Iranian oil money on Tron: $2.7 billion through seven wallets, $61 million frozen, and the 14 months in between

The US Attorney’s Office for the Southern District of New York filed a civil forfeiture complaint on 14 September 2026, case 26 Civ. 8010, against all USDT held in ten Tron addresses. It alleges that two Chinese companies, Blessed Trust and Hexa Whale, used trading accounts at Binance to launder the proceeds of black-market sales of Iranian oil, sending the money to the Government of Iran and to the Islamic Revolutionary Guard Corps, which the US designates as a terrorist organisation.

At the centre is a group of at least seven wallets the complaint calls “Entity A”. It says they received and distributed more than $1.5 billion of Iranian oil money, sent large amounts to the Iranian exchange Nobitex and to money transmitters it describes as IRGC fronts, and that one of them was used by a front company of the Iranian armed forces, Sepehr Energy. Tether had already frozen the ten seized wallets, which hold 61,192,367.59 USDT between them.

A civil forfeiture complaint is an allegation; nothing in it has been proven in court. The attribution below is the government’s. The numbers are ours, read from the chain on 9 October 2026, and for all seventeen wallets the USDT received minus the USDT sent equals the balance.

The complaint names two Entity A wallets in full and gives only the first five characters of the other five: TBd5K, TU6Vd, TLsfw, TCXnC and TWzSi. Each of the five turned up among the counterparties of the named wallets, and each is the only address with that prefix that moved real money: TWzSiPtNaievW4n7ibFNkVK2ZSPkKBqchq, TU6VdVR7EFjMHZBWaC634r3BboiRWNtFnM, TBd5KpeG58ArVoBETSyeeUYT1UfZvV78wW, TCXnCSSRkhhHZApv3s9ZCqY39M7qnwjFN9 and TLsfwELAPThXL3Q9EULeVJoU6yzdgmr5ra.

One detail shows why the complaint shortened them. Around TBd5KpeG58ArVoBETSyeeUYT1UfZvV78wW we found 36 addresses that start with TBd5K and end with V78wW — the same first and last characters. All but one sent a few dollars or nothing at all. They are address poisoning: strangers hoping somebody copies the wrong address from a transaction history. The real wallet moved 1.24 billion USDT.

The seven wallets took in 2.72 billion USDT from 1,225 outside addresses and paid out 2.71 billion to 1,488, between July 2023 and July 2025. That is more than the complaint’s “more than $1.5 billion”, and consistent with it. The flow ran in relays: the oldest wallet, starting with TBd5K, carried the money through 2023 and 2024; the one starting with TU6Vd passed 870 million to it and later 514 million to the one starting with TCXnC; in March 2025 the work moved to the two wallets that were eventually frozen and to their hub, starting with TWzSi.

The busiest months were March and May 2025, with 372 million and 306 million coming in.

491 million USDT came directly from wallets our database labels as Binance’s own withdrawal wallets, nearly all of it between April and November 2024. That fits what the complaint says: that Blessed Trust and Hexa Whale used trading accounts at Binance. Each of those withdrawals came out of a customer account. It does not show the exchange knew whose; the complaint makes no such claim either.

Most of the rest came through a short chain of feeder wallets. The largest of them received 1.31 billion USDT from 116 addresses. Among its sources is a wallet that our earlier reading of Iran’s central bank on Tron found sending 56.5 million to the central bank’s own wallets: here it sent 72.6 million in March and April 2025. Two Iranian money trails, one shared payer.

On the way out the money went mostly to unlabelled wallets — 2.65 billion of the 2.71 billion. We do not have a label for Nobitex or for the money transmitters the complaint describes on Tron, so we cannot confirm those flows from our side and do not try to.

One payment we can name. On 8 October 2024 the oldest Entity A wallet sent 2,000,000 USDT to an address that belongs to Zedcex, an exchange the US Treasury sanctioned in January 2026 for its ties to the Revolutionary Guard. The payment came 15 months before that designation.

Tether froze seven of the seized wallets on 15 June 2025 and the other three on 26 July 2025. The two named Entity A wallets made their last payments on 25 and 26 July — the day of the freeze. The complaint was filed on 14 September 2026, fourteen months later.

Not everything stopped. The largest feeder wallet was never frozen and kept working for three more months: between 27 July and 23 October 2025 it took in and paid out another 197.5 million USDT. It is not named in the complaint and we do not know whose it is. The other four Entity A wallets were not frozen either; by then they held next to nothing.

All seventeen are now marked in our database. The ten seized wallets and the hub already carried the issuer-freeze label and score 100. The four other Entity A wallets were unlabelled and scored 55–70 through their links; we have now marked them as connected to illegal services, with the complaint as the source. We did not mark the feeder wallets, because the complaint does not name them. You can check any address on the address check page.

Other Iranian money we have read on chain: Iran’s central bank and the exchangers sanctioned in August.

It does not say the allegations are proven; they are not. It does not say who controls any wallet beyond repeating the complaint. It does not say that Binance, Tether or any other service knew what the money was. The full addresses of five Entity A wallets are our identification from their first five characters and their flows, not the complaint’s text. It covers USDT on Tron only.