Marina Lubimova
Treasury Secretary Scott Bessent said approximately $130 million in digital assets had been frozen as part of an action targeting Iran-linked financial infrastructure. The amount is modest relative to the broader crypto market. The transaction history is more significant because it shows how sanctioned institutions can use stablecoins to build reserves outside traditional banking channels and how centralized token issuers can still restrict those reserves.
$370 Million In, $25 Million Out
According to TRM Labs, two designated wallets received approximately $370 million across nearly 1,000 transactions over more than five years. Inflows began in March 2021. Only about $25 million in USDT left the two addresses during their lifetimes, equivalent to less than 7% of the value received.
One wallet accumulated approximately $141 million and sent out $9.7 million. The other received roughly $229 million and transferred $15.7 million outward.
| Wallet | Total received | Total sent | Outflow rate |
| Wallet 1 | $141M | $9.7M | 6.9% |
| Wallet 2 | $229M | $15.7M | 6.9% |
| Combined | $370M | $25.4M | 6.9% |
The wallets did not show the behavior expected from operating accounts. They did not regularly settle payments, distribute funds to multiple counterparties or route balances into identifiable exchange deposit addresses.
The limited outbound activity also remained concentrated inside the same wallet network. In January 2022, one address transferred approximately $8.6 million directly to the other. The largest external destination received around $11 million through four transfers in early 2023, but that destination was another related wallet rather than an exchange.
By late 2023, most accumulation had ended. The funds then remained largely undisturbed until the sanctions action.
A Layer Between Liquidity and Reserves
The transaction map shows that the designated wallets were not funded only through direct transfers.
An institutional platform sent approximately $145 million across 19 transactions into two intermediary wallets. Those intermediaries then moved roughly $109 million through seven transactions into four wallets associated with the Central Bank of Iran.
An Asia-based payment processor supplied another $56.5 million across nine transfers directly into the same destination cluster.
Use the supplied transaction diagram:
- Institutional platform → $145M in 19 transfers → intermediary wallets
- Intermediary wallets → $109M in seven transfers → OFAC-designated Central Bank of Iran wallets
- Asia-based payment processor → $56.5M in nine transfers → designated wallets
The intermediary layer reduced direct exposure between the reserve addresses and the platforms supplying liquidity. That structure resembles traditional sanctions-evasion networks, where shell companies and correspondent accounts separate the source of funds from the final beneficiary.
Here, wallet addresses replaced part of that corporate infrastructure. The design also made the reserve accounts less visible through normal exchange monitoring. Neither of the two wallets showed outbound transfers to identified exchange deposit addresses, according to the supplied TRM analysis.
The Freeze Happened Above the Blockchain
OFAC can designate an address, but it cannot stop a permissionless blockchain from processing a valid transaction. The practical restriction depends on the asset held in the wallet and the centralized companies supporting it.
That distinction is central to the case.
The wallets accumulated USDT, a dollar-backed stablecoin issued by Tether. Unlike a native blockchain asset such as Bitcoin, USDT includes an issuer-controlled enforcement layer. Tether can blacklist addresses and prevent affected tokens from being transferred.
The sequence is therefore more precise than the headline suggests:
- Investigators attributed the wallets to sanctioned Iranian infrastructure.
- OFAC designated the addresses.
- The stablecoin issuer made the balances non-transferable.
Treasury supplied the legal action. The issuer supplied the technical control. The blockchain continued operating normally.
Why Reserve Wallets Matter
Operational wallets are relatively easy to identify because they interact frequently with exchanges, merchants, payment processors and other counterparties. Their transaction patterns reveal how the network functions.
Reserve wallets are quieter. They collect funds, consolidate balances and remain inactive until liquidity is needed.
That makes them harder to classify early, but more valuable once identified. Blocking an operating wallet can interrupt a payment route. Blocking a reserve wallet can immobilize capital accumulated across many routes and counterparties.
The two wallets analyzed by TRM appear to have served this second function. Their low outflow rate, internal transfers and lack of exchange deposits suggest they were built to preserve liquidity rather than circulate it.
- Funds received: $370M
- Funds transferred out: $25.4M
- Funds retained before later sanctions and balance changes: approximately $344.6M
- Lifetime retention rate: approximately 93.1%
This does not mean the full retained amount was still present when the latest freeze occurred. It shows how the wallets functioned over their lifetimes: most incoming value was stored rather than spent.
The Risk Moves to Stablecoin Issuers
The immediate market effect is limited. A freeze of roughly $130 million is too small to materially affect total stablecoin supply or broad crypto liquidity.
The larger consequence falls on issuers, exchanges and institutions handling dollar-backed tokens. Stablecoins are widely used because they combine blockchain settlement with a relatively stable dollar value. The same structure also creates a concentrated control point. Users can transfer tokens without a bank, but they remain exposed to the issuer’s compliance decisions.
For sanctioned entities, this creates a trade-off. USDT offers deeper liquidity and lower volatility than many decentralized assets, but balances can become unusable if their addresses are identified.
For institutions, the episode expands the scope of counterparty risk. A token may remain technically present in a wallet while becoming impossible to move, redeem or deposit through compliant services. That risk is not visible through price volatility alone.
Sanctions Enforcement Is Targeting the Balance Sheet
Earlier crypto enforcement often focused on payment routes: exchanges, mixers, brokers and addresses actively moving funds.
The latest action points toward a broader target. Authorities are now identifying where sanctioned networks store accumulated capital, not only where they process transactions.
The distinction matters. Payment infrastructure can be replaced. A sanctioned entity can create new addresses, change intermediaries or move to another platform. Rebuilding a reserve position accumulated over several years is more difficult.
The two wallets received funds from March 2021 onward, drew liquidity from institutional and Asia-based payment channels, and retained more than 93% of their lifetime inflows. Their value came from accumulation, not transaction volume.
The freeze therefore exposed a weakness in Iran’s crypto strategy. Public blockchains can move assets outside traditional banking networks, but dollar stablecoins remain dependent on centralized issuers. Once reserve addresses are attributed, the same instrument that provided access to dollar liquidity can become a mechanism for locking it away.
Marina Lubimova
