An impartial blockchain investigator claims to have linked the greater than $500 million in Tether (USDT) moved by Iran’s central financial institution to funds stolen from Bybit which can be being laundered by a North Korean hacking group.
The nameless sleuth, generally known as Tanuki42, seemed into two leaked paperwork that made up Elliptic’s findings final week. Elliptic disclosed how Iran’s central financial institution was shifting $507 million price of USDT by way of the nation’s largest crypto trade, Nobitex.
Nonetheless, Tanuki42 believes that “the same entity who is selling USDT to the Central Bank of Iran 🇮🇷 is also buying USDT from groups laundering on behalf of DPRK 🇰🇵.”
Inside the leaked letters, there have been two addresses:
- THwJSxR9qREsgEQjX1cpRw4Rw9WbmPSHVh
- TBaxHwoXQjAmiNZgRKECoA3b6fsrtmoZvB
Tanuki42 traced these addresses to transactions despatched by the entity Modex Co, which accepted Emirati Dirhams from Iran’s central financial institution in trade for USDT.
The crypto tackle (TWnCRk6z6KrwbuszhN6HUkdLRUh4yaVXBh) was discovered to have despatched $5 million to one of many leaked addresses and $10 million to the opposite.
Nonetheless, Tanuki42 additionally discovered that this tackle, believed to be below Modex Co’s management, had acquired roughly $1.7 million of the laundered proceeds from the $1.5 billion hack of Bybit in 2025.
They recognised the account from their earlier work on monitoring funds laundered through Bybit and trying to assist authorities freeze them.
Like Iran, North Korea can also be closely sanctioned and is utilizing USDT to bypass sanctions and assist convert the stolen Bybit funds into fiat.
One Elliptic report discovered that to launder $24 million, North Korean hackers had been creating nugatory tokens, after which changing them into jUSDT, a type of USDT deployed into the JustLend protocol on Tron.
The Nobitex trade, which Iran relied on to carry its USDT, was additionally hacked final 12 months by a pro-Israeli group.
They stole $90 million, and in line with Elliptic, this led to Iran shifting its USDT away from Nobitex and thru numerous different blockchains.
