Islamic Republic of Iran
Cryptocurrency operations primarily focused on sanctions evasion through IRGC-linked exchanges, mining operations, and OTC trading networks totaling over $8 billion.
47
Active Wallets
$8.00B
Total Volume
3
Threat Actors
8
Active Alerts
Executive Summary
Iran has developed sophisticated cryptocurrency infrastructure to evade international sanctions, processing an estimated $8 billion+ through various channels. Unlike North Korea's theft operations, Iran's crypto activities focus primarily on sanctions circumvention and funding operations for the Islamic Revolutionary Guard Corps (IRGC).
Key sanctions evasion methods include:
- IRGC-controlled cryptocurrency exchanges (Zedcex, Sarafi)
- State-sponsored Bitcoin mining operations
- OTC trading networks across Turkey and UAE
- USDT (Tether) transactions on Tron network
In January 2026, OFAC designated Zedcex exchange and multiple associated wallets for facilitating IRGC financial operations. These entities enabled billions in sanctions evasion by Iranian oil traders, petrochemical companies, and defense procurement networks.
Threat Actors
IRGC Cyber Command
HIGH CONFIDENCEAlso known as: IRGC-CEC, Iranian Cyber Army, Tortoiseshell
$8.00B
Estimated Volume
Islamic Revolutionary Guard Corps cyber operations involved in cryptocurrency-based sanctions evasion and ransomware.
First Observed
2010
Active Wallets
35
Last Activity
2025-02-19
Primary Focus
4 categories
Tactics
Primary Targets
APT35 / Charming Kitten
HIGH CONFIDENCEAlso known as: Charming Kitten, Phosphorus, TA453, Mint Sandstorm
$50.00M
Estimated Volume
Iranian espionage group that has conducted cryptocurrency theft operations targeting dissidents and researchers.
First Observed
2014
Active Wallets
12
Last Activity
2025-01-15
Primary Focus
4 categories
Tactics
Primary Targets
Zedcex Exchange
OFAC DESIGNATEDDesignated January 2026
IRGC-linked cryptocurrency exchange facilitating sanctions evasion for Iranian petrochemical and oil trading entities. Primarily operates on Tron network with USDT transactions. Estimated to have processed over $45 million before designation.
OFAC Designated Wallets
4 addresses tracked| Address | Chain | Entity | Received | Txns | Risk |
|---|---|---|---|---|---|
TJDENsfB...XnKhCM | tron | Zedcex Exchange Designated: 2025-01-15 | $45.00M | 1,250 | 100 |
0x1da582...2f9b5a | ethereum | IRGC Quds Force Designated: 2020-09-17 | $125.00M | 890 | 100 |
0x7db418...3e6107 | ethereum | Iranian OTC Network Designated: 2020-09-17 | $85.00M | 567 | 100 |
bc1qxy2k...hx0wlh | bitcoin | Iranian Mining Operations Designated: 2022-11-08 | $350.00M | 2,340 | 95 |
These addresses are officially designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC). Transactions with these addresses may violate U.S. sanctions laws.
Sanctions Evasion Methods
IRGC-Controlled Exchanges
Multiple cryptocurrency exchanges operating under IRGC oversight, including Zedcex and associated Sarafi networks, facilitate conversion between crypto and fiat currencies for sanctioned entities.
State-Sponsored Mining
Iran operates large-scale Bitcoin mining operations using subsidized electricity. An estimated 4.5% of global Bitcoin mining occurred in Iran at peak, generating fresh BTC without transaction history.
Oil Trade Settlement
Iranian oil exports to China and other buyers increasingly settled in cryptocurrency, bypassing SWIFT and traditional banking channels under U.S. sanctions.
OTC Trading Networks
Extensive over-the-counter trading networks across Turkey, UAE, and other regional hubs enable large-volume crypto-to-fiat conversion for Iranian businesses and individuals.
Integrate Iran Threat Data
Access Iran sanctions evasion intelligence via our free API
curl -X GET "https://api.nsctip.com/v1/nations/iran" \
-H "X-API-Key: YOUR_API_KEY"