5 billion in USDT, Tether’s dollar-pegged stablecoin. However, Elliptic cautioned that it cannot verify that all these funds are directly connected to the IRGC, since some wallets may belong to exchanges or services used by multiple customers.
The use of USDT exposes such wallets to one of Tether’s most powerful compliance tools: blacklisting. Of the 187 addresses flagged by Israel, 39 have already been frozen by Tether as of September 13, preventing further transfers of roughly $1.5 million in USDT.
Iran’s Revolutionary Guard has been tied to illicit crypto activity for years. Just last week, the U.S. Justice Department seized nearly $600,000 in USDT from an Iranian national accused of building drone navigation systems for the IRGC.
In December 2024, U.S. Treasury sanctions targeted wallets linked to IRGC networks moving more than $300 million in stablecoins via an intermediary connected to Yemen’s Houthis.
And in June 2025, the pro-Israel hacker group Gonjeshke Darande (“Predatory Sparrow”) stole $90 million from Iranian crypto exchange Nobitex, which Elliptic and others have linked to IRGC activities including ransomware operations. The hackers “burned” the stolen funds in vanity wallets marked with anti-IRGC slogans, and even leaked Nobitex’s source code.
The hack was seen as a hammer blow to Iran, which is alleged to have used crypto to evade sanctions.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers.