OFAC-Seized Wallets May Not Be Iranian, Analyst Warns
Blockchain intelligence firm Nominis questions whether $340 million in OFAC-sanctioned wallets truly belong to Iran, citing behavioral divergence from typical IRGC patterns. The analysis suggests possible involvement of other state actors like China, highlighting the need for evolving compliance practices as state actors adapt blockchain usage.
Quick Take
Nominis says seized wallets' behavior differs from known IRGC operations.
IRGC wallets typically keep low balances and avoid long holdings.
Operation Epic Fury targets $500M in Iranian crypto assets.
Tether froze over $344 million in USDT at U.S. request.
Market Impact Analysis
NeutralNeutral as the analysis is investigative and does not directly impact crypto prices, though regulatory scrutiny could have long-term implications.
Speculation Analysis
Key Takeaways
- Nominis analysis suggests OFAC-seized wallets holding $340M may not be linked to Iran but to other state actors.
- Wallet behavior diverges from typical IRGC patterns, indicating possible involvement of Chinese or other state entities.
- Static compliance typologies are insufficient; behavioral analysis is critical to identify evolving state-actor risk.
- Operation Epic Fury has seized nearly $500M in total Iranian crypto assets, though attribution remains fluid.
What Happened
A new analysis by blockchain intelligence firm Nominis suggests that cryptocurrency wallets recently sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) may not belong to Iran. The wallets, holding over $340 million, had been frozen as part of Operation Epic Fury, which targets Tehran’s digital assets. However, Nominis CEO Snir Levi said the wallet behavior shows structural characteristics that “diverge meaningfully” from known Islamic Revolutionary Guard Corps (IRGC) operations. The findings raise the possibility that other state actors, potentially including China, control the funds.
The Numbers
The OFAC action grabbed headlines with over $340 million in one set of wallets. That’s part of nearly $500 million seized in total under Operation Epic Fury. Tether separately froze $344 million in USDT at the U.S. government’s request. IRGC-linked wallets historically keep balances low—typically a few million dollars—and avoid long holdings. The flagged wallets, however, contained much larger sums, breaking the established pattern.
Why It Happened
The IRGC has shown consistent operational security: distributing funds across many wallets, keeping balances small, and minimizing exposure time. The sanctioned wallets buck that trend. Nominis found evidence of higher individual balances and different transaction structuring. This behavioral gap indicates either a shift in IRGC tactics—unlikely without other signals—or that the wallets are controlled by a different entity. Levi noted that even well-documented actors are evolving their blockchain usage, complicating attribution.
Broader Impact
For compliance teams, the case is a wake-up call. Static typologies that flag addresses based on known patterns are insufficient. Behavioral analysis and clustering are now essential to spot risks. The line between state actors is blurring, and sanctions enforcement must adapt. If wallets can’t be reliably attributed, the effectiveness of economic pressure campaigns comes into question.
What to Watch Next
- OFAC may issue updated guidance or new designations if the Iranian link proves weak.
- Blockchain analytics firms will likely roll out enhanced behavioral tools to track state-actor adaptations.
- Market participants should monitor whether Tether or other stablecoin issuers adjust freezing policies based on contested attribution.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
