What Iran's Hormuz toll and romance scams have in common

• Key insight: Pig butchering scams and Iranian sanctions evasion share the exact same financial infrastructure, including the Tether stablecoin and offshore exchanges.
• What's at stake: Correspondent banks face a 10-year statute of limitations for sanctions violations as illicit crypto flows convert back to cash at their off-ramps.
• Expert quote: Tether is "a key money laundering tool for the Islamic Revolutionary Guards Corps, sanctioned Iranian banks, and Iranian weapons manufacturers," said Sen. Richard Blumenthal.

Overview bullets generated by AI with editorial review

Following a chaotic weekend of headlines about Iran reopening the Strait of Hormuz then reversing course, there has been an important constant.

Iran's leaders have not moved on their announcement earlier this month that vessels transiting the world's most important oil choke point would have to pay Iran a toll in cryptocurrency.

The country said it would reopen the strait; then President Donald Trump vowed the U.S. naval blockade on Iranian ports would remain in force until Iran reached a deal; then Iran's Islamic Revolutionary Guard Corps, or IRGC, navy closed Hormuz again Saturday.

For bankers, an important compliance story sits beneath the theatrics.

The pipes carrying those toll payments to Iran run on Tether (USDT), a cryptocurrency pegged 1-to-1 to the U.S. dollar. The stablecoin moves across crypto exchanges including Zedcex and Zedxion, both added to the Specially Designated Nationals list maintained by the Treasury's Office of Foreign Assets Control, or OFAC.

Dollars come out the other end at U.S. correspondent banks — the dollar-account off-ramp where crypto flows convert back to cash.

These are the same rails cashing out the $7.2 billion that Americans reported losing to cryptocurrency investment fraud in 2025, which was the single largest U.S. fraud category of the year, according to the FBI Internet Crime Complaint Center's, or IC3, 2025 annual report.

Many of these schemes are so-called "pig butchering," in which scammers fatten up victims with fake crypto gains before cashing out. Customers aged 60 and older lost $2.76 billion in 2025, and those aged 50 to 59 lost $1.38 billion, per the IC3 data.

Both flows are growing. IRGC-linked addresses received more than $3 billion in 2025, up from $2 billion the year before, and accounted for more than half of value received by Iranian crypto services in the fourth quarter of 2025, according to Chainalysis's 2026 Crypto Crime Report.

The shared plumbing

On Jan. 30, the Trump administration designated U.K.-registered Zedcex, Zedxion and Iranian financier Babak Morteza Zanjani for sanctions. Treasury called it the first-ever designation of an IRGC-linked digital asset exchange.

Blockchain analytics firm TRM Labs discovered the network, attributing roughly $1 billion in IRGC-linked stablecoin flows to it.

Tether is the common cryptocurrency. Sen. Richard Blumenthal, D-Conn., has called it "a key money laundering tool for the Islamic Revolutionary Guards Corps, sanctioned Iranian banks, and Iranian weapons manufacturers."

On Feb. 24, Blumenthal opened a Senate subcommittee inquiry into Binance, alleging the crypto exchange moved roughly $1.7 billion to Iranian entities after its November 2023 federal plea. Binance has refuted the claims.

The same day, federal prosecutors in the Eastern District of North Carolina announced the seizure of $61 million in Tether from a pig-butchering scheme.

All of these share the same stablecoin, crypto exchange systems and correspondent-banking off-ramps as the Iranian flows.

The fraud funnel hitting American banks

Pig butchering follows a distinct choreography. Scammers build trust with victims, often under romantic pretense, direct them to fake trading platforms showing false gains, and extract escalating sums.

Scammers then swap these illicit proceeds to Tether and route the money through multiple wallets to obscure the origin. Tether offers the combination scammers want: stable value and the speed and anonymity of crypto.

An analysis by the University of Texas at Austin researchers found in March 2024 that 84% of transaction volume in pig butchering scams was in Tether.

Pig butchering operators are rarely (if ever) Iranian. The 2025 IC3 report attributes cryptocurrency investment fraud to Southeast Asia-based criminal enterprises that staff their compounds with human-trafficking victims forced to run the scams.

The Iran connection is, instead, infrastructure. Pig butchering and Iran's crypto payment rails share a stablecoin issuer, offshore exchange category and correspondent-banking rails.

The banker choke point

Asset seizure by federal law enforcement offers a late-stage remedy to illicit flows of value. But once a wire leaves a customer's account and lands at the scammer's exchange, recovery is vanishingly unlikely.

The earlier choke point is the bank.

For the originating bank, a wire from a longtime retail or wealth-management customer (particularly one aged 50 or older) to a cryptocurrency exchange, often for escalating amounts over a short window, serves as a meaningful detection opportunity.

The Financial Crimes Enforcement Network, or Fincen, Treasury's financial crimes bureau, made this point in a September 2023 alert about pig butchering, which flagged the rapid-escalation pattern as a priority suspicious-activity indicator.

Once the wire clears, the Tether conversion is instant. The money is on the same rail that carries the IRGC-connected money.

The same choke point applies at correspondent banks. Someone has to convert Tether flows to fiat at some off-ramp. U.S. correspondent banks are the off-ramp.

Fincen's May 2024 advisory on Iran-backed terrorist financing warned that non-Iranian institutions can unwittingly serve as intermediaries for illicit IRGC transactions. It's a warning that applies equally to pig-butchering flows cashing out through a compromised or sanctioned exchange.

A longer compliance tail

The statute of limitations for sanctions violations doubled from five years to 10 in 2024, according to Treasury guidance posted in July of that year. In March 2025, OFAC posted a matching rule obligating banks to 10 years of record retention for transaction records, screening documentation and compliance communications.

For banks, that's five more years of exposure on every correspondent payment, every wire to a crypto exchange and every screening decision.

Payment method does not alter sanctions liability, Chainalysis emphasized in its April 10 Hormuz toll analysis. Virtually every transaction involving the Iranian government, its agencies and its instruments is prohibited for U.S. persons, whether the payment settles in dollars, bitcoin, stablecoins or Chinese yuan.

For bankers filing suspicious activity reports, or SARs, on Iran-backed terrorist financing activity, the relevant document is the Fincen advisory issued May 8, 2024, catalogued as FIN-2024-A001, with the SAR key term IRANTF-2024-A001.

That advisory, together with Fincen's September 2023 pig-butchering alert, describes the patterns most directly relevant to U.S. retail banks, correspondent banks and private-wealth businesses:

• Customers claiming nonprofit-organization status who solicit cryptocurrency donations without apparent charitable activity.
• Small cryptocurrency payments from many wallets, aggregated in a single account and transferred together, with account logins from IP addresses in jurisdictions associated with terrorist activity.
• Vague purpose codes without commercial substance on wires to high-risk jurisdictions. Suspicious codes include "travel expenses," "charity," "aid" or "gifts."
• Customer accounts that receive large payouts from social media fundraisers and are then accessed from high-risk IP addresses.
• For pig butchering specifically: rapid escalation in wire amounts from long-tenure retail or wealth customers to cryptocurrency exchanges, particularly among customers aged 50 and older.

What's next

Two ongoing matters will shape what comes next for U.S. banks: the direction of OFAC enforcement and the trajectory of the Iran war itself.

OFAC's Jan. 30 action suggests the enforcement direction is moving in the direction of crackdown. TRM Labs called it an inflection point in that authorities are increasingly targeting ownership of the infrastructure that moves the money, not just individual transactions.

That means all correspondent banks with crypto-exposed relationships have greater sanctions enforcement exposure than they did 12 months ago.

But, these developments land in a political environment pulling the opposite direction.

Trump's January 2025 executive order declared crypto a national priority and established the President's Working Group on Digital Asset Markets, chaired by crypto czar David Sacks.

Federal law enforcement agencies including the SEC have dropped or frozen roughly 89 crypto enforcement cases in total since then, according to an August analysis by Jeffrey Kelly, a partner at law firm Nelson Mullins.

In March 2025, Trump signed another executive order establishing a strategic bitcoin reserve.

And, of course, the GENIUS Act passed into law in July 2025, creating a regulatory framework for stablecoins such as Tether.

Simultaneously, enforcement actions are sending the opposite message. OFAC designated IRGC-linked crypto exchanges. Treasury has doubled the statute of limitations. Federal law enforcement seized $61 million in Tether from a pig-butchering scheme.

Compliance officers must interpret both of the conflicting signals at the same time.