Nominis, a blockchain intelligence firm, says five anomalies in a set of OFAC‑sanctioned wallets suggest the $344 million Tether (USDT) freeze may not be Iran‑linked, challenging a key assumption behind one of the most consequential on‑chain enforcement actions to date. In an analysis released Sunday, CEO Snir Levi details behavioral patterns that he argues diverge from historic Islamic Revolutionary Guard Corps (IRGC) activity and instead align with Chinese state‑linked infrastructure, reframing how market participants interpret the origins and risk profile of the seized stablecoin holdings.

Market Movement

According to Nominis, the designated addresses exhibited a distinct activity arc that began in mid‑2021, when the wallets started moving USDT and steadily scaled up to high‑value transfers through early 2023. After February 2023, that flow largely went quiet, with the wallets turning dormant. This accumulate‑then‑pause pattern stands out against what the firm describes as prior IRGC‑associated flows, which typically keep funds circulating to avoid detection and potential seizure. For traders and compliance teams monitoring stablecoin circulation, the transition from sustained accumulation to inactivity over multi‑year windows points to a treasury‑style posture rather than the rapid cycling often associated with sanctions‑evading tactics.

Nominis also highlights the size and persistence of balances held by the seized addresses. Historically, the firm notes, IRGC‑linked clusters tended to disperse assets across many wallets, capping exposure in each at only a few million dollars and rotating funds quickly. By contrast, the sanctioned wallets in question maintained concentrated, larger balances for extended periods. In market terms, that concentration represents a materially different liquidity and risk footprint, since prolonged holding reduces the velocity of capital through exchanges and over‑the‑counter channels and increases the visible on‑chain inventory in fewer places.

Key Drivers

Direct links between the wallet cluster and exchange infrastructure form another pillar of the Nominis assessment. The firm says a root wallet within the group shows transfers to Huobi—now operating as HTX—and connections into Huione Group infrastructure. Levi describes these flows as consistent with Chinese‑dominated exchange behavior circa 2021 and notes that the observed patterns mirror those Nominis tracks across HTX and related platforms. For market observers, that exchange adjacency matters: routing and counterparties help define liquidity pathways for stablecoins and can indicate where price‑insensitive balances sit versus where active trading occurs.

Operational timing provides an additional signal. Nominis points to a separate HTX deposit address that received roughly $600,000 from wallets tied to the Central Bank of Iran. Temporal analysis of activity at that address, the firm says, aligns more closely with Asia‑based trading cycles than with typical Tehran working hours. From a market microstructure perspective, order flow synchronized with Asia sessions tends to intersect with liquidity available on Asian platforms, shaping spreads and transfer timing in ways different from Middle Eastern or European hours.

Interactions with Bitfinex add further context. Nominis reports that one sanctioned wallet sent small, periodic transfers to addresses linked to Bitfinex and also received a $5 inbound transaction flagged as possible testing behavior. The same wallet later appeared in 2025 within a scam‑related flow. That overlap raises the prospect that retail users were indirectly exposed to sanctioned infrastructure, an issue that can complicate exchange screening and wallet‑labeling practices. For markets, even small transfers can serve as breadcrumbs that affect compliance heuristics, counterpart visibility, and the perceived cleanliness of funds moving through major venues.

Investor Reaction

While the Nominis findings do not alter the scope of the OFAC action, they challenge the prevailing narrative tying the $344 million USDT freeze directly to the IRGC. By emphasizing dormancy after February 2023, concentrated balances over years, and patterns linked to Chinese exchange infrastructure, the analysis reframes how on‑chain investigators and risk teams may categorize counterparties. In turn, this can influence how service providers gate deposit addresses, how trading firms evaluate counterparty exposure in stablecoin rails, and how liquidity is routed when sanctions risk is flagged in clusters rather than in isolated wallets.

Levi also contends that static address blacklists are increasingly insufficient to capture how state‑linked groups maneuver on‑chain. For market participants, that view reinforces the need to compare historical behavior—such as cycling speed, balance concentration, and exchange adjacency—against new activity before drawing conclusions about provenance. As stablecoin sanctions tooling becomes standard practice, the distinction between attribution and pattern matching takes on added significance for onboarding decisions, transaction monitoring, and the pricing of compliance risk into market spreads.

Broader Impact

The reassessment arrives amid heightened enforcement under Operation Epic Fury. Treasury Secretary Scott Bessent said last week that the United States has seized close to $500 million in Iranian crypto as part of the campaign, with the $344 million in Tether frozen at OFAC’s request representing its largest single on‑chain action. Those moves build on January sanctions targeting Zedcex and Zedxion tied to alleged IRGC dealings near $1 billion, underscoring the scale at which stablecoin flows intersect with sanctions policy and exchange risk controls.

In that context, the Nominis analysis situates the disputed wallets within a wider map of infrastructure and timing signals centered on Asia‑aligned activity. If the dominant characteristics of the seized addresses diverge from earlier IRGC patterns—as the firm argues—then further segmentation of wallet clusters may be necessary for exchanges and analytics providers seeking to differentiate between long‑held treasuries, exchange operational wallets, and fast‑moving sanctions‑evasion rings. Such segmentation affects how liquidity providers assess deposit risk, how quickly frozen funds can be identified in overlapping clusters, and how exchanges calibrate heuristics used to screen inbound transfers in USDT.

The firm’s breakdown also underscores the practical challenges that arise when sanctioned infrastructure touches broad retail flows, even indirectly. The 2025 scam‑related overlap cited by Nominis illustrates how small transactions can route through or test addresses that later become subject to enforcement, complicating remediation for platforms and users. In parallel, the reported links to HTX and Huione Group machinery, paired with Asia‑centric trading cycles, point to liquidity corridors that may not align with prior assumptions about the geography of risk in stablecoin markets.

For now, the $344 million freeze remains a focal point for crypto market compliance and trading desks that track how enforcement shapes capital movement across exchanges. The Nominis findings do not change the totals or the status of the sanction but add texture to the underlying activity: accumulation through early 2023, dormancy thereafter, concentrated balances, exchange proximity, Asia‑aligned timing, and traces touching Bitfinex‑linked addresses and a later scam flow. As enforcement campaigns evolve, those nuances are likely to inform how participants evaluate counterparty exposure in USDT and how monitoring frameworks adapt beyond static lists toward pattern‑based assessments.

Taken together, the analysis narrows the gap between headline seizures and the on‑chain realities beneath them. Whether market participants view the anomalies as definitive or as prompts for deeper inquiry, the core takeaway is clear: trading behavior and operational timing can materially shape attribution in stablecoin pathways, and in this case, Nominis believes they point away from an Iran‑linked origin for the sanctioned wallets.