Israel’s Ministry of Defense has ordered the seizure of 187 cryptocurrency wallets it claims are owned by Iran’s Islamic Revolutionary Guard Corps (IRGC), a group designated as a terrorist organization by the United States, the European Union, and Israel. The announcement, made on Monday, targets wallets that the ministry’s National Bureau for Counter Terror Financing (NBCTF) believes are used for severe terror crimes.
Blockchain monitoring firm Elliptic reported that these wallets have collectively received $1.5 billion in Tether’s USDT stablecoin over time. However, Elliptic’s co-founder and chief scientist, Tom Robinson, emphasized that the firm cannot independently verify the IRGC’s ownership. He noted that the wallets currently hold just $1.5 million, a small portion of the total funds that have passed through them.
The Israeli Ministry of Defense did not respond to inquiries from TechCrunch regarding how it established the link between the 187 wallets and the IRGC. In a blog post, Elliptic suggested that some addresses might be managed by cryptocurrency services and form part of broader wallet infrastructure serving multiple customers, potentially complicating direct attributions.
Amir Rashidi, director of digital rights and security at the Iran-focused nonprofit Miaan Group, speculated that Israel may have uncovered details about these wallets through hacks into Iranian infrastructure. He highlighted longstanding rumors that the IRGC employs cryptocurrency to evade international sanctions. Rashidi added, “Many of these cases might, for example, involve exchanges that are not directly part of the IRGC but are connected to it, similar to many banks, financial and credit institutions, or even companies that appear to be private.”
This action follows a pattern of cyber operations targeting Iran’s digital financial assets. On June 18, during the Twelve-Day War between Israel and Iran, the hacking group Predatory Sparrow—widely believed to be linked to Israel—breached Nobitex, Iran’s largest cryptocurrency exchange. The group stole approximately $90 million in crypto assets and then “burned” them by transferring the funds to inaccessible wallets, rendering them unusable.
Crypto intelligence firms Elliptic and TRM Labs had previously identified Nobitex as a platform utilized by the IRGC, underscoring its role in the group’s financial activities amid sanctions. These incidents highlight the escalating use of cryptocurrency in geopolitical conflicts and counter-terrorism efforts.
