Analysis Questions Iranian Link to OFAC-Sanctioned Crypto Wallets; Points to Alternative State Players
Despite Treasury Secretary Scott Bessent's claims that wallets seized during Operation Economic Fury belonged to Tehran, a detailed examination of wallet behavior patterns indicates possible connections to different state entities.
A number of cryptocurrency wallet addresses that were recently hit with sanctions by the United States Treasury Department over alleged connections to Iran might actually be associated with different state actors rather than the Islamic Republic, according to research released on Sunday.
The research, conducted by blockchain intelligence company Nominis, indicated that although the recent confiscation of wallets containing over $340 million by the Treasury's Office of Foreign Assets Control (OFAC) represented a major cryptocurrency enforcement action, certain characteristics of these wallets don't align with patterns seen in previously confiscated wallets connected to Tehran.
While the use of cryptocurrency by the Islamic Revolutionary Guard Corps (IRGC) is well established, this case presents structural and behavioral characteristics that diverge meaningfully from previously observed patterns.
Snir Levi, Nominis CEO
According to him, wallets associated with the IRGC have demonstrated certain consistencies in how they operate, such as funds being spread across numerous wallets, balances in individual wallets being maintained at relatively modest levels — usually in the range of a few million United States dollars, assets not being held for prolonged timeframes, and operations being organized to reduce vulnerability to seizure or freezing actions.
The behavioral divergence observed in this case raises a critical question: To what extent does the frozen $340 million reflect direct IRGC control, versus infrastructure that overlaps with broader, potentially foreign, financial networks.
Snir Levi
Levi stated that the ramifications for compliance professionals could mean that relying on static typologies is no longer adequate, and that behavioral examination and clustering approaches are essential for pinpointing risk.
Most importantly, this case highlights that even well-documented actors such as the IRGC and potentially Chinese state-actors are continuing to evolve their use of blockchain infrastructure.
Snir Levi, Nominis founder
Operation Epic Fury targets crypto for maximum US economic pressure
The United States has confiscated close to $500 million worth of Iranian cryptocurrency holdings through Operation Epic Fury, an extensive economic pressure initiative directed at Tehran, according to Treasury Secretary Scott Bessent's announcement last Wednesday.
We are freezing bank accounts everywhere. More importantly, we are making people less willing to deal with the regime.
Scott Bessent, Treasury Secretary
During his guest appearance on Fox Business's "Kudlow," Bessent explained that the campaign also encompasses targeting pension funds and foreign-held property belonging to Iranian government officials.
The figure of $500 million that was referenced represents a substantial increase compared to the $344 million in confiscated cryptocurrency assets that had been previously made public. Seven days prior, Bessent had revealed that OFAC had imposed sanctions on multiple cryptocurrency wallets with purported links to Iran, and stablecoin provider Tether subsequently confirmed it had frozen in excess of $344 million in USDt (USDT) following a request from United States authorities.
According to Bessent, Operation Economic Fury has inflicted significant damage on Iran's economic system. One of the nation's biggest banking institutions went under in December, and the country's currency has depreciated by 60 to 70% relative to the US dollar. "They're in the middle of a currency crisis," he said.