Overview
- Elliptic maps a network of wallets linked to the Central Bank of Iran and reports the identified USDT has been moved out of wallets directly tied to the bank.
- Leaked documents point to two USDT purchases in April and May 2025 paid in Emirati dirhams, routed via an intermediary identified as Modex.
- On-chain flows show early transfers to Nobitex to inject dollar liquidity into local markets before a June 2025 hack forced an operational shift.
- After the Nobitex breach, CBI-linked funds moved through a cross-chain bridge from TRON to Ethereum and into decentralized and centralized venues.
- Tether said it froze about $37 million by blacklisting wallets linked to the activity, and Elliptic characterizes the $507 million figure as a conservative lower bound due to attribution limits.