Tether has said it helped freeze nearly $550 million in Iran-linked USDT this year as U.S. authorities targeted wallets tied to the Central Bank of Iran and other sanctioned networks.

Tether said on Sep. 28 that it acted on information from the Treasury Department’s Office of Foreign Assets Control and U.S. law enforcement when more than $344 million in USDT was frozen across two addresses in April. OFAC added the same addresses to the Central Bank of Iran’s sanctions entry the following day. The entry also identifies links to the Islamic Revolutionary Guard Corps-Qods Force and Hezbollah.

In July, more than $130 million was frozen across four other wallets as Treasury added four TRON addresses to the central bank’s designation. Tether put its total for Iran-linked USDT freezes in 2026 at approximately $550 million. Its announcement gave the amounts for the April and July actions but did not itemize every freeze included in that total.

The July action was previously covered by crypto.news, which reported that the four TRON wallets held about $131 million in USDT. Treasury Secretary Scott Bessent said at the time that OFAC had sanctioned multiple wallets tied to Iran’s central bank.

Tether froze two wallets before OFAC listed them

The order of the April steps is central to Tether’s account. According to the company, it supported the freeze after U.S. authorities supplied information about the two addresses; OFAC then formally listed those addresses as digital currency identifiers for the Central Bank of Iran.

Earlier reporting on the April $344 million freeze identified roughly $213 million in one TRON wallet and $131 million in another. The restrictions applied to the USDT held at the addresses. They did not require the TRON network itself to stop processing transactions.

Tether CEO Paolo Ardoino said public blockchains let authorities follow fund movements and that the company can act when law enforcement provides credible information. He described USDT as “not a haven for sanctioned actors, terrorist organizations or criminal networks.” His statement sets out the company’s position; the wallet designations and freeze amounts are separate actions reported by OFAC and Tether.

The issuer said it has aligned its freezing policy with OFAC’s Specially Designated Nationals list, including listed wallets that hold USDT after its initial issuance. A freeze prevents tokens at a blocked address from moving. It is distinct from a government seizure or a court order transferring ownership of the assets.

Treasury has expanded Iran sanctions to digital assets

Treasury launched Operation Economic Outcast on Aug. 24 and named digital assets alongside technology, gold, aviation and shipping in five new sectoral sanctions determinations. The department said the measures expanded its authority to target foreign people and companies operating in or supporting those sectors of Iran’s economy.

For U.S. businesses and individuals, OFAC designations carry direct transaction restrictions when a listed party or its blocked property is involved, unless an exemption or license applies. Treasury has also warned foreign firms about possible sanctions exposure for facilitating Iranian sanctions evasion. Those are Treasury’s stated rules and warnings, rather than a new restriction created by Tether’s announcement.

On Sep. 17, OFAC designated Iranian digital asset venture BitBank, its software developer, and three associates of financier Babak Zanjani under the campaign. Treasury alleged that Zanjani’s network used digital asset businesses to move funds for the IRGC, including hundreds of millions of dollars in Bitcoin. The BitBank sanctions action also placed the developer, Pishtaz Simorgh Electronic Trade Company, on OFAC’s list.

A separate U.S. civil case shows how a wallet freeze can precede an effort to take custody of tokens. In September, prosecutors sought forfeiture of $61.2 million in USDT held across ten TRON addresses that court filings said Tether had frozen in 2025. A Sep. 14 warrant authorized the FBI to take custody of the targeted assets; the forfeiture complaint asks a court to award ownership to the government. That case concerns alleged Iranian oil proceeds and is separate from Tether’s stated 2026 freeze total.

Earlier Iran-linked wallets and U.S. cases add context

Tether also cited work with Israel’s National Bureau for Counter Terror Financing. It said the bureau has referred more than 40 cases involving over 640 addresses, resulting in freezes of more than 22 million USDT. In 2023, the company disclosed a freeze of 32 addresses holding $873,118.34 in a case involving illicit activity affecting Israel and Ukraine.

After the Israeli bureau published a list of 187 addresses it associated with the IRGC in September 2025, blockchain analytics firm Elliptic reported that Tether had blacklisted 39 of them. Approximately $1.5 million in USDT remained in those wallets when they were frozen, according to Tether’s account of Elliptic’s findings.

Across its law enforcement work, Tether said it cooperates with more than 340 agencies in 67 countries and that the efforts have helped freeze over $4.9 billion in assets, including more than $2.4 billion connected to U.S. authorities. The body of its announcement states more than 2,800 investigations globally and more than 1,500 involving U.S. law enforcement, while its page subtitle gives higher figures of more than 2,900 and more than 1,600, respectively.

Among the U.S. cases the company cited was a September Justice Department operation against a marketplace serving scam centers. Tether said authorities restrained more than $52 million in one day and that the department acknowledged its assistance. It also cited a February seizure of more than $61 million in USDT tied to an alleged investment fraud operation, in which the Justice Department and Homeland Security Investigations acknowledged its help transferring the assets.

Bitget CEO Gracy Chen said the crypto exchange’s recent $388 million exploit stemmed from a vulnerability in a third-party security product that allowed the attacker to obtain “high-level internal credentials.”

In comments to Cointelegraph, Chen said the attacker used those credentials to issue fraudulent withdrawal commands. Bitget’s private keys were not compromised, and its cold wallets were not affected, she said.

Bitget said it has since addressed the security flaw and tightened its withdrawal controls, including restricting internal access, adding independent verification for withdrawals and increasing monitoring for unusual activity.

The attack occurred on Sept. 24, when Bitget detected unauthorized transfers from several of its hot wallets and temporarily suspended withdrawals. The exchange initially estimated that about $352 million in assets had been affected.

Related: Bitget resumes Bitcoin withdrawals as hacker swaps ETH via THORChain

Bitget has yet to disclose recovery figures

The exchange has not disclosed how much of the stolen crypto has been recovered or frozen. Chen said some assets have been frozen with help from other industry participants, but Bitget would release a total only after verifying the amounts.

Bitget had previously called on THORChain, a protocol for swapping assets between blockchains, to refuse services to addresses linked to the attack.

The exchange said it is not asking THORChain to halt its network as it attempts to prevent the stolen assets from being moved. THORChain has said it cannot selectively blacklist individual addresses.

“We understand that THORChain operates as a decentralized protocol and has said that it cannot selectively blacklist individual addresses. We respect the technical constraints of different networks and are not asking any protocol to take actions that are not technically possible,” Chen said.

Chen also addressed Bitget’s earlier suspicion that North Korea may have been behind the attack.

“What was shared previously was based on preliminary indicators identified during the investigation,” Chen said.

“Those indicators are still being assessed. Mandiant and SlowMist are supporting the independent forensic investigation, and that work is ongoing. We will share further findings as they are verified,” she added.

Additional reporting by Helen Partz.

Magazine: THORChain under fire over Bitget, ETH evolves beyond blockchain: Hodler’s Digest

Bitcoin BTC$83.292,12 fell to $83,000 on Monday, down 1.7% since midnight UTC and 2.1% over 24 hours, though it is the altcoin market taking the brunt of the damage, with 91 of the 100 CoinDesk 100 constituents lower on the day and the index down 2.6% to 1,874.56.

The unwind is almost a mirror image of Friday, with quant (QNT) falling 16% since midnight after rising 39% over 24 hours in Friday’s session, indexing protocol token the graph GRT$0.03188 is down 12% having gained 14%, and tokenization token ondo ONDO$0.5203 is 12% lower. The sector indices that led the advance are leading the retreat, with the DeFi Select Index (DFX) down 6.4% and 7.3% over 24 hours while the CoinDesk Computing Index (CPUS) lost 3.2% and 5.0%.

The trigger sits in oil rather than in crypto, with President Donald Trump rejecting Iran’s latest terms for reopening the Strait of Hormuz, conditions that included the release of frozen Iranian funds, the lifting of oil sanctions and an end to the U.S. naval blockade of Iranian ports. Brent crude has climbed back above $100 to $100.83, up 3.2% on the day, reversing Friday’s move below that level.

Digital asset-friendly financial institution Franklin Templeton is expanding its “off-exchange collateral program” to Bybit, allowing the exchange’s users to use shares in Franklin Templeton’s tokenized money market funds for crypto trading.

The partnership allows investors and wallet holders on the exchange to pledge shares, which represent about $686 million in net assets, as collateral to borrow stablecoins USDT or USDC while earning yield on the underlying assets, according to a press release on Monday.

The key point is that users will not have to move the underlying assets to Bybit. Instead, regulated custody platform ByCustody will hold the underlying assets off-exchange, with the value mirrored in Bybit’s trading environment to enable yield generation while unlocking trading liquidity, the release said.

This is not Franklin Templeton’s first off-exchange collateral partnership; the firm also offers its tokenized money market funds to customers of Binance and OKX. The work continues the buildout of collateral mirroring in the crypto space and the opportunities that brings, said Sandy Kaul, Head of Digital Assets and Innovation at Franklin Templeton.

LayerZero blamed Kelp for using one verifier instead of several, while Kelp said LayerZero staff had reviewed its setup and never objected. CoinGecko data showed nearly half of active LayerZero apps used the same one-verifier arrangement, and Kelp said it would move rsETH to Chainlink.

CCIP 2.0 offers a similar menu of verifiers, which lets companies run their own or hire outside providers such as Infosys and Nethermind. Chainlink’s own network of 16 independent node operators still checks every transfer, regardless of what else a user adds.

Users shouldn’t have to be “cross-chain security infrastructure experts,” the company told CoinDesk.

“Historically, legacy bridges have lost billions due to insecure infrastructure, while in-house builds are slow and expensive,” Johann Eid, Chainlink Labs’ chief business officer, said in a statement.

The upgrade also changes a safeguard Chainlink used to promote heavily; its Risk Management Network, a separate set of nodes that double-checked transactions, no longer plays that role. Chainlink said that kind of independent check can now come from the optional verifiers instead, which suggests a user who adds nothing now relies on one verifier network, where previously there were two.

Existing Chainlink users were automatically moved to the new version. Still, the company has not named any institution using the new verifiers yet, saying only that Aave and Maple have started adopting some of the upgrade’s other features.

“If every household used AI agents to optimize the return on their cash balances, banks could lose a large share of the cheap deposits they rely on to make loans, which would be a problem for the entire financial system,” he noted.

Agentic finance refers to AI that acts rather than just answers. These agents can monitor balances in real time, compare returns across institutions, move idle cash into higher-yield accounts and move it back in time for bills.

Estimates of the market’s size vary widely. Mordor Intelligence puts agentic AI in financial services at $7.78 billion in 2026 and projects $43.52 billion by 2031. MarketsandMarkets sizes the narrower AI agents segment at about $845 million in 2025.

Crypto is already building the payment rails these agents would need. Coinbase’s x402 protocol, the most widely used agentic payment standard, lets an AI agent pay for online services in stablecoins within seconds, with no account, card or human approval.

To date, the x402 Protocol has reportedly processed approximately 188 million to over 205 million cumulative transactions, with around 69,000 active agents.
Cloudflare, Google, Visa, Mastercard, AWS, Circle and Stripe have joined the x402 Foundation, which the Linux Foundation now governs.

Nate Geraci, co-founder of the ETF Institute, has previously said that AI and crypto are both coming for the traditional banking model.