Why Are Analysts Questioning the Attribution of Sanctioned Wallets?
Wallet addresses recently sanctioned by the US Treasury Department for alleged ties to Iran may not be directly linked to the Islamic Republic, according to new analysis from blockchain intelligence firm Nominis.
The report follows a major enforcement action by the Treasury’s Office of Foreign Assets Control (OFAC), which froze more than $340 million in crypto assets. While initially attributed to Iranian-linked activity, the analysis suggests that the wallets’ structure and behavior differ from known patterns associated with Tehran.
“While the use of cryptocurrency by the Islamic Revolutionary Guard Corps (IRGC) is well established, this case presents structural and behavioral characteristics that diverge meaningfully from previously observed patterns,” said Nominis CEO Snir Levi.
How Do These Wallets Differ From Known IRGC Patterns?
Nominis pointed to several inconsistencies when comparing the sanctioned wallets to historical IRGC-linked activity. Previous cases typically showed funds distributed across multiple wallets, relatively low balances per address, and short holding periods designed to reduce exposure to seizure risks.
In contrast, the recently frozen wallets appear to hold larger balances for longer periods and do not follow the same fragmentation strategies commonly associated with Iranian-linked networks.
“The behavioral divergence observed in this case raises a critical question: To what extent does the frozen $340 million reflect direct IRGC control, versus infrastructure that overlaps with broader, potentially foreign, financial networks,” Levi said.
Investor Takeaway
What Does This Mean for Compliance and Risk Monitoring?
The findings suggest that traditional methods of identifying illicit crypto activity may be losing effectiveness as state and non-state actors adjust their behavior.
Levi noted that compliance teams can no longer rely solely on static typologies when assessing risk, as blockchain activity becomes more complex and harder to attribute with certainty.
“Most importantly, this case highlights that even well-documented actors such as the IRGC and potentially Chinese state-actors are continuing to evolve their use of blockchain infrastructure,” he said.
The shift toward behavioral analysis and clustering reflects a broader change in how blockchain intelligence firms approach detection, moving beyond simple wallet tagging toward more dynamic models.
Investor Takeaway
How Does This Fit Into Broader US Enforcement Efforts?
The wallet seizures are part of a wider US campaign targeting Iran’s financial networks. Treasury Secretary Scott Bessent said authorities have frozen nearly $500 million in Iranian-linked crypto assets under Operation Epic Fury, a broader effort to apply economic pressure.
“We are freezing bank accounts everywhere. More importantly, we are making people less willing to deal with the regime,” Bessent said during a televised interview.
The total cited by Bessent exceeds earlier disclosures of $344 million in frozen assets, highlighting the scale of the enforcement effort. Stablecoin issuer Tether confirmed that it had frozen more than $344 million in USDT at the request of US authorities.
Beyond crypto, the campaign has targeted overseas assets and financial holdings linked to Iranian officials. US officials say the measures are contributing to broader economic strain, including currency depreciation and banking instability.
