OFAC freezes $344M USDT; NOMINIS notes wallet differences

The U.S. Treasury’s Office of Foreign Assets Control froze about $344 million in USDT held in two cryptocurrency wallets after flagging the addresses as linked to illicit activity. Tether blocked the tokens at OFAC’s request. The action is one of the largest enforcement moves involving a stablecoin to date.

NOMINIS, a blockchain analytics firm, examined the wallets’ transaction histories and compared them with previously confirmed cryptocurrency operations tied to Iran’s Islamic Revolutionary Guard Corps (IRGC). Snir Levi, NOMINIS chief executive, identified five behavioral differences between the frozen wallets and wallets previously linked to the IRGC.

The firm reported that the flagged wallets accumulated large USDT balances beginning in 2021 and held those balances for extended periods. By contrast, wallets tied to confirmed IRGC activity have typically spread funds across many addresses, maintained lower individual balances and moved funds frequently. NOMINIS also found that the two wallets became largely inactive after February 2023, showing fewer outgoing transactions and less turnover than seen in prior IRGC-linked cases. Distribution patterns and timing of transfers diverged from the profiles the firm used for confirmed cases.

NOMINIS noted that the observed patterns could reflect a mix of actors and services on the same on-chain routes, including state-affiliated actors, centralized exchanges and third-party service networks. The firm said layered infrastructure and shared services can make it difficult to determine who ultimately controls funds based on on-chain data alone.

The freeze took place amid heightened attention to crypto flows associated with Iran. U.S. officials have previously documented IRGC use of cryptocurrencies for financing and other operations. Investigators and analysts have warned that similar on-chain traces can result from different users following the same service paths or using the same exchanges.

The case also occurred against a backdrop of security incidents in decentralized finance. Recent hacks and exploits in DeFi have involved more than $600 million in stolen assets, and industry participants report technical and legal challenges in tracing control and proving real-world ownership of on-chain funds.

OFAC has statutory authority to designate persons and freeze assets tied to illicit activity or sanctions violations. NOMINIS’ analysis states that the on-chain behavior of the two frozen wallets does not fully match the financial patterns the firm associates with confirmed IRGC operations, leaving the question of who controlled the funds unresolved.