The United States has sanctioned Iranian exchanges, frozen nearly $1 billion in cryptocurrency, and traced $3.84 billion in Iran-linked flows through a single offshore exchange, exposing the scale of sanctions evasion through digital assets.
- The US Treasury has sanctioned four Iranian cryptocurrency exchanges, including Nobitex, which handles approximately 50% of Iran’s crypto trading volume, as part of Operation Economic Fury launched in April 2026.
- Treasury has seized or frozen nearly $1 billion in cryptocurrency from Iranian exchanges and wallets since the US-Israeli strikes on Tehran in February, including a $344 million USDT freeze in April and a $131 million freeze in July.
- The Wall Street Journal reported that Iran-linked entities moved more than $3.84 billion through crypto exchange CoinEx since 2019, with investigators tracing flows from Central Bank of Iran wallets that connected to the North Korean Bybit hack.
- Chainalysis estimated that Iranian crypto outflows reached $4.18 billion in 2025, a 70% year over year increase, as the rial collapsed and citizens sought alternatives to the sanctioned banking system.
- The enforcement campaign reveals both the capabilities and limitations of crypto sanctions: centralized stablecoins like USDT can be frozen by issuers, but decentralized protocols and cross chain transactions continue to provide routes for moving value beyond government control.
The numbers tell the story before the analysis begins. Nearly $1 billion in Iranian cryptocurrency seized by the US Treasury. More than $3.84 billion in Iran-linked flows traced through a single offshore exchange. Iranian crypto outflows of $4.18 billion in a single year. Four domestic Iranian exchanges sanctioned. Executives added to the OFAC list. Central Bank of Iran wallets frozen on the Tron network.
These figures, accumulated over the first half of 2026, describe the largest and most technically sophisticated sanctions enforcement campaign ever conducted through blockchain infrastructure. The US government is not merely identifying Iranian crypto activity. It is actively seizing, freezing, and blocking it at multiple points in the financial chain. The question is whether the campaign is working or whether it is simply documenting the scale of a problem it cannot contain.
The answer is probably both. The United States has developed meaningful new tools for sanctions enforcement on public blockchains, and it is deploying them at unprecedented scale. At the same time, the gap between what investigators can see and what they can stop is wide and growing. Iranian crypto activity grew 70% year over year in 2025 even as US surveillance capabilities expanded. Every enforcement action generates a public record of Iranian evasion methods, which Iranian operators then adapt against. The cat-and-mouse dynamic is running faster than the enforcement side can respond.
Operation Economic Fury
The enforcement campaign has a name: Economic Fury. Treasury Secretary Scott Bessent introduced it on April 14, 2026, as the financial arm of the US response to the military conflict that began with joint US and Israeli strikes on Tehran in February. The campaign targets Iran’s use of cryptocurrency exchanges, wallets, and traditional financial networks that officials accuse of supporting sanctions evasion and military financing.
The campaign followed months of intelligence gathering that began before the military strikes. Treasury officials had been tracking Iranian crypto networks since at least 2024, when Chainalysis and TRM Labs began publishing research on the scale of Iranian stablecoin adoption. The strikes accelerated the timeline from monitoring to action.
The first major crypto action came in April, when Tether froze approximately $344 million in USDT across two Tron wallets after US authorities linked the addresses to Iranian networks. One wallet held about $213 million; the other contained roughly $131 million. Blockchain analysis found transaction patterns associated with wallets linked to Iran’s Islamic Revolutionary Guard Corps and intermediaries connected to the Central Bank of Iran.
In June, Treasury escalated by sanctioning four Iranian cryptocurrency exchanges: Nobitex, Wallex, Bitpin, and Ramzinex. Nobitex, the largest, handles approximately 50% of Iran’s cryptocurrency trading volume according to Chainalysis and claims to serve 11 million users. Treasury also added Nobitex CEO Seyed Ali Khoee and chairman Amir Hossein Rad to the OFAC sanctions list, making them personally subject to asset freezes and travel restrictions.
In July, Treasury froze an additional $131 million in USDT held in four Tron wallets tied to the Central Bank of Iran. Bessent said on X that Treasury remained “committed to disrupting and degrading Iran’s illicit financial activities, including its abuse of digital assets.”
By late July, Bessent disclosed that the cumulative total of cryptocurrency seized or frozen from Iranian sources since the conflict began had approached $1 billion. The figure, while significant, represents assets identified by investigators and does not include Iranian-linked cryptocurrency that moved through compliant exchanges and was not captured in enforcement actions.
The CoinEx connection
While Treasury focused on domestic Iranian exchanges, a parallel investigation exposed the offshore dimension of Iran’s crypto network. On June 24, the Wall Street Journal reported that Iran-linked entities had moved more than $3.84 billion through crypto exchange CoinEx since 2019.
The investigation, citing TRM Labs and public on-chain data, found that CoinEx had become one of the primary routes for moving funds outside US sanctions. More alarmingly, investigators traced activity from two wallets controlled by the Central Bank of Iran and found links to assets stolen from Bybit by North Korean hackers in what was one of the largest thefts in crypto history, involving approximately $1.5 billion in virtual assets.
CoinEx denied any knowledge of Iran-linked activity. The exchange said that on-chain fund flows through a platform do not prove knowledge, support, or participation. It also said it had strengthened Iran-related risk reviews, geo-fencing, sanctions screening, and transaction monitoring. CoinEx has not been subject to new US sanctions as of this writing, but the WSJ report placed it under heightened regulatory scrutiny.
The $3.84 billion figure is notable not just for its size but for its duration. The flows spanned seven years, from 2019 through 2026, covering periods when international attention to Iranian crypto activity was already high. The Financial Action Task Force had placed Iran on its blacklist for most of that period. The fact that billions in Iranian linked flows continued through a single exchange for seven years without triggering enforcement action until journalists reported it raises questions about the gap between blockchain transparency and operational enforcement.
TRM Labs data cited in the WSJ report also showed that CoinEx was not the only offshore exchange processing Iranian flows. Several smaller platforms with limited compliance infrastructure handled significant volumes. The concentration at CoinEx reflects the exchange’s combination of low fees, minimal identity verification requirements during the relevant period, and availability in jurisdictions where Iranian users could access the platform without VPN restrictions.
The CoinEx case illustrates a fundamental challenge in crypto sanctions enforcement. Centralized exchanges operate as choke points where authorities can intervene, but only if the exchange cooperates or is within jurisdictional reach. CoinEx is based outside US jurisdiction. Its compliance response, strengthening internal controls after public reporting, is the kind of reactive posture that allows billions in flows before any intervention occurs.
The scale of Iranian crypto adoption
The enforcement actions unfold against a backdrop of massive and growing cryptocurrency adoption within Iran. Chainalysis estimated that Iranian crypto outflows reached $4.18 billion in 2025, a 70% increase over the previous year. The surge coincided with the collapse of the Iranian rial, which lost approximately 40% of its value against the dollar during the same period, and intensifying sanctions that cut Iran further from the global banking system.
For ordinary Iranians, cryptocurrency serves the same function it serves in other countries experiencing currency devaluation and capital controls: a way to preserve savings and move value across borders. The distinction between legitimate civilian use and sanctions evasion is difficult to draw at scale, and US enforcement actions have not attempted to make the distinction. When Treasury sanctions an exchange like Nobitex that serves 11 million users, the action affects both the IRGC operative moving military funds and the shopkeeper converting rials to USDT to protect against inflation.
Reuters reported that Nobitex was founded in 2018 by brothers Ali and Mohammad Kharrazi, who used the surname Aghamir, and that the pair belong to a politically connected Iranian family. Nobitex rejected the characterization, describing itself as a private and independent company with no relationship to the IRGC, Iran’s central bank, or other state institutions.
The platform’s scale suggests that Iranian crypto activity is not a marginal phenomenon. If Nobitex alone handles 50% of Iran’s crypto trading and processes volumes proportional to the $4.18 billion in outflows that Chainalysis tracked, the total Iranian crypto economy is likely larger than what any single data provider captures.
Tron is the dominant blockchain for Iranian USDT activity, but on-chain analysis shows significant use of Ethereum-based assets and bitcoin for larger transactions. Iran’s geographic position as a major energy producer gives it access to cheap electricity that has long sustained domestic bitcoin mining. Even under US pressure, Iran’s mining industry continues to produce bitcoin that is then sold through non-compliant channels, mixing mined coins with purchased ones in ways designed to obscure provenance.
What the $4.18 billion Chainalysis figure captures is primarily exchange-mediated activity. Peer-to-peer crypto transactions, informal hawala-style networks that use crypto as a settlement layer, and government-level transactions that go through diplomatic channels are not fully reflected in the data. The total Iranian crypto economy, combining formal exchange activity with informal flows, is likely substantially larger than the $4 billion headline figure cited by US officials.
How stablecoin controls enable enforcement
The most effective tool in Treasury’s crypto sanctions arsenal is not blockchain analysis or traditional intelligence. It is the freeze function built into centralized stablecoins. USDT, issued by Tether on various blockchains including Tron, contains issuer level controls that allow Tether to freeze specific addresses, preventing the stablecoins from being transferred regardless of who holds the private keys.
Every major freeze in the Iran campaign has involved USDT on Tron. The $344 million April action and the $131 million July action both targeted Tron wallets holding USDT. The pattern is not coincidental. Tron’s low transaction fees and fast settlement have made it the preferred blockchain for USDT transfers in emerging markets, including Iran. That same preference concentrates Iranian stablecoin holdings in a token that the issuer can freeze on demand.
This creates an asymmetry that favors enforcement. Iranian entities using USDT accept a counterparty risk that bitcoin users do not face: Tether can render their holdings inaccessible with a single transaction. The $475 million in USDT freezes during the Economic Fury campaign shows that this risk is not theoretical.
Tether’s cooperation with US authorities is not legally required in the traditional sense. Tether is incorporated offshore and is not subject to direct US regulatory jurisdiction. But the company has consistently complied with US law enforcement freeze requests, a pattern that reflects both the practical reality of wanting US banking relationships and the risks of being designated as a sanctions violator under OFAC regulations. Tether’s voluntary compliance with freeze requests is one reason why USDT on Tron became the enforcement mechanism of choice in the Iran campaign.
The limitation is that the freeze mechanism only works for centralized stablecoins. Iran has also adopted bitcoin and other decentralized assets for cross border transactions, including accepting cryptocurrency for weapons sales. Bitcoin cannot be frozen by any issuer. Decentralized exchanges and cross chain bridges provide routes that do not pass through compliant intermediaries. The freeze function addresses the largest and most visible flows but not the entire ecosystem.
The Bybit hack connection
The WSJ’s discovery that Central Bank of Iran wallets were linked to assets from the North Korean Bybit hack adds a dimension that extends beyond Iran sanctions. It suggests that the networks facilitating Iranian sanctions evasion overlap with the infrastructure used for state sponsored cybercrime.
The FBI attributed the Bybit hack to North Korean actors who stole approximately $1.5 billion in virtual assets. The hackers converted stolen funds into bitcoin and other tokens across many wallets, using decentralized protocols including THORChain to obfuscate the trail. THORChain processed almost $3 billion in trading volume from swaps tied to stolen Bybit assets, according to on-chain tracking.
The intersection of Iranian sanctions evasion and North Korean cybercrime through a common exchange infrastructure raises questions about whether these networks are coordinated or simply convergent. Two sanctioned states using similar crypto channels to evade financial restrictions could reflect shared operational methods, shared intermediaries, or merely the natural tendency of illicit actors to gravitate toward the same low compliance venues.
For regulators, the connection strengthens the argument for applying comprehensive sanctions screening and transaction monitoring requirements to all centralized exchanges, regardless of jurisdiction. For the crypto industry, it highlights the reputational and regulatory risk of operating exchanges that attract illicit flows through weak compliance.
The Bybit connection also matters for how crypto exchanges frame their role in global financial crime. For years, exchanges in non-US jurisdictions argued that sanctions compliance was a US issue, not a global one. The discovery that the same wallets connected both Iranian government funds and North Korean cybercrime proceeds changes the argument. State-sponsored actors from multiple sanctioned countries are using the same infrastructure, which pushes exchanges into a position where choosing not to comply with US sanctions implicitly means becoming a service provider for state-level threat actors.
FinCEN and OFAC have signaled in recent regulatory correspondence that they intend to pursue secondary sanctions against offshore exchanges that knowingly or negligently process flows from sanctioned jurisdictions. Whether CoinEx, which handled $3.84 billion in Iran-linked flows, faces secondary sanctions action will be a test case for how aggressively that posture is applied in practice.
The enforcement paradox
The Iran crypto sanctions campaign reveals a paradox at the heart of blockchain based enforcement. The same transparency that allows investigators to trace $3.84 billion in flows through CoinEx or identify Central Bank of Iran wallets on Tron also shows the scale of activity that proceeded without intervention for years.
Treasury’s ability to freeze USDT, sanction exchanges, and trace on chain activity represents a significant expansion of sanctions enforcement capabilities compared to the traditional banking system. But the $4.18 billion in Iranian crypto outflows in 2025 alone suggests that enforcement is capturing a fraction of total activity. The actions are significant in dollar terms but may represent less than 25% of annual Iranian crypto flows based on available estimates.
Critics of the campaign argue that sanctioning exchanges like Nobitex primarily harms ordinary Iranians who have no alternative to crypto for preserving savings. Proponents argue that the distinction between civilian and military use cannot be drawn cleanly when the Iranian government uses the same financial networks as the civilian population, and that targeting the infrastructure is the only viable method at scale.
The campaign also faces a structural limitation: as enforcement increases on centralized platforms, activity migrates to decentralized alternatives. Each successful USDT freeze teaches Iranian operators to diversify into bitcoin, privacy coins, or decentralized stablecoins that cannot be frozen. The enforcement action itself accelerates the adaptation that makes future enforcement harder.
What to watch
- Additional exchange sanctions. CoinEx has not been sanctioned despite the WSJ report. Whether Treasury acts against offshore exchanges that process Iranian flows will test the limits of US jurisdictional reach.
- The total seized figure. Treasury’s $1 billion in seized crypto is a running total. Whether it continues to grow at the current pace or plateaus will indicate whether enforcement is keeping up with the flow.
- Migration to decentralized platforms. If Iranian entities shift from USDT on Tron to bitcoin, decentralized stablecoins, or privacy focused protocols, the freeze mechanism that has powered most seizures will become less effective.
- Regulatory response to the Bybit-Iran link. The connection between Iranian sanctions evasion and North Korean cybercrime through shared exchange infrastructure may drive new compliance requirements for exchanges globally.
- Impact on Iranian civilians. The sanctions affect both government entities and ordinary citizens who use crypto as an inflation hedge. How the humanitarian dimension is addressed, or not addressed, will influence the political sustainability of the campaign.
Frequently asked questions
How much Iranian cryptocurrency has the US seized?
The US Treasury has seized or frozen nearly $1 billion in cryptocurrency from Iranian exchanges and wallets since the military conflict began in February 2026. Major actions include a $344 million USDT freeze in April and a $131 million freeze in July, both involving wallets on the Tron network.
What is Operation Economic Fury?
Operation Economic Fury is a US Treasury campaign launched on April 14, 2026, targeting Iran’s financial networks including cryptocurrency exchanges, wallets, and traditional banking channels. The campaign is the financial arm of the US response to the military conflict with Iran.
Which Iranian crypto exchanges were sanctioned?
Treasury sanctioned four Iranian exchanges in June 2026: Nobitex, Wallex, Bitpin, and Ramzinex. Nobitex, the largest, handles approximately 50% of Iran’s crypto trading volume and claims 11 million users. Two Nobitex executives were also added to the OFAC sanctions list.
How much money flowed through CoinEx from Iran?
The Wall Street Journal reported that Iran-linked entities moved more than $3.84 billion through crypto exchange CoinEx since 2019, based on TRM Labs data and public on chain analysis. CoinEx denied knowledge of Iran-linked activity and said it strengthened compliance controls.
How does the US freeze cryptocurrency?
The US leverages the freeze function built into centralized stablecoins like USDT. Tether can freeze specific wallet addresses, preventing tokens from being transferred. This mechanism does not work for decentralized assets like bitcoin, which cannot be frozen by any issuer.
What is the connection between Iran and the Bybit hack?
Investigators traced activity from Central Bank of Iran wallets to assets stolen from Bybit by North Korean hackers, who took approximately $1.5 billion in virtual assets. The connection suggests that Iranian sanctions evasion networks and North Korean cybercrime infrastructure may share common exchange intermediaries.
How much crypto do Iranians use?
Chainalysis estimated that Iranian crypto outflows reached $4.18 billion in 2025, a 70% increase year over year. The surge coincided with the collapse of the Iranian rial and intensifying sanctions that cut Iran from the global banking system.
Can Iran avoid crypto sanctions?
Centralized stablecoins can be frozen, but decentralized assets like bitcoin cannot. As enforcement increases on centralized platforms, Iranian entities are expected to migrate toward decentralized protocols, privacy coins, and cross chain bridges that operate beyond the reach of issuer level controls.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. The information presented reflects publicly available data as of August 1, 2026. Readers should conduct their own research and consult qualified professionals before making financial or legal decisions.
