Iranian Authorities Bought Over $500 Million in USDT to Support the Rial

A network of crypto wallets used by the Central Bank of Iran was identified purchasing at least $507 million worth of USDT. Leaked documents describe two major USDT purchases made in April and May 2025, with payments settled in UAE dirhams.

Based on this data, researchers were able to reconstruct a broader wallet infrastructure linked to the central bank and uncover the systematic accumulation of more than half a billion dollars in USDT. This points to a deliberate strategy to bypass the international banking system. GetBlock AML Research revealed details on how Iran has been using crypto assets to circumvent global sanctions.

Key findings

• On-chain data shows that Iran’s central bank acquired at least $507 million in USDT.
• Until early June 2025, most of these funds were sent to Nobitex, Iran’s largest cryptocurrency exchange, and later routed through a special service used to transfer assets across different blockchains. In mid-June 2025, a pro-Israeli hacker group attacked Nobitex, citing its alleged use by Iran’s Islamic Revolutionary Guard Corps.
• There are clear signs that the stablecoins were used to support the exchange rate of the Iranian rial. This became an alternative way to influence the market, as sanctions prevent Iran from freely using its official foreign currency reserves.
• Blockchain transparency makes it possible to trace such flows and, when necessary, block them.

The actual amount of USDT involved is likely higher, as the estimate only includes wallets that could be linked to the Central Bank of Iran with a high degree of confidence.

Wallet structure linked to the Central Bank of Iran. Visualization: Elliptic.

Transaction analysis shows a clear shift in how the bank managed its USDT holdings. Before June 2025, nearly all funds were sent to Nobitex, the country’s largest crypto exchange. On the platform, users can store USDT, trade it for other digital assets, or sell it for Iranian rials.

Starting in June 2025, the pattern changed sharply. USDT began moving through a cross-chain service that transferred assets from the TRON blockchain to Ethereum. The funds were then swapped into other currencies via decentralized exchanges, bridged into different networks, and routed through centralized platforms. This process continued through the end of 2025.

This shift coincided with a major security breach at Nobitex. On June 18, 2025, roughly $90 million in crypto assets were stolen from the exchange. The attack was carried out by the hacking group known as Predatory Sparrow.

How Iran’s Nobitex exchange lost more than $80 million. Chronology of the hack

The trading platform was hacked by the pro-Israeli hacker group Predatory Sparrow

Читать дальше

The group claimed that Nobitex played a central role in terrorism financing and sanctions evasion. Instead of cashing out the stolen funds, the attackers destroyed them by sending the assets to an inaccessible wallet.

Why did Iran’s central bank need stablecoins?

Under normal conditions, individuals and companies dealing in US dollars rely on international banks and the SWIFT system to move funds through US-linked financial institutions. While the exact use of USDT by the central bank is not fully known, it likely addressed two major challenges:

• The rapid devaluation of the national currency
• Severe restrictions on international trade

Transfers to Nobitex suggest an attempt to inject dollar liquidity into the economy to support the rial. Large-scale USDT purchases began during a period of extreme volatility. Over just eight months, the rial lost half its value and hit record lows against the dollar. The central bank likely used USDT to buy rials on Nobitex, effectively doing what central banks typically do with foreign reserves—stabilizing the market, but through crypto instead.

12 days of war: how the Iranian Nobitex exchange recovered after the hack

The trading platform resumed trading on July 9, but Iranian users are in no hurry to return to the exchange

Читать дальше

Decline of the rial against the US dollar

Beyond domestic measures, the bank also appears to have built a “sanctions-resistant” financial system. By using USDT as digital dollar accounts, the state was able to store value in dollars outside the reach of US authorities.

This system supports a closed-loop trade model officially approved in August 2022. Under this framework, imports and exports are settled in so-called “synthetic dollars,” helping preserve liquidity and avoid the risk of funds being frozen in traditional banks.

Iranians are withdrawing cryptocurrency en masse to personal wallets. Why is this happening?

There has been a sharp surge in activity among Iranian cryptocurrency users amid mass protests in the country and the high probability of a military confrontation with the United States.

Читать дальше

Blockchain transparency makes everything visible

While these operations aim to bypass sanctions, they are not invisible. Unlike cash or informal transfer systems, stablecoins such as USDT operate on public blockchains like TRON and Ethereum. With the right tools, these transactions can be tracked and, if necessary, blocked.

As in traditional finance, enforcement can be applied at key choke points—exchanges and custodians. Analytical platforms can identify transactions linked to sanctioned countries or entities.

Stablecoins offer even stronger control mechanisms, as issuers can directly freeze wallets. In June 2025, several wallets associated with Iran’s central bank were blacklisted, resulting in the freezing of $37 million in USDT.