How did the United States seize $1 billion in crypto assets from Iran?

I saw a short video today with eye-catching subtitles: The US Treasury Secretary said the US seized $1 billion in crypto assets from Iran, and some people don't even know their wallets have been taken.

This statement easily raises an intuitive question: Aren't cryptocurrencies decentralized? Aren't wallets only accessible to the private key holder? How could US law enforcement agencies possibly transfer other people's coins?

Let's get to the conclusion first.

The US didn't rewrite the blockchain ledger, nor did it crack all wallets out of thin air.

It targets several entry points connecting crypto assets to the real world: exchanges and custody platforms, stablecoin issuers, private keys, and device control. On-chain assets are difficult to directly "confiscate," but as long as assets pass through these entry points, they may be frozen, seized, or even transferred to wallets controlled by law enforcement agencies.

What Did the News Actually Say?

In public reports, U.S. Treasury Secretary Scott Bessent stated around May 29, 2026, that the U.S. had seized approximately $1 billion in crypto assets related to Iran, placing this action within the context of economic pressure operations against Iran under the "Economic Fury" policy. The phrase "grabbed the wallets" in the short video likely comes from this public speech.

However, it's important to note the discrepancies in the wording here.

But it's important to note the differences in wording.

A more stable and verifiable statement from the recent official announcement by the U.S. Treasury Department is that the actions have resulted in the freezing of nearly $500 million in crypto assets related to the Iranian regime. Tether also publicly confirmed on April 23, 2026, that it had cooperated with the U.S. government to freeze over $344 million in USDT at two addresses. USDT is a dollar-denominated stablecoin issued by Tether and is one of the most liquid stablecoins globally. Tether stated that the actions were coordinated with the Office of Foreign Assets Control (OFAC) and U.S. law enforcement agencies. OFAC is the U.S. Treasury Department's sanctions enforcement arm, and many cross-border financial institutions use its list as a high-pressure compliance requirement. Therefore, this news cannot be simply interpreted as "the U.S. hacked into Iranian wallets." A more accurate understanding is that the U.S., through sanctions lists, on-chain tracking, cooperation from stablecoin issuers, control by exchanges or custodians, and judicial forfeiture procedures, has rendered a number of wallet addresses, accounts, or assets related to Iran unusable. Regarding the $1 billion figure, publicly available materials do not yet provide the complete address, currency, and execution path. It can only be considered a cumulative figure publicly announced by US officials, rather than a fully transparent on-chain fact.

There's more than one type of crypto wallet

Many people, upon hearing "wallet taken," imagine a cold wallet containing Bitcoin, with the mnemonic phrase written on paper, known only to the holder. Such self-custodied wallets do indeed represent the core security narrative of crypto assets: whoever controls the private key has the right to transfer funds.

However, real-world "wallets" are far more complex. The BTC, ETH, and USDT balances that ordinary users see in transactions are often not from wallets where they independently control the private keys, but rather from the platform recording transactions in their accounts. The true controllers of the private keys may be exchanges, custodians, market makers, payment platforms, or fund service providers.

If law enforcement agencies obtain court orders, grounds for sanctions, or if the platform actively cooperates, they can require the platform to freeze accounts, restrict withdrawals, and transfer assets. This is similar to how a bank account and the cash in your wallet are not the same thing. The money in a bank account appears to be your balance, but the banking system, regulatory orders, and judicial procedures can all affect its use. Crypto assets in centralized exchange accounts also have a similar layer of real-world control. In short videos, saying "your wallet was stolen" is more accurately described as the account being frozen, or the custodian transferring assets to a wallet designated by law enforcement. The US Department of Justice has already explained similar logic in its materials on cryptocurrency enforcement: if assets are controlled by a third-party exchange or online wallet service provider, law enforcement agencies can issue seizure warrants to these third-party custodians; if assets are in the suspect's own devices, hardware wallets, or paper wallets, the focus of enforcement becomes finding private keys, mnemonic phrases, passwords, and usable devices. Once law enforcement obtains a valid private key, they must be prepared to quickly transfer assets to wallets controlled by law enforcement, as the original holder or associated individuals may preemptively transfer the funds. In simpler terms, this means: there are no backdoors for law enforcement in on-chain transfers; whoever can sign can access the coins. For law enforcement to access truly self-custodied wallets, they must first obtain the private key or control the device. If they do, the wallet, like any ordinary holder, can initiate on-chain transfers; if they don't, they can only freeze related addresses, monitor inflows and outflows, and wait for the assets to enter the control of exchanges or stablecoin issuers. Stablecoins are not decentralized assets. In this incident, the most important point for ordinary readers to understand is about stablecoins. Many people treat USDT as on-chain US dollar cash, and it does indeed seem very similar: fast transfers, clear arrival, and strong cross-platform liquidity. However, centralized stablecoins like USDT and USDC are not essentially "cash without an issuer." USDC, a USD stablecoin issued by Circle, like USDT, has a clearly defined issuer, reserve asset arrangements, and compliance controls. The $344 million freeze publicly confirmed by Tether is a prime example. Tron or Ethereum won't be completely suspended by a single statement from the US government, but stablecoin issuers can restrict certain addresses from transferring funds out through contracts and backend rules. The assets still appear in on-chain addresses, but these tokens can no longer circulate freely like normal USDT. This is a risk many crypto users easily overlook: you hold on-chain tokens, but these tokens have issuers behind them; you're using a public blockchain, but the availability of stablecoins is affected by issuer rules, sanctions lists, legal requests, and anti-money laundering requirements. For ordinary, legitimate users, this mechanism may not affect daily use; however, for those subject to sanctions, illicit funds, fraudulent funds, terrorist financing, and money laundering networks, the "freezeability" of stablecoins has become a crucial tool for law enforcement. From this perspective, stablecoins are becoming a fascinating form of financial infrastructure: they leverage the transparency and composability of public blockchains while retaining the compliance control points familiar to the traditional financial world. On-chain analytics companies can track fund flows, regulatory agencies can flag high-risk addresses, issuers can cooperate in freezing funds, and exchanges can refuse deposits or restrict withdrawals. Many previously believed that crypto assets inherently circumvented financial regulation; now it seems that the larger they become in mainstream finance, the more they are reintegrated into the real-world compliance network. Self-custody also has its limits. Does this mean that as long as you don't use exchanges or USDT, and only hold native BTC or ETH, it's absolutely safe? Technically, self-custody does significantly return control to the holder. As long as the private key isn't leaked, law enforcement agencies find it difficult to directly control native Bitcoin like they would a bank account. No company on the Bitcoin network can freeze an address simply by answering a phone call, and Ethereum's native ETH doesn't have a unified blacklist. This is the most powerful aspect of crypto assets. However, this doesn't mean it's detached from the real world. Private keys may be stored on phones, computers, hardware wallets, paper, cloud storage, or password managers; wallets may be in exchanges, custodians, or multi-party computation (MPC) services; funds may ultimately be exchanged for fiat currency, used for payments, asset purchases, or trade settlements. MPC is a technical solution that distributes private key control among multiple participants, improving the security of institutional wallets, but it also introduces issues related to service providers, approval processes, and permission design. National-level law enforcement excels not at directly confronting the blockchain, but rather at manipulating people, devices, platforms, and fund exit points. It can search devices, demand platform cooperation, freeze stablecoins, sanction addresses, and force exchanges to refuse certain funds. It can also wait until target funds enter a regulated financial system before taking action. On-chain transparency amplifies this capability, as every large transfer, split, aggregation, cross-chain transaction, and deposit can become investigative leads. Therefore, self-custody enhances the ability to prevent others from easily signing on your behalf, not to make assets disappear from the legal world. Private key management, source of funds, counterparties, deposit and withdrawal paths, and whether sanctions and anti-money laundering rules are violated still determine whether the asset can be safely used in the real world. In summary, for ordinary users, don't automatically equate "my crypto assets are on-chain" with "no one can control them." If assets are held on an exchange, what you really need to consider is the platform's jurisdiction, compliance policies, account verification information, and ability to explain the source of funds. If the asset is a stablecoin, it's crucial to understand the issuer's freezing mechanism. If the asset originates from high-risk addresses, mixing services, illicit funds, or sanctioned entities, it's highly likely to be blocked by on-chain transaction monitoring—the KYT system—when it enters exchanges or payment scenarios, continuously identifying the source of funds and transaction risks. The core value of crypto assets does indeed stem from personal control, global liquidity, and public verifiability. However, these three factors don't mean it lacks real-world constraints. On the contrary, as the scale of funds increases, counterparties become more complex, stablecoins become mainstream, and exchanges become the entry point, the connection between on-chain assets and traditional law enforcement will become increasingly close. Therefore, the crypto world hasn't been "crashed" by the US, but it's also not as vacuum and free as many people imagine.