Five Anomalies in OFAC-Sanctioned Wallets Suggest $344 Million USDT Freeze May Not Be Iran-Linked
In a significant revelation, blockchain intelligence firm Nominis has identified five anomalies in the wallets associated with the recent $344 million Tether (USDT) freeze, suggesting that the funds may not be linked to Iran as initially presumed. Nominis CEO Snir Levi published an analysis that scrutinizes the behavioral patterns of these sanctioned addresses, indicating a potential overlap with Chinese state-linked infrastructure rather than connections to the Islamic Revolutionary Guard Corps (IRGC).
1. The Wallets Accumulated, Then Went Dormant
The designated wallets began their activity by moving Tether in mid-2021, with high-value transfers peaking in early 2023. However, following February 2023, these wallets experienced a significant decrease in activity, becoming largely inactive. This “accumulate-then-freeze” pattern stands in stark contrast to historical IRGC flows, which typically keep funds in constant motion to evade seizure. This disparity raises questions about the ownership and intent behind the frozen wallets.
2. Concentrated Balances Break From Past IRGC Patterns
Traditionally, IRGC-related wallets tend to distribute funds across multiple addresses, capping individual balances at just a few million dollars and cycling their holdings quickly to minimize exposure to potential freezes. In contrast, the wallets in question have amassed large, sustained balances over extended periods, deviating from these established IRGC patterns. This unusual behavior further complicates the narrative that these funds are linked to Iranian entities.
3. Direct Exposure to Huobi and Huione Infrastructure
One of the root wallets within the cluster has been traced back to transfers involving Huobi, now known as HTX, along with connections to the Huione Group infrastructure. Levi noted that such activity aligns with behavioral trends observed across Chinese-dominated exchanges from around 2021. The connections to these platforms suggest a more intricate web of interactions than previously understood, potentially indicating a different operational focus.
4. Asia-Aligned Operational Timing
An interesting finding from Nominis involves a separate HTX deposit address that received approximately $600,000 from wallets associated with the Central Bank of Iran. However, the temporal analysis of this address reveals that the trading cycles align more closely with Asian market operations rather than the working hours of Tehran. This suggests that the wallets may be operating within a framework that is more influenced by Asian market dynamics than by Iranian interests.
5. Bitfinex Interactions and a 2025 Scam Overlap
Further complicating the narrative, one of the sanctioned wallets exhibited interactions with Bitfinex-linked addresses, including small periodic transfers. This wallet also received a $5 transaction that Levi speculated could be indicative of testing behavior. Notably, the same wallet was identified in 2025 within a flow related to a scam, raising concerns about the potential for retail users to be indirectly exposed to sanctioned infrastructure.
Where the Findings Sit Within Operation Epic Fury
These findings emerge amidst broader efforts by the U.S. Treasury, which has reportedly seized nearly $500 million in Iranian cryptocurrency under Operation Epic Fury. The $344 million in Tether frozen at the request of the Office of Foreign Assets Control (OFAC) represents the largest single on-chain action in this campaign. As investigations continue, the anomalies highlighted by Nominis may prompt a reevaluation of the assumptions surrounding these sanctioned wallets and their connections to Iran.
In conclusion, while the initial narratives pointed to Iranian affiliations, the emerging data suggests a more complex picture. The overlaps with Chinese state-linked infrastructure and the unique behavioral patterns of these wallets merit further scrutiny and could redefine the understanding of sanctioned cryptocurrency flows moving forward.