The National Bureau for Counter Terror Financing of Israel (NBCTF) has today published a list of 187 cryptocurrency addresses that it says are linked to Iran’s Revolutionary Guards, also known as the Islamic Revolutionary Guard Corps (IRGC). The IRGC is sanctioned and designated as a terrorist group by various jurisdictions, including the United States, Canada, the United Kingdom and the European Union.
Action taken by Elliptic
Elliptic has taken urgent action to ensure that addresses that were included in the NBCTF seizure order are available to screen and trace using our next-generation Holistic blockchain analytics technology. Users will now be able to ensure that they do not inadvertently process funds originating from – or being sent to – addresses included in the seizure order.
These addresses have collectively received $1.5 billion in Tether’s USDT stablecoin. However, it is not possible to verify whether all of these transactions are directly linked to the IRGC since some of the addresses may be controlled by cryptocurrency services and could be part of wallet infrastructure used to facilitate transactions for many customers.
An extract from Administrative Seizure Order (ASO-43/25).
Tether freezes IRGC assets
The use of the USDT stablecoin makes these funds prone to seizure, thanks to their “blacklisting” functionality. Of the 187 addresses listed by the NBCTF, 39 were “blacklisted” by Tether on Saturday 13th September. This prevents these wallets from engaging in any further USDT transactions, effectively freezing the $1.5 million in USDT held by these addresses.
Historical context: Ongoing IRGC crypto activity
The IRGC has been linked to the use of cryptocurrency for a number of years.
Just last Friday, the U.S. Justice Department announced the seizure of $584,741 in USDT from Iranian national Mohammad Abedini. Abedini is the founder of a business that manufactures navigation systems allegedly used in the Islamic Revolutionary Guard Corps (IRGC) military drone program, including the Shahed UAV.
In December 2024 the U.S. Department of the Treasury added cryptocurrency addresses to sanctions lists, which had received $332 million in USDT. These were linked to Sa’id Ahmad Muhammad al-Jamal, himself sanctioned for funnelling tens of millions of dollars to the Houthi militant group in Yemen (Ansarallah), in cooperation with senior officials in Iran’s Islamic Revolutionary Guard Corps – Qods Force (IRGC-QF).
In June 2025 over $90 million was stolen from the Iranian crypto exchange Nobitex by a pro-Israel group. The stolen funds were sent to addresses containing some variation of the term “F*ckIRGCterrorists”. Elliptic and others have linked Nobitex to the IRGC, including through its use by sanctioned IRGC operatives accused of ransomware operations and the targeting of critical infrastructure.
The inherent transparency of blockchain technology enables comprehensive visibility into financial flows, empowering all ecosystem participants to play a crucial role in identifying and reducing illicit funds. When authorities and industry work together with speed and precision, we can ensure customers remain safe and secure while maintaining the integrity of the digital asset ecosystem.
