Blockchain analytics firm Chainalysis has released a detailed report exposing the stablecoin pipeline behind the $344 million USDT freeze linked to Iranian networks. The freeze, executed by Tether on April 23, 2026, in coordination with the U.S. Treasury's Office of Foreign Assets Control (OFAC), targeted two cryptocurrency addresses associated with the Central Bank of Iran (CBI) network.
Multi-Layered Money Flow: Brokers, Intermediaries, and DeFi Protocols
Chainalysis traced the funds through a complex multi-step process: Iranian-linked brokers first purchased stablecoins with fiat currency, then routed the USDT through intermediate wallets, across cross-chain bridges and DeFi protocols for mixing and obfuscation, before the funds cycled back into the Iranian domestic crypto ecosystem and ultimately reached entities affiliated with the Islamic Revolutionary Guard Corps (IRGC). OFAC added the two CBI-linked addresses to its sanctions list on April 23, with on-chain data exactly matching the frozen amount.
The analysis reveals that as early as late 2025, sanctioned individual Babak Morteza Zanjani published leaked documents containing cryptocurrency addresses he claimed were tied to the Central Bank of Iran. Those materials indicated that a broker helped the regime acquire stablecoins with fiat currency. That broker had exposure to Alireza Derakhshan, who coordinated over $100 million in crypto purchases linked to Iranian oil sales from 2023 to 2025. Chainalysis outlined a transaction flow where funds moved from brokers into stablecoins, through intermediary wallets, across bridges and DeFi protocols, before returning to Iranian crypto channels and IRGC-affiliated entities.
Strait of Hormuz Risk: Stablecoins as Toll Payment Tool?
The report also highlights fresh compliance risks around the Strait of Hormuz. Iran reported collecting toll payments from commercial vessels, while scammers allegedly targeted shipping firms trying to comply with those demands. Some companies paid fraudulent actors and were later confronted by IRGC naval vessels after Iranian authorities did not receive the funds. If stablecoin use is confirmed, Chainalysis noted it would fit the pattern of recent Iranian on-chain activity.
Chainalysis stated in its blog post: “Iran’s digital asset networks provide the critical financial infrastructure needed to launder the billions of dollars generated by these shadow fleet vessels back to the IRGC and Iran-aligned terrorist organizations across the region.” The analysis shows how Central Bank of Iran funds were laundered through several bridge and DeFi protocols before being cycled back into the mainstream Iranian crypto ecosystem, forming a continuous, traceable pathway linking funding sources, routing layers, and sanctioned entities.
This incident underscores the central role of stablecoins in Iran’s sanctions evasion network, as well as the enhanced ability of law enforcement to combat such activities through on-chain analysis. Future monitoring and freezing of Iran-linked cryptocurrency addresses are expected to intensify.