TRON and Stablecoins at Center of Iran’s $1B Crypto Evasion Network

This article was first published on Deythere.

A January 9, 2026 case study from blockchain intelligence firm TRM Labs (TRON) claims that 2 exchange brands incorporated in the United Kingdom, Zedcex and Zedxion, operated as a stablecoin settlement corridor linked to the Islamic Revolutionary Guard Corps. TRM estimates about $1.0B in IRGC-linked value flowed through the network from 2023 to 2025, or roughly 56% of total volume, with the IRGC share peaking at 87% in 2024.

The report frames the risk as infrastructure, meaning wallets and routing that can move money repeatedly without needing a headline event like a hack.

The flow pattern looks like routine settlement

TRM estimates IRGC-linked flows of about $23.7M in 2023, about $619.1M in 2024, and about $410.4M in 2025, while the IRGC share fell to about 48% as other activity increased.

Why USDT on TRON sits at the center

TRM says transfers were conducted almost entirely in USDT on the TRON blockchain. USDT aims to track $1, and TRON is known for low-fee transfers, so the pairing can act like a compact settlement lane when banking routes are constrained.

How 2 brands can share one set of pipes

TRM argues Zedcex and Zedxion functioned as a single exchange despite separate UK registrations, and that the wallets routed value between IRGC-linked addresses, offshore intermediaries, and domestic Iranian platforms. The report also says parts of the stack appeared nested in white-label infrastructure from ChainUp, alongside additional wallet layers that were not purely off-the-shelf.

TRM highlights Iranian financier Babak Zanjani as part of the wider ecosystem behind the network, framing it as sanctions-evasion finance adapting to stablecoin rails.

The indicators that raise the temperature

TRM says its tracing connected Zedcex-attributed wallets to addresses designated by Israeli authorities as IRGC property under an administrative seizure order issued on September 1, 2025, and it notes that many of those wallets were later blocklisted by the USDT issuer. The report also points to signs of integration with a Turkey-based mobile payment processor, which would provide a bridge from on-chain value into real-world settlement.

A direct sanctioned counterparty link

TRM reports that in late 2024, over $10M in USDT moved directly from a wallet dually attributed to the exchange infrastructure and the IRGC to addresses controlled by Said Ahmad Muhammad al-Jamal. US Treasury sanctions records list al-Jamal and link him to the IRGC-Qods Force, and TRM notes the lack of intermediary routing, increasing the compliance significance of the transfer.

What compliance teams are watching next

After allegations like these, the next chapter usually plays out in the plumbing, not the headlines. Analysts watch for sudden wallet migrations, new deposit addresses, and shifts from public rails into smaller liquidity pools, because that is how operators try to keep the same corridor alive under a different name.

They also track whether stablecoin issuers expand blocklists and whether payment processors tighten onboarding, since the fastest way to choke a high-risk network is often at the fiat edge where cash-outs happen, not on-chain where funds can hop between wallets in seconds.

Conclusion

If the findings are borne out, the central lesson is that sanctions risk in crypto is increasingly rail risk. It depends on who controls the platform, how wallets are managed, and where fiat exits sit, so beneficial ownership checks and continuous wallet monitoring become as important as tracing after the fact, especially for stablecoin-heavy corridors, and it pressures issuers and exchanges to coordinate faster when red flags appear.

FAQs

What is being alleged?

TRM Labs alleges that Zedcex and Zedxion processed about $1.0B in IRGC-linked flows from 2023 to 2025, with IRGC-linked activity dominating volume in 2024.

Why is USDT on TRON central?

TRM says transfers ran almost entirely in USDT on TRON, a combination used for fast, low-fee settlement that can support repeated high-value movement.

Who is Said Ahmad Muhammad al-Jamal?

US Treasury listings identify him as a designated individual linked to the IRGC-Qods Force, and TRM alleges over $10M in USDT was sent to addresses it associates with him.

Glossary of key terms

Stablecoin: A crypto asset designed to track a fiat value.

Wallet attribution: Linking on-chain addresses to real entities.

Beneficial ownership: The people who ultimately control a company.

White-label infrastructure: Outsourced exchange components.

Settlement rail: The route used to move value between counterparties.