A blockchain intelligence firm Chainalysis has published a detailed analysis of the $344 million USDT freeze that took place on April 23, 2026, revealing how funds linked to Iran’s central bank were routed through a complex network of intermediaries, DeFi protocols, and cross-chain bridges. The freeze was executed by Tether in coordination with the U.S. Office of Foreign Assets Control (OFAC) and law enforcement agencies, bringing Tether’s total frozen assets since launch to $4.4 billion. In a blog post dated April 27, Chainalysis traced the flow of funds from sanctioned actors through multiple layers, highlighting the evolving use of stablecoins for sanctions evasion.
OFAC Sanctions Two Crypto Addresses Linked to Iran’s Central Bank
On the same day as the freeze, OFAC updated its sanctions list to include two cryptocurrency addresses associated with Iran’s central bank. Chainalysis linked these addresses to activity involving Iranian exchanges and intermediary wallets that interacted with central-bank-affiliated accounts. The frozen balances corresponded to $344 million in USDT. According to Chainalysis, “Iran’s digital asset networks provide the critical financial infrastructure necessary to launder billions of dollars earned by its ghost fleet of oil tankers back to the IRGC and Iran-aligned terrorist organizations across the region.” The timing of the wallet freezes, intermediary routing, and sanction designations suggests a coordinated enforcement framework.
Routed Through Intermediaries, Bridges and DeFi
The analysis also referenced an earlier leak of documents in late 2025 involving sanctioned individual Babak Morteza Zanjani, which included crypto addresses he claimed were linked to Iran’s central bank. Chainalysis said the materials showed an intermediary helped the regime purchase stablecoins with fiat currency. That intermediary had ties to Alireza Derakhshan, who coordinated over $100 million in crypto purchases between 2023 and 2025 tied to Iran’s oil sales. Chainalysis described a transaction flow where funds moved from intermediaries into stablecoins, through intermediary wallets, bridges, and DeFi protocols, before returning to Iran’s mainstream crypto channels and ultimately to affiliates of the Islamic Revolutionary Guard Corps (IRGC). This layered approach allowed funds to be laundered through multiple on-chain protocols, making detection more difficult but still traceable.
New Risks in the Strait of Hormuz: Stablecoins as a Payment Tool
Chainalysis also highlighted emerging compliance risks around the Strait of Hormuz. Iran has announced that it will collect transit fees from commercial vessels, and fraudsters have reportedly targeted shipping companies attempting to pay these fees. Some companies paid scammers and later encountered IRGC Navy vessels when Iranian authorities did not receive the money. Payment methods are still under investigation, but Chainalysis noted that stablecoin use would align with Iran’s recent on-chain activity if confirmed. The firm stated: “Funds from Iran’s central bank were laundered through multiple bridge and DeFi protocols before being channeled back into Iran’s mainstream crypto system.” The analysis underscores how stablecoins are increasingly central to Iran-linked networks, posing new challenges for global sanctions enforcement.