The Houthis’ eight sanctioned Tron wallets: $915M passed through — and the freeze that mattered came four months before the sanctions

On 2 April 2025 OFAC, the Treasury’s sanctions office, designated a network of Houthi financial facilitators and procurement agents who, it says, worked with Sa’id al-Jamal, a senior Houthi financial official backed by Iran’s Revolutionary Guard Qods Force. The Treasury says the network bought weapons and other goods in Russia and shipped stolen Ukrainian grain to Houthi-held Yemen.

The same day OFAC amended the entry of Ansarallah itself and added eight Tron addresses to it, all marked as USDT. The addresses therefore sit on the group’s own entry, not on any individual’s. Who controls them is OFAC’s statement, not ours. Below is what they did on chain. For each of the eight, the USDT received minus the USDT sent equals the balance, so the count is complete.

From outside the group, the eight received 915.5 million USDT from 1,229 addresses and paid out 914.8 million to 776. The difference is what was frozen.

Almost all of it went through one wallet, TQ5mpZPbQMSq2s1vSM3RJgiB1AsTsiTpFZ. It received its first payment on 17 November 2023 and its last on 1 October 2024. In between it took in 822.7 million USDT in 6,103 transfers. From February to June 2024 it handled more than 100 million a month, with a peak of 181 million in May. Then the flow faded: 37 million in July, 77 million in August, 9 million in September, and nothing after the first day of October.

The other seven were much smaller: 36.4 million, 35.0 million, 20.0 million, 15.9 million, 2.5 million, 1.06 million and one wallet that received a single transfer of 1 million and sent it on.

The same sanctions list attributes several Tron wallets to Sa’id al-Jamal himself. Seven of the eight Ansarallah wallets traded with five of them: 41.9 million USDT came from al-Jamal’s wallets and 39.6 million went to them, 81.5 million in all, from December 2023 to November 2024. The largest single payment was 6,829,503 USDT from TV5ZTpKDszLTF6XcMnPongS33pwBgF91by on 7 October 2024.

This is not an inference from patterns. Both ends of these transfers are on the US sanctions list, under the group and under the man the Treasury calls its financier.

On 9 December 2024 at 20:51 UTC the wallet TM6Kix9wH8cYQ4rLpFifsQ4ddH3rPX3f8p received exactly 1,000,000 USDT. Two minutes later it sent 409,000 on. The next evening, 10 December at 21:12 UTC, Tether blacklisted it with 700,519 USDT on it, and fifteen seconds earlier a second wallet of the eight, with 49,799 USDT. Both balances are still there.

That was almost four months before OFAC listed either address. The other six were blacklisted on 2 April 2025, between 18:06:57 and 18:07:18 UTC, the day of the designation. Together they held 24 cents. So the 750,318 USDT that is frozen today was caught by the earlier action, not by the sanctions.

One of the eight, TXEaKf4rT3rMoD3Vuqnuhwr6vLq6BL5t33, behaves like a Binance deposit address: every one of its outgoing transfers, 1,056,544 USDT in all, went to a single wallet labelled as Binance’s own, usually within a minute of the money arriving. It was active until the end. On 2 April 2025 at 14:05 UTC it received 10,000 USDT and at 14:06 the money was on Binance. Four hours later Tether blacklisted the address.

As with the Tren de Aragua wallets we read earlier, a blacklist on a deposit address stops little, because the money does not stay there. What matters is the account behind it, and only the exchange can see and freeze that.

The 822.7 million in the main wallet came from 929 addresses and went out to 546. Very little of it touched an exchange directly: wallets labelled as exchanges in our database sent the eight less than 3% of what they received.

The outflow has a clearer shape. About 72% of what the main wallet paid out went to wallets that were created in batches on the same days as the main wallet itself: fourteen opened on 17, 20 and 21 November 2023, and fourteen more on 29 and 30 April 2024. The wallets of each batch also went quiet together: those of the first we read stopped on the evening of 21 May 2024, those of the second in the early hours of 4 January 2025. The six largest each passed on between 130 and 270 million USDT to hundreds of addresses.

Wallets that are opened together and switched off together are the working wallets of one operator, rotated in shifts. They look like the payout side of an exchange desk or money broker, not like hundreds of independent customers. We cannot name the operator from the chain, and we have not marked these wallets.

Three things stand out. First, the money that is frozen was caught by Tether’s own action in December 2024, not by the sanctions: by April 2025 the main wallet had been idle for six months, and of the rest only the deposit address was still in use. Second, the list itself documents the ties. Eighty-one million dollars moved between the group’s wallets and its named financier’s, and it moved in USDT on Tron, where every transfer can be read. Third, the bulk of the money went to a rotating set of wallets that one operator controls. The sanctions named the group’s addresses, not that operator’s.

In our database all eight addresses, and al-Jamal’s, carry the sanctions label from OFAC’s list, and addresses that sent them money show that link as their risk. We have not marked the batch wallets, the exchanges or other counterparties. You can check any address on the address check page. Other sanctioned wallets we have read on Tron: Iran’s central bank, ISIS-K and Hamas-linked wallets, Tren de Aragua.

It does not say who controls any wallet beyond repeating OFAC’s attribution. It does not say the senders knew whom they were paying. It does not say the 915.5 million is the Houthis’ money or all of their money — only that this is what passed through the eight listed addresses in USDT on Tron. It does not identify the operator of the batch wallets. “Binance” refers to a wallet labelled as the exchange’s own in our database.