Arkham said it has identified on-chain addresses belonging to the Central Bank of Iran, using a coordinated $344 million USDT freeze as the breakthrough that exposed the state entity’s crypto infrastructure for the first time. The action involved two Tron wallets, which now form the basis of Arkham’s newly labeled entity page.
The firm said those two wallets are currently the full set of addresses listed under the Central Bank of Iran on its platform. Almost all funds in both wallets have already been frozen, so they are no longer useful for moving liquidity. Still, the wallets remain important for investigators, because historical transfers can be used to trace routes to other addresses that may still be active.
Freeze action created the starting point for attribution
According to the source material, in April 2026 Tether worked with the Office of Foreign Assets Control and US law enforcement to freeze more than $344 million in USDT held in two Tron addresses. US officials said the wallets were linked to suspected Iranian sanctions evasion.
Arkham researchers then analyzed the flagged addresses on-chain, following transaction patterns and connecting the flows to Iran’s central bank. That attribution gives investigators, researchers, and compliance teams a documented starting point for mapping Tehran’s digital asset activity.
Arkham says the visible wallets are likely only part of the network
The report says Iran has long used blockchain infrastructure to work around traditional financial channels constrained by international sanctions. In Arkham’s view, the two exposed Tron wallets are an entry point, not a complete picture. The company said Iran likely controls a broader set of unidentified wallets beyond what is currently visible on the entity page.
Arkham added that the wider network may connect to Iranian and Russian exchanges, including Nobitex and the sanctioned Garantex platform. The identified addresses are presented as a foundation for deeper investigative work, not as a full inventory of state-held crypto assets.
US enforcement widened beyond the initial wallet freeze
On May 11, the US Treasury Department said its ongoing “Economic Fury” campaign had led to the freezing of nearly $500 million in regime-linked cryptocurrency. Treasury Secretary Scott Bessent said the department would “continue to cut the Iranian regime off from the financial networks it uses to carry out terrorist acts and to destabilize the global economy.”
The day after Tether’s freeze, US sanctions targeted Iran-linked crypto wallets, and Treasury said it would track every financial lifeline the regime tried to move outside the country.
A separate investigation cited in the report said the IRGC had funneled close to $1 billion since 2023 through two UK-registered exchanges, mostly using USDT on Tron. TRM Labs described that activity as a repeatable financial channel rather than one-off usage. The Trump administration later imposed its first sanctions on digital asset exchanges under Iran-related authorities, naming two platforms accused of handling large volumes of IRGC-linked transactions.
Arkham had also previously reported that during the fragile ceasefire that began in April 2026, Iran demanded shipping companies pay a Bitcoin toll to pass through the Strait of Hormuz, using BTC because it was non-sovereign and harder to confiscate. The firm separately tracked sharp outflows from Iranian exchange Nobitex in the hours after US and Israeli airstrikes, as state-linked actors and retail users moved liquidity into self-custody.