Two terror-finance freezes on Tron: one caught $538,000, the other caught $28

On 1 July 2026 OFAC, the US Treasury’s sanctions office, added 134 cryptocurrency addresses to its entry for ISIL Khorasan: 131 on Tron and three on Monero. Tether blacklisted all 131 Tron addresses the same morning, between 08:00 and 08:54 UTC. Chainalysis reported that they had received more than $1.4 million and sent out more than $880,000.

On 23 July OFAC designated Zaid Issam Ahmed Al-Jebouri, an Iraqi national in Istanbul, as part of a network financing Hamas, and listed seven Tron addresses under his name. Tether blacklisted six of them at 21:43 UTC that day. Chainalysis put the amount they had received at about $38.6 million.

Who the wallets belong to is OFAC’s statement, not ours. Below is what the addresses did on chain, read on 7 October 2026. For every one of the 138 the USDT received minus the USDT sent equals the balance, so the count is complete.

The 131 wallets received 1,402,014 USDT from outside in 553 transfers from 236 senders, and sent 863,744 USDT out to 295 addresses. That matches the published figures. The difference, 538,270 USDT, is what Tether froze: it sits on 59 of the wallets, and 26 of them hold $10,000 or more each.

The inflow grew every year: 73,000 in 2023, 223,000 in 2024, 706,000 in 2025, and 401,000 in the first half of 2026. Most of what was frozen had arrived between February and June 2026.

It is usually described as donations, and by number of transfers it is: half of them are under $480. By money it is not. 48 transfers of $10,000 or more account for 852,000 USDT, 61% of everything received. One sender delivered 102,000 USDT to three of the wallets within a single minute on 22 April 2026. The 131 wallets also moved 1.12 million USDT among themselves.

There was no flight. The last outgoing payment was made at 20:25 UTC on 30 June, eleven and a half hours before the first wallet was blacklisted, and it was an ordinary 350 USDT. After the freeze a few senders kept paying in: 1,365 USDT arrived on frozen wallets in the following days and is stuck there.

The seven addresses received 24.73 million USDT from 692 senders and paid the same amount out to 745 recipients. Our count covers USDT only and is lower than the $38.6 million Chainalysis reports; we give our number and do not know what accounts for the gap.

They were not used together. They were used one after another: the first through 2022, the second from December 2022 to February 2023, the third until January 2024, the fourth until July 2024, the fifth until January 2025, and the last two for a few weeks each in early 2025. Each was emptied before the next took over. The busiest year was 2024, with 11 million USDT.

The last real payment, 20,330 USDT, left on 22 March 2025. The designation came on 23 July 2026, sixteen months later. On that day the seven wallets together held 27.94 USDT. Six were blacklisted; the seventh, which is empty, was not.

Of the 24.73 million that reached the seven wallets, 14.3 million — 58% — came directly from the withdrawal wallets of centralised exchanges: about 5.1 million from MEXC, 4.3 million from KuCoin, 1.9 million from OKX, 1.3 million from Binance, 0.7 million from Gate. That does not mean the exchanges did anything wrong; it means the people who paid these wallets were exchange customers, and each of those withdrawals has an account behind it.

On the way out the picture is different: only about 0.66 million went to addresses we can tie to an exchange. 3.65 million went, in 2022 and early 2023, to addresses that Israel’s counter-terror-financing bureau named in seizure orders in 2023. After those orders the payments simply continued through the next wallets in the chain for two more years.

For ISIS-K the exchange share is smaller: about 315,000 USDT came from exchange withdrawal wallets and about 217,000 went to exchange deposit addresses, most of it at MEXC.

The same tool — a sanctions listing followed by a Tether freeze — produced two opposite results in one month. Where the wallets were listed while still in use, more than a third of all the money that had ever touched them was caught. Where they were listed sixteen months after the owner had moved on, practically nothing was. A wallet that is rotated every few months and emptied each time is not hurt by a freeze that arrives later.

For anyone who checks addresses the lesson is the other way round: the list tells you which addresses are sanctioned today, not who was paid through them yesterday. In our database all 138 addresses carry the sanctions label from OFAC’s list, and an address that traded with them directly shows that link as its risk. You can check any address on the address check page. A similar reading of a much larger case: Iran’s central bank on Tron.

It does not say who owns any wallet beyond repeating OFAC’s attribution. It does not say that people who sent money to these wallets, or received money from them, knew what they were dealing with. It covers USDT on Tron only; the three Monero addresses cannot be read from outside. Exchange names refer to the exchanges’ own labelled wallets and deposit addresses in our database.