OFAC listed three Amin Exchange wallets. 28 it left out took in $72.7M, and the newest were still taking payments on the day of the listing

01 · The sanctionsOFAC sanctions eight Canadian money exchanges

Some currency exchange shops in Toronto and Vancouver trade in Iranian rials. Iran's money is hard to send abroad, since US sanctions cut its banks off. Some of these shops turn rials into crypto instead, the US Treasury says. On 6 November, it named eight of them.

OFAC, the Treasury's sanctions office, added the eight firms to its list under an order that covers Iran's crypto trade. Americans can no longer deal with them, and must freeze any property of theirs they hold. OFAC also published six wallets that four of the firms used. All six sit on TRON, a blockchain where USDT moves fast and cheaply. USDT is a stablecoin, a token that tracks the US dollar. The firms on the list include Million Exchange, Farah Exchange, CCC and Amin Exchange. The Treasury says many of them traded with sanctioned Iranian crypto exchanges and with addresses linked to Iran's Revolutionary Guard, the IRGC. It says several also worked with Ryan Wedding, a Canadian drug trafficker already on OFAC's list.

Bitquery indexes every payment on TRON, so we traced the six wallets and the wallets that traded with them. The six had gone quiet months before OFAC acted. Amin Exchange, one of the eight, had already moved its business to fresh wallets. We found 28 of them. Between January and November they took in $72.7M, and the newest cluster was still taking payments on the day OFAC published its list. Shared gas payments, shared customers and shared exchange accounts tie them to Amin. No payment runs straight from Amin's listed wallets to the newest ones, though. TRM Labs, a blockchain data firm, published its own analysis of the action, and we note where its figures and ours agree. The chain shows money moving between wallets. It cannot show who holds the keys, or why.

02 · How it worksHow a sarafi turns rials into USDT

In Persian, people call a money exchange a sarafi. OFAC says these firms took rials and other currencies from customers and paid them out in crypto. On TRON, that means USDT moving between wallets in public, where anyone can follow it.

Most transfers on TRON cost a small fee in TRX, the network's own coin. So a new wallet usually can't move USDT until someone sends it TRX for gas. That first top-up is a strong clue. A wallet that tops up many new ones is a gas wallet, and the wallets it funds often share one owner.

A sarafi also needs an off-ramp, a way to turn USDT back into ordinary money, and exchanges are the usual one. Each exchange account gets its own deposit address. So when two wallets pay the same deposit address, they pay into the same account.

Sanctions bite through the firms that follow US rules. Tether, which issues USDT, can freeze the USDT in any address. Our audit of USDT freezes shows how it acts on OFAC's list. But the list names addresses. A wallet that isn't on it carries no flag.

03 · The listed walletsSix sanctioned wallets that had already gone quiet

The six wallets took in $228.3M in USDT. Million Exchange's single wallet handled two thirds of it, in less than a year and a half. Farah's wallet ran the longest. CCC's was the smallest.

The money had stopped long before OFAC acted. None of the six had sent any USDT for at least 163 days, and CCC's wallet, the first to go quiet, had sat idle for 454. Together they held 70 USDT and a little TRX. There was almost nothing left on them to block.

TRM Labs counts $120.7M flowing into Million's wallet over the 14 months before it went quiet, and our count matches. TRM links the silence to Wedding's arrest in January. On our data, the wallet's last USDT left on 19 February.

04 · Amin's other walletsAmin Exchange kept opening wallets OFAC did not list

OFAC listed three wallets for Amin Exchange. Its list names two companies behind that trade name, a numbered company in Vancouver and Top PC Technician in Toronto. Each wallet stayed busy for only a few months, and together they took in $18.6M.

The newest of the three, TJT3JZ…, led us to the rest. Its very first incoming payment, on 14 January, was a 10 USDT test from an unlisted wallet, TGvUm4…. Twelve days later a third wallet, THH9Kb…, topped up TJT3JZ… with TRX for gas. Later, USDT flowed back from TJT3JZ… to THH9Kb….

THH9Kb… is the gas wallet behind this whole cluster. It had already topped up TGvUm4…. On 10 March it funded four fresh wallets in half an hour. The next day TJT3JZ… sent its last payment, and five of its regular payers started paying one of the new wallets.

On 16 April the four March wallets went quiet within 13 minutes of each other. Five hours later THH9Kb… funded a seeder wallet that sent five new wallets 20 USDT each, and one of those topped up an eleventh. None of the eleven carries a label in our data. From January to June they took in $31.1M from outside the group. On 9 June, they stopped.

05 · After 9 JuneThe newest Amin wallets stayed busy until the listing day

On the morning of 9 June, the April wallets swept their last TRX into one of the group. At 07:09 UTC that wallet sent its last USDT to an exchange deposit address. At 07:33 a brand-new wallet, TE9RkK…, received a small withdrawal of USDT and TRX from KuCoin, a large exchange. Within 23 minutes it had topped up four more fresh wallets. The old wallets never took another payment, and the new ones started that same morning.

Amin's cluster ran the same play twice more. On 10 August a new funder got TRX from KuCoin and topped up four fresh wallets in under ten minutes. On 21 September another did the same for six. Each batch took over from the one before. Money moved between them too: a wallet from the August batch later sent the September funder 141,743 USDT.

Together the 17 new wallets took in $41.6M from outside the cluster, and payments kept coming through October. The last one landed late on 6 November, the day OFAC acted. The next morning one of the wallets paid an exchange deposit address, and the cluster still held about 84,000 USDT.

No payment runs straight between Amin's earlier wallets and these 17, so the link is indirect. Four things tie them together. Both groups paid the same three exchange deposit addresses, at Binance, Bybit and KuCoin, and Amin's listed wallet TJT3JZ… paid the Binance one too. Twelve wallets with no label paid both Amin's listed wallets and the new ones. The biggest sent a listed Amin wallet 40,000 USDT and the new wallets $1.60M. Every batch started the same way, with one wallet paying the gas for several new ones within minutes. And the first new funder got its coins 24 minutes after the old wallets went quiet.

We rate the link moderate to high. It points to the business behind Amin's listed wallets, though the chain can't say whether that is the Vancouver company or the Toronto one. TRM reports that NIA Nations, another of the eight firms, paid Amin $968,342 between late June and late August. Those dates fit the new wallets, but TRM doesn't publish its addresses, so we can't match the payments.

06 · Iran's Revolutionary GuardPayments with wallets tagged to the IRGC

The Treasury also says many of the firms dealt with addresses linked to the IRGC. Our data shows three of them did. Our labels tag three TRON wallets as IRGC wallets, and Israel's counter-terror finance bureau named all three in a seizure order. Two of them sent Million Exchange 455,231 USDT early in 2025, and the third sent CCC 300,000 USDT that June. Farah Exchange paid the third a small sum. Our labels mark all three as frozen by Tether.

Million also traded with Keyvan Fayyaz Gareh Blagh, whom OFAC listed under its cyber program in August. A year earlier Million sent his wallet 10,000 USDT and got 100,700 back, and TRM reports the same two payments. Farah's record goes back further. In 2023 and 2024 it sent $2.0M to two wallets that our labels flag for money laundering. Our labels mark both as frozen by Tether.

The firms also paid each other. Late last year, Amin's listed wallet TLyRLC… sent Million Exchange 835,460 USDT in nine payments. A TRON transfer can carry a short note, called a memo. All nine carry the same three letters: mil.

Payments with the Iranian exchanges that OFAC listed in June stayed small. The largest was about $32,000, from Nobitex to Million. We found no payment between the six wallets and the three that OFAC lists for Ryan Wedding. We found none with Shelbit's listed wallet either. Shelbit is an Iranian exchange that OFAC listed in August. TRM reports $311,250 from Shelbit to Amin, plus Farah payments with Shelbit and Wallex, through wallets that aren't on the list. Our labels don't cover those wallets.

07 · The exchangesThe exchanges hold the next clue

All six listed wallets took money from KuCoin. Its hot wallet, the one it pays withdrawals from, sent them $6.2M in all. MEXC, Binance, Kraken and Bitget paid in too, and the six cashed out through deposit addresses at Binance, MEXC and KuCoin. Our labels name only 9% of the money the six took in and 7% of what they sent. The rest moved through wallets with no label.

The three deposit addresses that both Amin clusters used are the clearest lead. Each belongs to one account at Binance, Bybit or KuCoin, and each exchange can see whose account it is. Timing and shared payers also found X Wallet's new wallets after it swapped them on 5 November.

08 · The methodHow we traced the wallets

We traced every payment with Bitquery's TRON data on 7 November 2026. Then we checked the totals for the newest wallets against a second copy of that data. Bitquery's address labels name the exchanges. Some of the work ran through the Bitquery MCP server, which lets an AI assistant query on-chain data. We traced a $110M TRON laundering circuit the same way. The full TRON history is also sold as files, as the TRON dataset on the Bitquery Data Store. For cases like this, we also run crypto investigation services for compliance teams and law enforcement.

09 · The recordAddresses for crypto sanctions screening

Seven of the addresses below are on OFAC's list: the six from 6 November and Blagh's. The 28 wallets we tied to Amin aren't on it, so they carry no sanctions flag. We publish them so compliance teams can review them in their crypto sanctions screening.

FAQ

What did OFAC announce on 6 November 2026?

OFAC, the US Treasury's sanctions office, sanctioned eight Canadian money services businesses under an Iran sanctions order that covers crypto. They include Million Exchange, Farah Exchange, CCC and Amin Exchange. OFAC also published six TRON wallets that four of them used.

Which crypto wallets did OFAC sanction?

Six TRON wallets: one each for Million Exchange, Farah Exchange and CCC, and three for Amin Exchange. They took in $228.3M in USDT, and none had sent any USDT for months when OFAC listed them.

Are Amin Exchange's other wallets sanctioned?

No. The 28 wallets we tied to Amin aren't on OFAC's list. Together they took in $72.7M this year, and the newest were still active on 6 November. Shared gas payments, shared customers and shared exchange accounts link them to Amin.

What is Amin Exchange?

Amin Exchange is the trade name OFAC gives two Canadian companies, a numbered company in Vancouver that also goes by Sarafi Amin, and Top PC Technician in Toronto. A sarafi is a money exchange. OFAC sanctioned both in November.

How did these firms move Iran's money with crypto?

OFAC says they took rials and other currencies from customers and paid them out in crypto. On TRON, Amin ran short-lived USDT wallets and opened a new batch every few weeks, each batch topped up with gas by one funder wallet.

Did the Canadian firms deal with Iran's Revolutionary Guard?

Three of them traded with TRON wallets tagged to the IRGC. CCC and Million Exchange took 755,231 USDT from such wallets, and Farah Exchange paid one of them a small sum.