Israel claims Iran's revolutionary guard holds $1.5B in stablecoins

What to know

• Israel’s counter-terror bureau listed 187 crypto addresses it claims are tied to Iran’s Islamic Revolutionary Guard Corps, sanctioned by the U.S., EU, U.K. and Canada.

• Blockchain analytics firm Elliptic said those addresses received $1.5B in USDT, but cautioned that some may belong to exchanges rather than directly to the IRGC.

• Tether has already blacklisted 39 of the flagged wallets, freezing $1.5M, amid rising scrutiny of Iran’s alleged use of crypto to evade sanctions.

The National Bureau for Counter Terror Financing of Israel (NBCTF) has published a list of 187 cryptocurrency addresses it says are linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), a group sanctioned and designated as terrorist by the U.S., EU, U.K. and Canada.

According to blockchain analytics firm Elliptic, those addresses collectively received $1.5 billion in USDT, Tether’s dollar-pegged stablecoin. However, Elliptic cautioned that it cannot verify that all these funds are directly connected to the IRGC, since some wallets may belong to exchanges or services used by multiple customers.

The use of USDT exposes such wallets to one of Tether’s most powerful compliance tools: blacklisting. Of the 187 addresses flagged by Israel, 39 have already been frozen by Tether as of September 13, preventing further transfers of roughly $1.5 million in USDT.

Iran’s Revolutionary Guard has been tied to illicit crypto activity for years. Just last week, the U.S. Justice Department seized nearly $600,000 in USDT from an Iranian national accused of building drone navigation systems for the IRGC.

In December 2024, U.S. Treasury sanctions targeted wallets linked to IRGC networks moving more than $300 million in stablecoins via an intermediary connected to Yemen’s Houthis.

And in June 2025, the pro-Israel hacker group Gonjeshke Darande (“Predatory Sparrow”) stole $90 million from Iranian crypto exchange Nobitex, which Elliptic and others have linked to IRGC activities including ransomware operations. The hackers “burned” the stolen funds in vanity wallets marked with anti-IRGC slogans, and even leaked Nobitex’s source code.

The hack was seen as a hammer blow to Iran, which is alleged to have used crypto to evade sanctions.