US Freezes Near $1B in Iran Crypto, Traces $3.84B Via CoinEx

The Treasury has frozen or seized nearly $1 billion in Iranian cryptocurrency since February and traced more than $3.84 billion in Iran-linked transfers through CoinEx, a single offshore exchange. The actions are part of Operation Economic Fury, the sanctions program Treasury Secretary Scott Bessent introduced on April 14 as the financial arm of the US response to the military conflict that began with joint US and Israeli strikes on Tehran in February.

April brought the first major crypto action, when Tether froze about $344 million in USDT across two Tron wallets after US authorities linked the addresses to Iranian networks. One wallet held roughly $213 million, the other about $131 million. Treasury escalated in June, designating four Iranian exchanges: Nobitex, Wallex, Bitpin, and Ramzinex. Nobitex, the largest, handles about half of Iran's trading volume, according to Chainalysis, and claims 11 million users. Treasury also put CEO Seyed Ali Khoee and chairman Amir Hossein Rad on the OFAC list, exposing them to asset freezes and travel restrictions.

In July, Treasury froze an additional $131 million in USDT held in four Tron wallets tied to the Central Bank of Iran. Bessent said on X that Treasury remained "committed to disrupting and degrading Iran's illicit financial activities, including its abuse of digital assets." By late July, the cumulative total of Iranian crypto frozen or seized had approached $1 billion, Bessent said. Treasury officials had tracked Iranian crypto networks since at least 2024, when Chainalysis and TRM Labs began publishing research on the scale of Iranian stablecoin adoption. The strikes shifted that work from monitoring to enforcement.

CoinEx and the Bybit Overlap

The offshore picture came into focus June 24, when the Wall Street Journal reported that Iran-linked entities had moved more than $3.84 billion through CoinEx since 2019. TRM Labs data and public on-chain analysis cited in the report showed the exchange had become one of the primary routes for moving funds outside US sanctions. Investigators also connected two wallets controlled by the Central Bank of Iran to assets stolen from Bybit in a hack worth roughly $1.5 billion.

CoinEx denied knowledge of the activity. The exchange said on-chain fund flows through a platform do not prove knowledge or participation, and that it had strengthened Iran-related risk reviews, geo-fencing, sanctions screening, and transaction monitoring. The exchange has not been sanctioned. TRM Labs data cited in the same report showed several smaller offshore platforms with limited compliance operations also processed Iranian volumes.

The flows ran from 2019 through 2026. For most of that stretch Iran was on the Financial Action Task Force blacklist, and Chainalysis and TRM Labs had published research on the scale of Iranian stablecoin adoption ahead of the conflict. Billions in Iran-linked transfers moved through one exchange without an enforcement action; reporters exposed them first. CoinEx's combination of low fees and minimal identity checks during the relevant years drew the volume, and the platform operated in jurisdictions Iranian users could reach without VPN workarounds.

The FBI attributed the Bybit hack to North Korean state hackers, and on-chain trackers had tied about $3 billion in THORChain swap volume to the stolen assets. Whether Iran and North Korea coordinate their crypto channels or simply converge on the same low-compliance venues is an open question.

Why the Freezes Hit USDT on Tron

The most effective enforcement tool in the campaign is a feature of the stablecoin itself. USDT carries issuer-level controls that let Tether freeze a specific address with a single transaction, blocking transfers no matter who holds the private key. Every major freeze in the Iran campaign has hit USDT on Tron, the network that dominates stablecoin transfers in emerging markets because of its low fees and fast settlement.

Combined, the two rounds froze $475 million.

Tether is incorporated offshore and falls outside direct US regulatory authority, yet it has consistently honored US law enforcement freeze requests. The record reflects the company's dependence on US banking relationships and the risk of OFAC designation if it refused.

The same lever does not exist for Bitcoin. Decentralized assets cannot be frozen by any issuer, and exchanges and bridges that skip identity checks give Iranian operators routes around the choke points Washington can reach. Tron is the dominant chain for Iranian stablecoin activity. On-chain analysis also shows Ethereum-based assets and bitcoin used in larger transfers. Iran's bitcoin mining industry, running on cheap electricity from the country's energy sector, supplies a steady stream of coins outside the system Washington can freeze. Mined coins are mixed with purchased ones to obscure provenance.

Chainalysis estimated Iranian crypto outflows at $4.18 billion in 2025, up 70% from the previous year. The jump coincided with the rial losing roughly 40% of its value against the dollar and with sanctions that cut Iran further from the global banking system. The $1 billion frozen since February is less than a quarter of one year's outflows by that estimate, and it counts only assets investigators identified. The total also excludes Iranian-linked crypto that moved through compliant venues and escaped enforcement. Peer-to-peer trading and transfers routed outside exchange rails are not in the data at all.

The sanctions also hit a civilian user base. Nobitex says it serves 11 million people, a figure that spans the shopkeeper converting rials to USDT and the operative moving military funds. Treasury has not tried to separate the two. Reuters reported that Nobitex was founded in 2018 by brothers Ali and Mohammad Kharrazi, who used the surname Aghamir, and that the pair come from a politically connected family. Nobitex rejected the account, calling itself a private and independent company with no relationship to the central bank or the IRGC.

Critics of the campaign argue that designating exchanges like Nobitex hits civilians who have no alternative for protecting savings. Supporters respond that the government moves military funds through the same networks civilians use, and that targeting the infrastructure is the only method that scales.

Each successful USDT freeze documents for Iranian operators which venues are monitored, and the practical response is to shift volume toward channels Washington cannot reach. FinCEN and OFAC have signaled in regulatory correspondence that they intend to pursue secondary sanctions against offshore exchanges that knowingly or negligently process flows from sanctioned jurisdictions. CoinEx, which handled $3.84 billion in Iran-linked flows before tightening its screening after the WSJ report, is the natural test of how aggressively that posture gets applied. As of this writing, it has not been designated.

US Freezes Near $1B in Iran Crypto, Traces $3.84B Via CoinEx

CoinEx and the Bybit Overlap

Why the Freezes Hit USDT on Tron

Explore More

More from AlphaScala

Trading Q&A

Related Tools & Research

Asset Profiles