People often place blame on the most vulnerable, which raises questions about accountability.
A recent move by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) brought this issue into focus when it froze about $344 million in $USDT.
According to authorities, two wallets linked to illicit activity held the funds. Given the geopolitical tensions at the time, attention quickly shifted to Iran’s Islamic Revolutionary Guard Corps (IRGC) as the main suspect.
However, NOMINIS CEO Snir Levi analyzed these wallets and compared their behavior with previously confirmed IRGC-linked crypto activity.
He found notable differences in how the funds were accumulated and moved, suggesting that the patterns did not fully match typical IRGC operations.
The recent freezing of over $340 million in $USDT by Tether, along with action from U.S. authorities, is one of the biggest crypto enforcement cases so far. While the IRGC is known to use crypto, this case shows wallet behavior that is different from what has been seen before.
To back up his analysis, NOMINIS CEO pointed out five key differences.
Historically, IRGC-linked wallets spread funds across many addresses, keep balances low, and move money frequently to avoid detection. In contrast, the recently flagged wallets show a different pattern.
They accumulated large amounts of $USDT starting in 2021 and then became mostly inactive after February 2023, which does not fit the usual IRGC “fast movement” strategy.
Meanwhile, some wallets showed unusual interactions with exchanges like Bitfinex, including small test transfers.
Cluster data also shows links to Huobi ($HTX), Huione Group, and possible China-linked crypto flows. One $HTX address also received funds linked to Iranian entities, but the timing remains unclear.
According to NOMINIS, this overlap suggests either shared infrastructure or accidental interaction with high-risk wallets, raising a key question: Does the $340 million $USDT seizure reflect direct IRGC control, or a more complex mix of exchange infrastructure and unclear attribution?
$USDT freeze raises questions over IRGC link and attribution complexity
Following the NOMINIS CEO’s report, the case comes back to the same uncertainty.
The main question is whether the IRGC became an easy target during rising geopolitical tensions in the Middle East. Based on the earlier findings, that looks likely.
Naturally, this also raises a wider concern about DeFi infrastructure, especially as the ecosystem is already under pressure after more than $600 million lost in recent DeFi hacks, showing ongoing security and attribution challenges in crypto.
In short, the $340 million $USDT seizure highlights a downside of decentralized systems, where illicit flows can move through complex networks and accountability becomes harder to trace.
NOMINIS CEO Snir Levi also points out that this complexity makes clear attribution difficult in cases like this.
While it’s hard to be certain, the data suggests the network doesn’t fully match known IRGC financial patterns. Instead, it looks more mixed and complex, with possible overlap between state-linked actors, exchanges, and third-party networks.
At a basic level, the $344 million $USDT freeze highlights not just rising risks in DeFi, but also weak accountability in complex crypto systems, where bad actors can potentially hide within these layered systems, while attribution becomes less clear and blame may fall on the wrong parties.
Final Summary
- The $344 million $USDT freeze shows how hard it is to track who really controls money in complex crypto networks.
- NOMINIS CEO says it’s often unclear who is responsible, so blame can sometimes be misassigned in DeFi systems.
