Overview
- Elliptic identified a network of wallets it attributes to the Central Bank of Iran and says the $507 million figure is a conservative lower bound.
- Leaked documents point to two USDT purchases in April and May 2025 paid in UAE dirhams via an intermediary called Modex.
- Funds initially flowed to Nobitex to bolster local dollar liquidity, then shifted after the June 18, 2025 Nobitex hack to cross-chain bridges, decentralized exchanges, and other venues.
- Tether previously froze about $37 million linked to the network and says it works with law enforcement to disable illicit stablecoin activity.
- Elliptic’s Tom Robinson says no USDT remains in the wallets tied directly to the central bank, as investigators monitor additional wallets and cross-chain movements tied to trade settlement under sanctions.