Iran’s central bank accumulated more than $500 million in US dollar-backed stablecoins to support the rial and manage trade outside the global banking system, according to blockchain analytics firm Elliptic. Leaked documents show two USDT purchases in April and May 2025, paid in Emirati dirhams, which allowed researchers to map a wider wallet network linked to the Central Bank of Iran. The analysis identified at least $507 million in USDT, which Elliptic treats as a lower bound due to strict attribution standards applied to confirmed wallets.
Elliptic traced early USDT flows from central bank-linked wallets to Nobitex, Iran’s largest cryptocurrency exchange. Nobitex allows users to hold USDT, trade it for other cryptoassets, or sell it for Iranian rials through local market channels. The routing pattern points to a strategy of injecting dollar liquidity into domestic markets during intense currency pressure.
The accumulation began amid extreme volatility, when the rial lost half its value within eight months and reached record lows against the dollar. Elliptic observed activity consistent with efforts to buy rials using USDT, mirroring open market operations normally conducted with cash reserves. This approach allowed authorities to act without relying on correspondent banks or sanctioned financial infrastructure.
Reports cited by Elliptic suggest the main goal involved stabilizing foreign exchange markets rather than speculative trading. By using USDT on a local exchange, the central bank could influence liquidity while avoiding direct access to frozen dollar reserves. Why would a sanctioned central bank turn to blockchain networks to perform functions usually handled by traditional banks?
Elliptic detected a sharp operational change starting in June 2025. Instead of routing USDT to Nobitex, linked wallets began sending funds to a cross-chain bridge. The bridge moved assets from TRON to Ethereum before further conversions.
From that point, funds flowed through decentralised exchanges, other blockchains, and some centralised platforms. This multi-step process continued through the end of 2025, increasing complexity and dispersion across networks. The timing matched a major security incident at Nobitex.
On June 18, 2025, attackers stole about $90 million in cryptoassets from the exchange. The pro-Israel group Gonjeshke Darande claimed responsibility and accused Nobitex of aiding sanctions evasion. Instead of cashing out, the group destroyed the stolen assets by sending them to an inaccessible wallet.
Elliptic said the wallet activity suggests the construction of a parallel financial system built on stablecoins. By holding USDT, the central bank could store dollar value outside the correspondent banking and SWIFT systems. The firm described this setup as “digital off-book eurodollar accounts”.
The structure aligns with a closed-loop trade framework authorized in August 2022. This system allows import payments and export revenue settlement using synthetic dollars rather than physical cash. Such mechanisms reduce seizure risks tied to conventional cross-border transfers.
Despite the intent to evade sanctions, Elliptic noted that blockchain transparency leaves detailed transaction trails. USDT operates on public networks like TRON and Ethereum, which allow monitoring with advanced analytics tools. Elliptic said these findings show how sanctions evasion attempts remain visible and traceable on open blockchains.
Also Read: Iran Imposes Near-Total Internet Blackout as Protests Escalate and Trump Issues Stark Warning
Elliptic traced more than $500 million in USDT linked to Iran’s central bank, revealing a structured effort to support the rial and settle trade outside global banking systems. The activity relied on stablecoins, local exchanges, and blockchain bridges, showing how transparent networks can still expose sanctions-evasion strategies.