OFAC's Canadian MSB Designations: Six TRON Addresses and a 15-Second USDT Blacklist Burst

BlockintAI · 2026-11-07T14:56:44.773Z

Cover illustration: six listed addresses and a blacklist cycle. The connectors are conceptual, not a map of verified transfers.

On November 6, 2026, as part of Operation Economic Outcast, the US Treasury's Office of Foreign Assets Control (OFAC) designated eight money services businesses based in Canada under Executive Order 13902. Treasury says the firms convert Iranian rials and other currencies into digital assets, that many of them facilitated transactions with sanctioned Iranian exchanges and IRGC-associated addresses, and that several worked with OFAC-sanctioned narcotrafficker Ryan Wedding.

Four of the eight SDN entries carry cryptocurrency identifiers: six unique Digital Currency Address - TRX strings. That same evening, the USDT TRC20 contract recorded AddedBlackList events for all six across 15 seconds and six consecutive blocks. One of those addresses — Farah Exchange's TW5NEaaoPHXC1rt5PaYgG474gQ49oiZ2F5 — had already been frozen on March 25, 2026, unfrozen on May 14, then used again before the November re-freeze.

Retrieved TronGrid records show 942,756 USDT of direct transfers from two addresses OFAC lists for Amin Exchange to the address it lists for Million Exchange. The address listed for Farah records approximately 55.103 million USDT incoming and 55.103 million outgoing between March 2022 and May 2026. These are gross Transfer amounts, not losses or independently attributed illicit proceeds; Million's own history remains partial.

Times use America/Chicago: CDT (UTC−5) during daylight saving and CST (UTC−6) otherwise, with UTC shown where it matters. Entity/address associations below are OFAC's designation identifiers, not independent findings of who controlled keys throughout the historical transfer period.

Key facts

Who was designated, and why

Treasury's press release frames the action as part of Operation Economic Outcast, launched to cut financial channels that sustain the Iranian regime and the IRGC, including the use of cryptocurrency. It was coordinated with FinCEN and FINTRAC, and with the DEA for the drug-trafficking strand.

The eight designated entities, and what Treasury says about each:

• Diverse Trade Inc, doing business as Million Exchange / Millionex (millionex[.]ca), is an Ontario MSB. Treasury says digital-asset addresses associated with it have sent hundreds of thousands of dollars to IRGC- or other terrorism-related addresses, and that Wedding laundered drug proceeds through it by buying digital assets with drug-related cash.
• 1380079 BC Ltd, doing business as Amin Exchange Vancouver (aminexchange[.]ca), and affiliate Top PC Technician Inc (Amin Exchange Toronto). Treasury says Amin addresses have received hundreds of thousands of dollars from Shelbit, and that Amin has laundered millions in drug proceeds in Toronto, Vancouver and Montreal, including cash-to-crypto for Wedding.
• NIA Nations Currency Ltd (nnce[.]ca), a British Columbia MSB. Treasury says its addresses have transacted with IRGC-associated addresses and with sanctioned Iranian exchanges Nobitex, Wallex, Ramzinex and Bitpin.
• 2397639 Ontario Ltd, doing business as Farah Exchange. Treasury says a digital-asset address associated with it conducted hundreds of thousands of dollars of transactions with Shelbit and Wallex, sent thousands to terrorism-related addresses, and sent millions to Wedding-related addresses.
• CCC Inc and B Galaxy Inc (Cryptoyal / C Exchange; cryptoyal[.]net, sarafic[.]com). Treasury says a CCC address received hundreds of thousands from terrorism-related addresses; B Galaxy advertises unlimited digital assets for Iranian currencies.
• Darvish Exchange (darvishexchange[.]com), an Ontario MSB advertising Bitcoin-for-rial exchange. Treasury says an associated address has transacted with Nobitex, Wallex, Aban Tether and Shelbit.

Those IRGC, Shelbit, Wedding and Iranian-exchange attributions are Treasury's. The transfer analysis below does not assign those labels to counterparties. It counts gross USDT Transfer amounts of at least 10 USDT from retrieved TronGrid records, rather than Treasury's figures, losses or Iranian regime revenue.

Frozen the same evening

The USDT TRC20 contract recorded the following AddedBlackList events for all six OFAC-listed TRON addresses on November 6, 2026, in six consecutive blocks:

Blocks 87780519–87780524. Read-only calls around 7:21 AM CT on November 7 returned isBlackListed=true for all six and balanceOf values totaling 69.8953 USDT: 0.3953 USDT on the Amin TLyRL… address, 69.5 USDT on the CCC TCre… address, and zero on the other four. This is the later USDT balance snapshot, not a measurement of balances at the freeze blocks or of other assets. The flag restricts ordinary transfers on this USDT contract while set; it does not freeze all TRON assets.

Farah's address: frozen, unfrozen, then frozen again

The address OFAC lists for Farah Exchange, TW5NEaaoPHXC1rt5PaYgG474gQ49oiZ2F5, has a documented earlier blacklist cycle. These three verified event checks establish the sequence below, rather than an exhaustive list of all administrative events:

The March 25 freeze is also recorded in BlockintAI's issuer-freeze report 47bee2d0. The successful outgoing transfer linked above occurred after the May 14 removal; the latest outgoing transfer of at least 10 USDT in the retrieved records is dated May 27. The event logs identify flag changes, not the reason for them or an independent finding of criminal conduct. On November 6 it was blacklisted again with the other five SDN addresses.

Paging this address's available TronGrid USDT records to endpoint termination returned 4,476 raw records. Within them, transfers of at least 10 USDT total 55,103,074.09 USDT incoming and 55,103,325.55 USDT outgoing, from March 21, 2022 to May 27, 2026. This describes retrieved indexed records and gross flows, not a reconciled loss or the firm's total business volume.

Gross USDT flows on the six listed addresses

The table counts Transfer records of at least 10 USDT on Tether's official TRON contract, TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, using six decimals. Five addresses were paged to TronGrid endpoint termination in a November 7 snapshot; Million is explicitly partial. The threshold is in USDT units, not a historical USD valuation. Figures are gross: a transfer between listed addresses appears at both endpoints, and a self-transfer appears in both directions for that address.

Million Exchange paging scope. The Million row is limited to the first 3,000 retrieved records. Continuation was available and a further page could be retrieved, so 3,000 is this analysis's cutoff, not a demonstrated TronGrid hard cap. The displayed dates describe this partial window, not the address's first-ever activity; lifetime inflow/outflow totals are withheld. Amin→Million totals come from the Amin addresses' paged-to-termination records. The reverse transfer is independently present in the recipient Amin address's paged-to-termination history, so it does not depend on completing Million's history.

Transfers between addresses listed for Amin and Million

Among the six listed addresses, the direct transfers of at least 10 USDT in the retrieved records are are:

• Amin TLyRLCNwBhaXkYak1bTFUYTj72crbgN5Vy → Million TJHZswisiMgjioAVpmpMSWXCeQGCPjcTMK: 835,460 USDT
• Amin THauYJJEaFGLpEknoKnYmXmT5TCeQGKjDE → Million: 107,296 USDT
• Million → Amin THau…: 36,470 USDT, confirmed in the recipient Amin address's records (d90b5ca8…)

Amin→Million combined is 942,756 USDT, from nine transfers by TLyRL… and one by THau…. A 6,498 USDT self-transfer on THau… is excluded from these inter-address figures but remains included in both directions of that address's gross table totals. No qualifying inter-listed transfer involving the Farah or CCC address appears in their paged-to-termination records; Million's own history remains incomplete.

Treasury describes Amin and Million as separate MSBs that both handled Wedding-related cash-to-crypto. The records show transfers between the addresses OFAC lists for the firms; they do not establish the economic purpose of each transfer or a common operator.

What this means

• The six-event burst spans 15 seconds. The USDT blacklist events occurred on the designation's calendar evening. This measures the event burst, not the response interval after Treasury published its announcement. The 69.8953 USDT balance was checked the following morning, not at the freeze blocks.
• Blacklist state can change. The address listed for Farah has a March add, May removal, a later May outgoing transfer, and November re-add. These logs show the changing USDT flag; they do not supply the issuer's reasons or establish who controlled the address at each point.
• There are direct inter-listed transfers. Retrieved records total 942,756 USDT from the Amin-listed addresses to the Million-listed address. This is gross transfer volume, not a finding that the entire amount was criminal proceeds or Treasury's attributed flow to terrorism-related addresses.
• Four of the eight entities have no TRX address on the SDN list. B Galaxy, Darvish, NIA Nations and Top PC Technician were designated without a Digital Currency Address - TRX identifier in the entries we checked. Absence of a listed address is not absence of crypto activity.

Addresses

Listed by OFAC on November 6, 2026 as Digital Currency Address - TRX:

• 1380079 BC Ltd (Amin Exchange): TLyRLCNwBhaXkYak1bTFUYTj72crbgN5Vy, THauYJJEaFGLpEknoKnYmXmT5TCeQGKjDE, TJT3JZKJWVHVkKRKSmWmg5UYHhAqBM7mfP
• 2397639 Ontario Ltd (Farah Exchange): TW5NEaaoPHXC1rt5PaYgG474gQ49oiZ2F5
• CCC Inc: TCreRMzGspdHNEkqkasejS6xTzqXNkYJJZ
• Diverse Trade Inc (Million Exchange): TJHZswisiMgjioAVpmpMSWXCeQGCPjcTMK

SDN Website identifiers, with exact entity mappings (defanged):

• 1380079 BC LTD: aminexchange[.]ca
• CCC INC: sarafic[.]com, cryptoyal[.]net
• B GALAXY INC: cryptoyal[.]net
• DARVISH EXCHANGE: darvishexchange[.]com
• DIVERSE TRADE INC: millionex[.]ca
• NIA NATIONS CURRENCY LTD: nnce[.]ca

Related reports

• OFAC Operation Economic Outcast (6 Nov 2026): six TRON addresses on eight Canada-based Iran-linked MSBs
• Tether Frozen USDT-TRC20 Address (2026-03-25) — Farah TW5NEaao…

Sources

• US Treasury press release, "Operation Economic Outcast Sanctions Eight Canadian Money Services Businesses Enabling Iranian Regime", Nov 6, 2026: https://home.treasury.gov/news/press-releases/sb0686
• OFAC recent actions, Nov 6, 2026 (SDN entries, Digital Currency Address - TRX identifiers, websites): https://ofac.treasury.gov/recent-actions/20261106
• Current official SDN XML (entity/address/website mappings): https://www.treasury.gov/ofac/downloads/sdn.xml
• Tether supported protocols (official TRON USDT contract): https://tether.to/en/supported-protocols/
• Tronscan, freeze transactions linked in the table above
• Tronscan address pages: TLyRL…, THau…, TJT3…, TW5NE…, TCre…, TJHZ…
• Tether USDT TRC20 AddedBlackList / RemovedBlackList events and isBlackListed checks via TronGrid (Nov 6–7, 2026)
• BlockintAI C3 reports linked above

Believe you lost money through fraud or sanctions evasion involving a money services business? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file.