Inside the $61.2M USDT forfeiture tied to Iranian oil sales

A civil forfeiture complaint filed this month seeks $61.2M in USDT tied to Iranian oil sales. The public record, the filing itself and the Tron blockchain, allows the network behind those addresses to be measured directly. $2.72B entered it over 25 months. This is what the on-chain data shows, and how we measured it

Key takeaways

The action covers 2.2% of what entered the wider network. The US seeks forfeiture of $61.2M held in 10 addresses; the wider “Entity A” cluster took in $2.72B from outside sources over 25 months.

More money left in the final week than the freeze secured. $92M left the 10 target addresses in the seven days before freezing, more than the $61.2M ultimately recovered.

The seizure works by destroying and reissuing the tokens, and it needs Tether. The mechanism is established practice, used since October 2024; what’s still unsettled is whether that can happen before a final forfeiture judgment.

The money that left went to high-volume shared hubs, not dedicated deposit wallets. The 25 largest destinations moved $8.53B in total; this network was 17% of their throughput.

What does this case look like at a glance?

Every figure above is reproducible from public sources: the court filing and the Tron blockchain. No proprietary data was required to produce this analysis.

What did the DOJ file against these 10 Tron addresses?

On September 14, 2026, the US Attorney’s Office for the Southern District of New York filed a civil forfeiture complaint against USDT held in 10 Tron addresses. The government alleges the funds are proceeds of black-market sales of Iranian crude oil to Chinese buyers, intended to finance Iranian military agencies, including the IRGC, a designated foreign terrorist organization.

The complaint describes two Hong Kong companies, Hexa Whale Trading Limited and Blessed Trust Limited, which it says misrepresented their business to service providers while moving oil proceeds and providing on-ramp services. None of these parties has been charged with a crime, and all allegations remain unproven.

How the addresses relate

The complaint uses two labels that answer different questions, and they overlap rather than nest.

“Entity A” is a finding about control. The government identifies “at least seven interrelated cryptocurrency addresses” which, “based on transaction flows and clustering heuristics, including address activation history and the flow of USDT and TRX,” it says “have at all relevant times been controlled by the same person or entity, or group of individuals or entities working together.” That is an attribution claim: these seven share an operator.

The 10 defendants are the property being sued. Civil forfeiture is an action in rem, against the asset itself, not a person. The defendants are the addresses the complaint says were “used to hold and to launder the proceeds,” and they were presumably selected because they still contained USDT when they were frozen.

So an address can be in one set, the other, or both:

Pullout
Concentration check: of everything the 10 defendant addresses sent out, 49.2%, or $500M, went to a single Entity A address.

The claim that reaches further than the 10 addresses

Three claims are pleaded. Two are standard forfeiture theories, reaching proceeds and property involved in money laundering. The third, 18 U.S.C. § 981(a)(1)(G), reaches all assets of an entity engaged in a federal crime of terrorism, not only proceeds that can be traced to the offense.

The complaint applies it directly to the cluster, pleading that “all assets of Entity A” are forfeitable, “including funds that are sent by or received by Entity A.”

On that theory, money arriving in one of those addresses in future would be claimable as an asset of the entity, whether or not those particular dollars could be traced to an oil sale. The five emptied cluster addresses are not closed positions in legal terms, and the 2.2% figure measures what was present when the freeze landed rather than the limit of what the government says it can reach. How far that theory extends is a question for the court; we are describing what is pleaded.

Is Tether’s burn-and-reissue seizure mechanism new?

Much of the commentary has focused on a single footnote: Tether will burn the tokens in the target addresses and issue replacements into government custody. The framing has been that this is a breakthrough for asset recovery.

It is established practice. The clearest precedent is from June 2025, when the same issuer publicly confirmed facilitating a $225M seizure in a District of Columbia civil forfeiture action, 3.7 times the size of this case and fifteen months earlier. Crystal covered this same mechanism at smaller scale in our analysis of the Garantex freeze, and documented US cases using it run back to October 2024.

What remains unsettled is narrower: whether it is lawful to destroy the named property and mint a replacement before a final forfeiture judgment. That question is live in at least two actions: one filed two weeks before this complaint over a $42.4M freeze, and another seeking turnover of $344M frozen earlier this year. Separately, the GENIUS Act gives foreign issuers until July 2028 to meet US compliance standards, a deadline that doesn’t resolve this narrower question on its own.

The more practical observation is simpler. These addresses were frozen on June 15 and July 26, 2025. The complaint was filed 14 months later. Freezing was the fast part.

How much of the network did the freeze reach?

The 10 addresses named as defendants are the residue of a two-year operation rather than its balance sheet.

Per address the share held ranges from 0.3%, one took in $359M and was holding $1M when the freeze landed, to 99.2%, an address that received $12.5M and never moved it again.

Against the seven-address cluster the denominator is larger: $2.72B of external inflow across 10,118 transfers and 25 months, of which $61.2M is 2.2%. That $2.72B is the conservative reading. Summing what each of the seven received gives $5.77B, but $3.05B of that is the cluster moving funds between its own addresses, so we subtract it.

We confirmed the freezes independently rather than inferring them from inactivity, querying the USDT contract directly for each address’s blacklist status with a known-frozen address and an active exchange wallet as controls. All 10 are confirmed frozen, and their balances match the complaint to the cent.

Several addresses ran at once, and the roster changed

The seven were not used one after another. Between two and four were active in any given month, and in March 2025 six were. Individual addresses stopped being used and others took over, with long periods of overlap; their active spans run from four months to 17.

One changeover is unusually tight. On the morning of March 29, 2025, inside about two hours, the TLsfw address made its final transfer at 10:29, the TWzSi address made its first at 10:49, the TU6Vd address made its final at 10:58, and the TBJT9 address made its first at 12:12.

A freeze therefore reaches whichever addresses are holding a balance on the day it lands, across a roster that keeps changing.

And the last week was the busiest

On the morning of July 26, 2025, one address sent $8M out in three transfers between 07:06 and 07:18, to a single destination, before the blacklist reached it. Another moved $14.5M the day before.

An eleventh Tron address shows the same pattern from the issuer’s side. It is blacklisted but is not named in the complaint: it passed $67.2M through between February and July 2025 and was holding nothing when it was frozen. A freeze that lands after the money has moved has no property to forfeit, so it never becomes a case at all.

Where did the frozen network’s outgoing funds go?

We followed the 25 largest destinations of the cluster’s outflow, $1.45B, or 54% of everything that left it, one hop further.

A dedicated deposit address sends nearly everything to one destination. None of these does: their largest single destination takes between 5% and 46% of outflow, and the rest spreads across hundreds of counterparties, 1,809 in one case.

So the funds did not move into wallets built for this network. They moved into high-volume hubs that receive from a broad range of sources and move roughly six times what this network put into them. Following an individual dollar past that point means separating it from $7.08B contributed by everyone else, which is a question about method and access, not one the public transfer graph answers on its own.

The complaint reflects that division. Its cluster attribution is expressly chain-based; the government cites “transaction flows and clustering heuristics,” including activation history, and that work reproduces from public data. The step from a cluster to named companies draws on Binance’s customer and transaction records. Structure, scale, and timing are on the chain; identity came from the exchange.

Is any part of this network still active?

Two findings from the chain do not appear in the complaint.

The wallet that created the seized addresses was never frozen, because it never held money. A single address activated seven of the 10 defendants within a four-hour window on May 14, 2025, confirming the clustering method the complaint describes. Its lifetime USDT balance has never exceeded $196.50. Its only function is to activate new addresses and pay transaction fees. There is nothing in it to freeze, and it is not blacklisted. It went quiet in June 2025, then sent one further transaction on July 14, 2026, funding an address created two weeks earlier that went on to process $6.1M across 1,755 transfers, running until two weeks before the complaint was filed.

By the clustering standard the complaint sets out, that address is connected to the seized cluster. We would put it cautiously: a single fee payment is weaker evidence than a shared activation parent, and the newer address behaves differently. It is a lead, not a conclusion.

The private keys are still live. The largest frozen address has signed four unlimited approval transactions since it was frozen, in August 2025, October 2025, April 2026, and July 17, 2026, each authorizing a different new address to spend its balance. Someone still controls that key and was still trying to move the funds two months before the complaint was filed. The blacklist, not the seizure, is what stops them.

Meanwhile, almost nothing has been paid into the frozen addresses since: $1.00 in total, and that is dust. The counterparties understood immediately what had happened.

Frequently asked questions

What is the SDNY’s forfeiture complaint against USDT tied to Iranian oil sales? On September 14, 2026, the US Attorney’s Office for the Southern District of New York filed a civil forfeiture action seeking $61.2 million in USDT held across 10 Tron addresses. The government alleges the funds are proceeds of black-market Iranian oil sales, laundered through two Hong Kong companies, Hexa Whale Trading Limited and Blessed Trust Limited, using Binance trading accounts. No party has been charged with a crime, and all allegations remain unproven.

How much of the wider network did the freeze actually reach? The 10 frozen addresses hold $61.2 million, but the broader “Entity A” cluster the complaint identifies took in $2.72 billion from outside sources over 25 months. The action covers about 2.2% of what moved through the wider network, the residue still present when the freeze landed, not the full scale of the operation.

. Did money move out of the addresses before they were frozen? Yes. In the seven days before each freeze, $92 million left the 10 target addresses, and another $10.4 million moved out on the freeze days themselves, more than the $61.2 million the freeze ultimately secured. Detection-to-freeze speed, not the freeze itself, determined how much was recovered.

Is any part of the network still active? Two chain findings not in the complaint suggest yes. The wallet that activated seven of the 10 frozen addresses was never itself frozen, since it never held funds, and sent a further transaction as recently as July 14, 2026. Separately, the largest frozen address has signed four unlimited approval transactions since being frozen, most recently on July 17, 2026, meaning whoever holds the private key is still trying to move funds; only Tether’s blacklist prevents it.

Are the $2.72 billion and $1.5 billion figures measuring the same thing? No. The complaint’s own figure, “more than approximately $1.5 billion,” refers specifically to proceeds of the alleged Iranian oil sales. Crystal’s $2.72 billion measures all USDT that arrived at the same addresses from outside the cluster, regardless of source. Both are reproducible from public data, but they answer different questions.

How reliable is the on-chain attribution in this analysis?

Address prefixes are not identifiers on Tron. The complaint abbreviates five cluster addresses to their first five characters. Those addresses are recoverable from chain data, but a prefix search returns 38 candidates for one of them, and 37 are decoys: vanity addresses generated to match both the first and last five characters of the real one, then seeded with dust so they appear in transaction histories and get copied by mistake. Only volume separates them. The real address moved $937M; the decoys moved under $100 each. Anyone reproducing this work from prefixes alone will publish a wrong address.

Fee-payment links pick up shared infrastructure. The complaint notes, correctly, that one address paying another’s fees can indicate a relationship. Applied mechanically to this dataset, that heuristic also flags an address receiving dozens of small payments from the provisioning wallet, which turns out to be part of the energy-rental market operated around JustLend, a Tron lending protocol. It has never transferred a dollar of USDT. It is infrastructure the network rented from, alongside thousands of unrelated customers.

A shared activation parent and a shared fee payer are different kinds of evidence. The first is specific to the addresses involved; the second can be an artifact of both parties using the same service.

What does this case mean for compliance teams and policymakers?

For compliance teams, the practical lesson is about tempo. The interval between detection and freezing determined the outcome here, and it was measured in days. More money left in the final week than was ultimately secured.

For policymakers, the record here is mixed and worth reading in full. Issuer freezing held: these funds have been immobilized for 14 months against an operator still attempting to move them, and the mechanism is now routine enough to be litigated rather than debated. The measurable constraint is elapsed time: between the money arriving and the freeze landing, and between the freeze and the complaint.

And for anyone assessing an exposure: the addresses in a court filing are the ones that were still holding money when they were frozen.

This analysis ran on nothing but a public court filing and the Tron blockchain, using the same clustering and attribution methodology built into Crystal Expert.

This analysis is based on the public court filing in 26 Civ. 8010 (S.D.N.Y.) and on public Tron blockchain data as of September 17, 2026. All allegations described are unproven, and no party referenced has been convicted of any offense. Nothing here is legal or investment advice. Our figures and the complaint’s measure different quantities: the complaint states proceeds of the alleged oil sales, while we measure all USDT arriving at the addresses concerned. Both are reproducible from public data.