Israel Demands Freeze of $1.5 Million USDT Linked to Terrorists

Tether blacklisted 39 addresses, allegedly linked to Iran's IRGC.

Israel’s Ministry of Defense has approached Tether, the company behind USDT, demanding the freezing of $1.5 million across 187 wallets. According to the ministry, these wallets belong to Iran’s Islamic Revolutionary Guard Corps (IRGC) and are used to finance terrorism.

Elliptic confirmed that significant sums in USDT have passed through the listed addresses. However, analysts emphasized that not all transactions are directly linked to the Iranian military.

Some wallets are believed to belong to cryptocurrency services or other infrastructure “used for operations by many clients.”

The IRGC is under international sanctions and is recognized as a terrorist organization by the United States, Canada, the United Kingdom, and the European Union.

According to Elliptic, on September 13, Tether added 39 of the 187 addresses to its blacklist.

Context

Experts noted that the IRGC has been using cryptocurrency for many years. On September 12, the U.S. Department of Justice announced the seizure of 584,741 USDT from Iranian national Mohammad Abedini.

The investigation revealed that he is the founder of a company producing navigation systems, allegedly used in the IRGC’s military drone program.

In March, members of the Corps were accused of embezzling over $21 million in cryptocurrency under the guise of an anti-corruption investigation into the collapsed exchange Cryptoland and its founder Sina Estavi.

In December of last year, the U.S. Treasury added addresses to its sanctions list that had received a total of $332 million in USDT. The wallets belonged to Saeed Ahmad Mohammad al-Jamal, previously implicated in transferring tens of millions of dollars to Yemen’s Ansar Allah militant movement with the assistance of senior IRGC officials.

In June 2025, a pro-Israel hacker group breached the Iranian crypto exchange Nobitex, stealing $90 million. The stolen funds were sent to addresses containing variations of the phrase “F*ckIRGCterrorists.”

According to Elliptic and other sources, the trading platform is linked to the IRGC. In particular, it is used by sanctioned IRGC operatives accused of conducting ransomware attacks.

Analysts at TRM Labs suggested that Israeli intelligence may have used data from the hacked Nobitex to capture Iranian spies.