Crypto sleuth links $500M in Iranian USDT to stolen Bybit funds
An independent blockchain investigator claims to have linked the more than $500 million in Tether (USDT) moved by Iran’s central bank to funds stolen from Bybit that are being laundered by a North Korean hacking group.
The anonymous sleuth, known as Tanuki42, looked into two leaked documents that made up Elliptic’s findings last week. Elliptic disclosed how Iran’s central bank was moving $507 million worth of USDT through the country’s biggest crypto exchange, Nobitex.
However, Tanuki42 believes that “the same entity who is selling USDT to the Central Bank of Iran 🇮🇷 is also buying USDT from groups laundering on behalf of DPRK 🇰🇵.”
Within the leaked letters, there were two addresses:
- THwJSxR9qREsgEQjX1cpRw4Rw9WbmPSHVh
- TBaxHwoXQjAmiNZgRKECoA3b6fsrtmoZvB
Tanuki42 traced these addresses to transactions sent by the entity Modex Co, which accepted Emirati Dirhams from Iran’s central bank in exchange for USDT.
The crypto address (TWnCRk6z6KrwbuszhN6HUkdLRUh4yaVXBh) was found to have sent $5 million to one of the leaked addresses and $10 million to the other.
Read more: Iran’s central bank stacked $507M USDT last year, report
However, Tanuki42 also found that this address, believed to be under Modex Co’s control, had received roughly $1.7 million of the laundered proceeds from the $1.5 billion hack of Bybit in 2025.
They recognised the account from their previous work on tracking funds laundered via Bybit and attempting to help authorities freeze them.
Like Iran, North Korea is also heavily sanctioned and is using USDT to bypass sanctions and help convert the stolen Bybit funds into fiat.
One Elliptic report found that to launder $24 million, North Korean hackers were creating worthless tokens, and then converting them into jUSDT, a form of USDT deployed into the JustLend protocol on Tron.
The Nobitex exchange, which Iran relied on to hold its USDT, was also hacked last year by a pro-Israeli group.
They stole $90 million, and according to Elliptic, this led to Iran moving its USDT away from Nobitex and through various other blockchains.
Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.