TL;DR: A Senate Permanent Subcommittee on Investigations Democratic staff report, first reported by the Wall Street Journal on September 28, 2026, found that about 84 percent of 846 Iran-linked sanctioned wallets transacted exclusively or predominantly in Tether's USDT. Tether answered the same day that it has helped freeze roughly $550 million in Iran-linked USDT this year. Both figures describe what happened after designation. The question regulators are now asking exchanges, fintechs, and issuers is what their sanctions program did before the addresses were named.
The Number That Matters Is Not 84 Percent
The headline statistic is a concentration figure, not an exposure figure. According to the Senate PSI staff findings as reported by the Wall Street Journal, investigators reviewed 846 wallets designated by OFAC and Israel's National Bureau for Counter Terror Financing and found that roughly 84 percent ran exclusively or mainly on USDT. One outlet has carried 87 percent, and the full report was not yet public when the story ran, so treat the precise share as provisional. The same reporting says the Central Bank of Iran accumulated at least $507 million in USDT. Senator Richard Blumenthal, the subcommittee's ranking member, told the Journal the token has "become central to Iran's shadow banking system, allowing the Iranian government to fund its regional proxies, commit human-rights abuses, and pursue hostile drone and missile programs."
Tether's response arrived within hours: nearly $550 million in Iran-linked USDT frozen during 2026, including more than $344 million across two addresses in April, which OFAC later added to the SDN List as Central Bank of Iran digital currency identifiers, and more than $130 million across four Tron wallets in July. Tether also cited work with more than 340 law enforcement agencies in 67 countries and more than $4.9 billion frozen globally.
The two sets of numbers describe the same sequence from opposite ends. Wallets moved USDT for years, authorities identified them, and the issuer froze what was left. Neither number captures how much value passed through those addresses, or the exchanges and intermediaries serving them, before designation. That is the record Blumenthal's June 4 letter to Tether demanded, and it is the record every institution touching stablecoin flows should be able to produce about its own book.
Freezing After Designation Is Not a Sanctions Program
A freeze executed after OFAC names an address is list-matching. It is necessary, fast on a public blockchain, and the minimum any issuer or exchange must do. It is not a sanctions compliance program. A program is the set of controls that identify prohibited exposure before a regulator does the identification for you.
We see this distinction blurred constantly, with blacklisting speed offered as evidence of program strength. Regulators are asking a different question. OFAC's FAQ 1250, issued May 1, 2026, states that Iranian digital asset exchanges are Iranian financial institutions blocked under Executive Order 13599 regardless of whether they appear on the SDN List. Nobitex was blocked property before June 2. A screening approach that waited for the Nobitex entry to appear in a list feed was, by OFAC's own reading, already late.
The designation record makes the same point. Treasury's June 2 action against Nobitex, Wallex, Bitpin, and Ramzinex stated that Nobitex alone processed more than 50 percent of all Iranian digital asset inflows in 2025 and helped the Central Bank of Iran access hundreds of millions of dollars in stablecoins. Those venues ran public websites quoting USDT against the rial. Any exchange or issuer with meaningful Tron-USDT volume had measurable indirect exposure to them long before the designations. The compliance requirements for stablecoin issuers under the GENIUS Act and the pending FinCEN and OFAC program rules assume exactly this posture: risk-based counterparty due diligence, not a blacklist reflex.
What "Before Designation" Looks Like in Practice
Pre-designation exposure has three observable layers, and a defensible program has to show work on each.
The first is counterparty exposure to Iranian venues, direct and indirect. Direct hops to Nobitex or Wallex deposit addresses are the easy case; two or three hops out, through nested services and over-the-counter desks in the Gulf and Hong Kong, is the hard one. The SDNY civil forfeiture complaint filed September 14 describes two Hong Kong firms, Blessed Trust and Hexa Whale, that presented themselves as a wealth manager and a commodities broker while moving Iranian oil proceeds through a UAE exchange into a wallet cluster that had distributed more than $1.5 billion to Iran's government and the IRGC, with transfers onward to Nobitex. The counterparty that matters is rarely the one on the KYB file.
The second layer is typology. Iran-linked USDT activity has a recognizable shape on Tron: large round-figure transfers between private wallets, intermediary addresses that exist only to break a direct link, and volume that spikes around oil settlement cycles. Chainalysis described the two frozen central bank wallets in April as making frequent transfers of up to tens of millions of dollars, largely with other private wallets, consistent with known IRGC wallets. Our guide to sanctions evasion red flags covers the fiat-side equivalents.
The third layer is the proxy pattern: front companies in third countries, misdescribed business purposes, and ownership that sits just under control thresholds. The OFAC 50 Percent Rule applies whether the owned entity holds a wallet or a bank account. A program that screens wallet addresses but not the beneficial owners funding them has covered half the problem.
None of this is exotic. It is the ordinary content of a crypto AML compliance program with the Iran typologies loaded in. The gap is not capability. Most programs simply treat designation as the trigger for review rather than the confirmation of a risk they should already have rated.
The Enforcement Posture Has Already Moved
The Senate report lands in a week when three separate signals pointed the same direction. On September 22, Reuters confirmed Bloomberg's report that the Manhattan US Attorney's office and the Justice Department's criminal division are investigating whether Binance knowingly allowed trading that violated Iran sanctions. On September 25, Reuters reported that prosecutors in California had seized roughly $84 million from Capstone, a Montana payments company that allegedly told Wells Fargo and JPMorgan it was an IT business while operating as an unlicensed money services business for two crypto firms, which prosecutors did not accuse of wrongdoing.
The third signal is prudential. When the Federal Reserve published its GENIUS Act proposals on September 24, Governor Michael Barr's statement flagged the provision barring the Board from enforcement action on an AML deficiency unless it is "significant or systemic," and said the standard "may have unknown effects on the Board's ability to effectively substantiate that an institution establishes and maintains compliant programs." A higher enforcement threshold does not lower the bar for issuers. It shifts the burden toward proving program effectiveness on demand. Treasury's September 17 designation of BitBank under Operation Economic Outcast, with its explicit secondary sanctions warning to non-US persons, widens the perimeter at the same time.
What We Would Ask a Stablecoin Program to Show
If a regulator or bank partner asked an exchange or issuer to account for its Iran exposure over the past two years, five items answer the question. A dated risk assessment that rated Iranian digital asset exchanges as blocked property before June 2, not after. Counterparty exposure metrics, direct and indirect, to Nobitex, Wallex, Bitpin, Ramzinex, BitBank, and their known deposit clusters. Monitoring scenarios tuned to the Tron-USDT typologies described in public forfeiture complaints, and the alerts they produced. Enhanced due diligence files on Gulf and Hong Kong intermediaries showing business purpose tested against actual flow, not accepted from a questionnaire. And a written rationale for every alert closed as a false positive that an examiner can follow without the analyst in the room.
Most of that work is investigative, not technical: pulling a wallet cluster's history, reading a corporate registry, comparing a declared business to the pattern of settlements, and writing down why the evidence does or does not support a hit. That is where the hours go, and why so many programs default to waiting for the list. Our agents do this work inside the tools compliance teams already use, and every conclusion cites the data it relied on. The freeze is the last step. The program is everything that had to happen before it.
Frequently Asked Questions
What did the Senate PSI report find about Iran and USDT?
According to the Senate Permanent Subcommittee on Investigations Democratic staff report as reported by the Wall Street Journal on September 28, 2026, about 84 percent of 846 Iran-linked wallets sanctioned by US and Israeli authorities transacted exclusively or predominantly in Tether's USDT. The report also states that Iran's central bank accumulated at least $507 million in USDT.
How much Iran-linked USDT has Tether frozen in 2026?
Tether says it has helped freeze roughly $550 million in Iran-linked USDT this year, including more than $344 million across two addresses in April that OFAC later identified as Central Bank of Iran digital currency identifiers, and more than $130 million across four Tron wallets in July. The company says it has frozen more than $4.9 billion globally.
Are Iranian crypto exchanges blocked even if they are not on the SDN List?
Yes. OFAC FAQ 1250 states that Iranian digital asset exchanges are Iranian financial institutions blocked under Executive Order 13599 regardless of whether they appear on the SDN List. OFAC FAQ 1257 adds that non-US persons transacting with designated exchanges face secondary sanctions exposure.
Why is freezing sanctioned wallets not enough for a sanctions compliance program?
A freeze after designation confirms a risk that authorities have already identified. A compliance program is expected to find prohibited or high-risk exposure first, through counterparty due diligence, indirect exposure measurement, and typology-based monitoring. Regulators and prosecutors increasingly examine what an institution knew, or could have known, before a designation was published.
.png)
