Share this article

Israel Links Wallets That Received $1.5B in Stablecoins to Iran's Revolutionary Guard

Israel flagged 187 crypto addresses allegedly linked to the IRGC. Elliptic says the wallets received $1.5B in USDT, though not all may belong to Iran’s Revolutionary Guard.

Updated Sep 17, 2025, 12:36 p.m. Published Sep 16, 2025, 12:37 p.m.
Map of Iran with a pin just north of Esfahan. (Tudoran Andrei/Shutterstock)
Map of Iran with a pin just north of Esfahan. (Tudoran Andrei/Shutterstock/Modified by CoinDesk)

What to know:

  • Israel’s counter-terror bureau listed 187 crypto addresses it claims are tied to Iran’s Islamic Revolutionary Guard Corps, sanctioned by the U.S., EU, U.K. and Canada.
  • Blockchain analytics firm Elliptic said those addresses received $1.5B in USDT, but cautioned that some may belong to exchanges rather than directly to the IRGC.
  • Tether has already blacklisted 39 of the flagged wallets, freezing $1.5M, amid rising scrutiny of Iran’s alleged use of crypto to evade sanctions.

The National Bureau for Counter Terror Financing of Israel (NBCTF) has published a list of 187 cryptocurrency addresses it says are linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), a group sanctioned and designated as terrorist by the U.S., EU, U.K. and Canada.

According to blockchain analytics firm Elliptic, those addresses collectively received $1.5 billion in USDT, Tether’s dollar-pegged stablecoin. However, Elliptic cautioned that it cannot verify that all these funds are directly connected to the IRGC, since some wallets may belong to exchanges or services used by multiple customers.

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters

The use of USDT exposes such wallets to one of Tether’s most powerful compliance tools: blacklisting. Of the 187 addresses flagged by Israel, 39 had already been frozen by Tether as of Sept. 13, preventing further transfers of roughly $1.5 million in USDT.

Iran’s Revolutionary Guard has been tied to illicit crypto activity for years. Just last week, the U.S. Justice Department seized nearly $600,000 in USDT from an Iranian national accused of building drone navigation systems for the IRGC.

In December 2024, U.S. Treasury sanctions targeted wallets linked to IRGC networks moving more than $300 million in stablecoins via an intermediary connected to Yemen’s Houthis.

And in June 2025, the pro-Israel hacker group Gonjeshke Darande (“Predatory Sparrow”) stole $90 million from Iranian crypto exchange Nobitex, which Elliptic and others have linked to IRGC activities including ransomware operations. The hackers “burned” the stolen funds in vanity wallets marked with anti-IRGC slogans, and even leaked Nobitex’s source code.

The hack was seen as a hammer blow to Iran, which is alleged to have used crypto to evade sanctions.

UPDATE, Sep. 17 12:46 UTC: Updates headline.

More For You

Protocol Research: GoPlus Security

GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

More For You

Nasdaq, home of Coinbase, Strategy stocks, seeks 23-hour trading amid investor demand

Nasdaq logo on a screen

Crypto's 24/7 trading has influenced investor expectations, with Nasdaq acknowledging that many of its clients are already active overnight.

What to know:

  • Nasdaq plans to expand stock and exchange-traded product trading to 23 hours a day, five days a week, according to a filing.
  • The move follows similar initiatives by the New York Stock Exchange and reflects growing global demand for extended market access.
  • Always-on cryptocurrency trading has influenced investor expectations, with Nasdaq acknowledging that many of its clients are already active overnight.