In a document detailing the seizure order, the ministry’s National Bureau for Counter Terror Financing (NBCTF) said it was “convinced that the cryptocurrency wallets” in the list are property of the IRGC and are “used for the perpetration of a severe terror crime.”

The IRGC is sanctioned as a terrorist organization by the United States, the European Union, and Israel, among other countries. 

According to blockchain monitoring firm Elliptic, the named wallets have received $1.5 billion over time in Tether’s stablecoin USDT. Elliptic’s co-founder and chief scientist Tom Robinson said that the company cannot confirm whether those wallets do indeed belong to the IRGC. Robinson also said that the wallets currently only hold $1.5 million, a fraction of the funds that moved through them until today.  

Israel’s Ministry of Defense did not respond to TechCrunch’s request for comment, asking how it was able to establish that those 187 wallets are linked to the IRGC. 

In a blog post, Elliptic said that “some of the addresses may be controlled by cryptocurrency services and could be part of wallet infrastructure used to facilitate transactions for many customers.”

Amir Rashidi, the director of digital rights and security at the Iran-focused nonprofit Miaan Group, said it’s possible Israel found information about these wallets by hacking into Iran’s infrastructure. Rashidi added that “there were always rumors that the IRGC was using cryptocurrency to circumvent sanctions.”

“Many of these cases might, for example, involve exchanges that are not directly part of the IRGC but are connected to it, similar to many banks, financial and credit institutions, or even companies that appear to be private,” he said. 

This is not the first time Israel, or at least Israeli-aligned groups, has targeted Iran’s government cryptocurrency stash. 

On June 18, during the so-called Twelve-Day War between Israel and Iran, a hacking group, called Predatory Sparrow, believed to have links to Israel’s government hacked Iran’s largest crypto exchange Nobitex. The hackers stole around $90 million worth of crypto and then “burned” it by sending it to inaccessible wallets, effectively destroying the digital funds.

Crypto intelligence firms like Elliptic and TRM Labs previously said that Nobitex was used by the IRGC.