According to Elliptic research, the Central Bank of Iran secretly purchased over 500 million USD worth of USDT to stabilize the collapsing Rial and bypass banking sanctions to maintain trade. Initially relying on domestic exchange Nobitex, but after a $90 million hacker attack in June 2025, they shifted to cross-chain bridges and decentralized exchanges.
Iranian Central Bank Secretly Establishes USDT Reserve Network
(Source: Elliptic)
Elliptic states that they discovered a cryptocurrency wallet network controlled by the Central Bank of Iran (CBI), which accumulated at least $507 million in USDT by 2025. This figure represents a lower bound, as the analysis only includes high-confidence wallets; the actual scale may be larger. The USDT purchases were conducted in stages, indicating a systematic, state-level strategy rather than temporary market operations.
Leaked documents revealed by Elliptic show that the Central Bank of Iran purchased USDT twice in April and May 2025, both times paid in UAE Dirham (AED). These purchases coincided with increased pressure on the Rial and heightened volatility in the foreign exchange market. Starting from these documents, Elliptic mapped out a broader wallet infrastructure of the central bank, revealing a systematic accumulation of stablecoins.
The core logic of this strategy is to use USDT as a parallel dollar reserve. Due to US sanctions cutting off Iran from the global banking system, traditional dollar clearing and correspondent banking are severely restricted, limiting Iran’s ability to utilize foreign exchange reserves. Even with ample oil revenues, Iran finds it difficult to convert these into usable international payment means. USDT offers an alternative: it is pegged to the dollar, transferable globally, and does not go through traditional banking channels.
Rial Collapse Crisis Drives USDT Demand
Over the past year, Iran’s currency crisis has worsened, with the Rial plummeting to historic lows in the open market. By early 2026, the exchange rate had deteriorated to the point where the Rial’s purchasing power was nearly wiped out, fueling public anger and market panic. Although the Rial technically did not fall to “zero,” its rapid devaluation made it nearly unusable for international trade and savings.
Multiple exchange rates, high inflation, and loss of confidence have forced businesses and households to turn to alternative assets such as USD, gold, and cryptocurrencies. Against this backdrop, the Iranian central bank’s USDT purchases serve dual purposes: on one hand, as a foreign exchange intervention tool, injecting stablecoins into the market to absorb selling pressure during Rial devaluation; on the other hand, as a settlement tool for international trade, bypassing banking sanctions to complete transactions with foreign suppliers.
Sanction pressures have intensified the crisis. USD clearing and correspondent banking are heavily restricted, severely limiting Iran’s ability to use foreign exchange reserves. Even with substantial oil revenues, these funds are often frozen in foreign banks or only accessible through barter. The emergence of USDT provides a gray area: it is not legal tender, not directly regulated by banks, but can be used as a store of value and transfer medium.
Initially Relying on Nobitex Exchange as Liquidity Channel
Until mid-2025, most of the USDT held by the Central Bank of Iran flowed into Iran’s largest cryptocurrency exchange, Nobitex. Nobitex allows users to hold USDT, exchange it for other cryptocurrencies, or sell it for Rial. This pattern indicates that the central bank initially used the exchange as a domestic liquidity conduit, with USDT acting as a parallel dollar reserve, exchangeable for local currency when needed.
The advantage of this approach is convenience and efficiency. As Iran’s largest exchange, Nobitex has the deepest liquidity pools and the broadest user base. The central bank can quickly convert USDT to Rial or vice versa to intervene in the foreign exchange market. Additionally, using a domestic exchange reduces cross-border transfer and compliance complexities.
However, this approach carries significant risks. Concentrating large amounts of national assets on a single platform makes it a clear target for attacks. Moreover, the security and operational transparency of centralized exchanges are always major concerns in the crypto space. These potential risks materialized in June 2025.
$90 Million Hacker Attack Triggers Strategic Shift
(Source: Arkham)
On June 18, 2025, pro-Israel organization Gonjeshke Darande launched a $90 million hacker attack on Nobitex. The group accused Nobitex of aiding sanctions evasion and claimed to have destroyed the stolen assets. The attack not only caused significant losses but also exposed the vulnerability of Iran’s reliance on a single platform.
After June 2025, fund flows changed abruptly. Elliptic found that USDT was no longer primarily routed through Nobitex but was transferred via cross-chain bridges, moving assets from TRON to Ethereum. Subsequently, funds were exchanged on decentralized exchanges, transferred across blockchains, and routed through some centralized platforms. This process continued until the end of 2025.
This strategic shift indicates that the Iranian central bank is learning to adapt to security threats in the crypto ecosystem. Cross-chain bridges and decentralized exchanges, while more complex to operate, offer higher resistance to censorship and asset dispersal. Funds are no longer concentrated on a single platform but spread across multiple blockchains and protocols, reducing single points of failure.
Data Leak Rumors Raise Internal Security Concerns
Businessman Babak Zanjani claims that the central bank purchased USDT to manage the foreign exchange market and transferred funds to wallets associated with the national bank’s technology subsidiary. More worryingly, Zanjani states that the wallet addresses were soon exposed and subsequently marked by hostile actors.
He wrote: “What’s concerning is that every time we transfer USDT into a wallet, our wallet address is either leaked to hostile networks or listed on Israel’s sanctions and seizure lists within a short period. This raises a serious and fundamental question: Is there information leakage within the central bank? Or is Israel secretly monitoring the structure and operations of the central bank?”
Although these claims are unverified, they have intensified calls for greater transparency from the central bank and its technical partners. Blockchain’s transparency is a double-edged sword: it makes transactions verifiable and immutable, but also means that once wallet addresses are identified, all transaction history is exposed.
