Elliptic Traces Iran Central Bank’s $507M USDT Network

• Elliptic linked Iran’s central bank to at least $507M in USDT bought in 2025 using Emirati dirhams.

• Funds initially flowed through Nobitex, then shifted cross-chain after a $90M hack hit the exchange.

• Despite sanctions evasion attempts, USDT activity stayed traceable, enabling Tether to freeze $37M.

As per Elliptic, Iran’s Central Bank acquired at least $507 million in USDT through a linked wallet network. Leaked records show purchases in April and May 2025, paid in Emirati dirhams. The activity involved multiple blockchains and aimed to move dollar value outside traditional banking channels.

Leaked Records Reveal Stablecoin Accumulation

According to Elliptic, internal documents revealed two large USDT purchases by the Central Bank of Iran during April and May 2025. Payments were settled in AED, bypassing correspondent banking systems. Using these records, Elliptic mapped additional wallets tied to the bank, identifying a broader accumulation totaling at least $507 million.

Elliptic stated the figure likely understates total holdings, as analysts only counted wallets linked with high confidence. Initially, most USDT flowed to Nobitex, Iran’s largest crypto exchange. There, funds could be stored, traded for other cryptoassets, or exchanged for rials, supporting local market activity.

Shift in Fund Flows After Nobitex Hack

However, Elliptic observed a clear operational change beginning in June 2025. USDT transfers shifted from Nobitex to a cross-chain bridge, moving assets from TRON to Ethereum. Subsequently, funds passed through decentralized exchanges, additional blockchains and centralized platforms through late 2025.

Notably, the shift followed a major security breach at Nobitex on June 18, 2025. During that incident, attackers stole $90 million in cryptoassets. The group Gonjeshke Darande claimed responsibility and later destroyed the assets by sending them to inaccessible wallets, according to public statements.

Sanctions, Transparency and Wallet Freezes

Elliptic reported that Iran’s central bank likely used USDT to address currency pressure and international settlement barriers. On-chain patterns show USDT entering Nobitex during periods of sharp rial depreciation. The approach resembled open market operations conducted using digital assets instead of cash reserves.

Despite efforts to bypass sanctions, Elliptic emphasized that stablecoin transactions remain traceable. Public blockchains like TRON and Ethereum allow monitoring at exchanges and custodians.

Tether exercised this control on June 15, 2025, blacklisting wallets tied to the network and freezing 37 million USDT. The case shows how blockchain transparency enables tracking even complex, state-linked financial activity.