“The Iranian regime’s reliance on digital assets and shadow banking networks is further evidence that Economic Fury is working,” said Secretary of the Treasury Scott Bessent, underscoring the Treasury’s view that a newly sanctioned crypto conduit helped keep Tehran’s financial apparatus moving.
OFAC sanctions Shelbit, founder Siavash Kayvanpour, and Aban Tether
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions on Shelbit, an entity described by blockchain analysts as a crypto “exchange” in name only. OFAC’s action also targets Shelbit’s founder, Siavash Kayvanpour, a network of affiliated entities registered across the United Arab Emirates, Poland and Georgia, and a separate Iran-based exchange, Aban Tether.
TRM Labs: $6.3bn moved, settlement-conduit behavior on TRON
Blockchain analytics firm TRM Labs, in a public blog, traced roughly $6.3bn moving through wallets tied to Shelbit between May 2024 and March 2026. TRM reported that approximately 88% of that activity — about $5.6bn — moved on TRON and was “almost entirely in dollar-pegged stablecoins,” with an average transfer size of roughly $54,500.
TRM’s behavioral findings are blunt: Shelbit’s wallets “held virtually no balances.” As the firm put it, “Value entering the platform left almost immediately, with inbound and outbound amounts matching to within 0.1% – a pattern consistent with a settlement conduit rather than an exchange holding customer funds.” The wallets were rebuilt on a rotating cycle, “every one to four months across two years of operation,” a rotation TRM said was “consistent with deliberate efforts to limit traceability.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDocumented flows to the IRGC, Hamas, and sanctioned Russian services
The Treasury cited money flows from Shelbit-controlled wallets to addresses controlled by the Islamic Revolutionary Guard Corps (IRGC). TRM additionally reported that in September Shelbit sent over $2m in four transfers on a single day to a wallet under the control of Hamas.
Beyond Middle Eastern actors, TRM traced $318m to A7, a sanctioned Russian payment network, and found exposure to services named Grinex, Rapira, and other sanctioned Russian and Central Asian platforms. TRM concluded that Shelbit’s conduit served more than one sanctioned economy, linking dollar-pegged stablecoins, cross-border settlement, and sanctioned payment rails.
Farsi-language gambling network and named social-media figures
TRM tied Shelbit’s principal customers to a Farsi-language online gambling network of more than 2,000 websites. Two public-facing figures were identified as the network’s advertised faces: Sasha Sobhani and Pooyan Mokhtari. TRM reported Sobhani as “the son of a former senior Iranian diplomat and government minister,” posting from a villa in Madrid; Mokhtari was described as an influencer and singer. Both men, the report says, advertised conspicuous wealth and pinned betting-site links on profiles with audiences in the millions.
Sobhani and Mokhtari deny wrongdoing. According to TRM’s account, “Sobhani says he categorically rejects any involvement in money laundering, sanctions evasion, or terrorism financing, and that his role was limited to paid advertising.” “Mokhtari denies the allegations made against him in Dubai and says he has no affiliation with the IRGC.” TRM quantified the gambling exposure at approximately $72.6m across 55 platforms, with the single largest relationship accounting for roughly $46.4m. TRM added that Kayvanpour “has not responded to requests for comment.”
What this means for technologists, policymakers, and gambling customers
- Technologists and security teams should note the technical fingerprints TRM identified: near-instant settlement behavior, inbound/outbound parity within 0.1%, frequent wallet rotation every one to four months, and concentration on TRON stablecoins — patterns that, in TRM’s assessment, are consistent with a settlement conduit rather than a conventional exchange.
- Policymakers and regulators are receiving a concrete enforcement example: OFAC targeted an exchange-like conduit, its founder, and affiliated entities across multiple jurisdictions, while the Treasury framed the action as part of a broader campaign—“Economic Fury”—to increase economic pressure on Iran’s financial networks.
- Customers and operators of the identified gambling sites face a different exposure: TRM reported $72.6m of flows tied to more than 2,000 Farsi-language betting platforms, with one counterparty relationship alone worth about $46.4m — a commercial footprint that informs both compliance risk and potential enforcement focus.
The Treasury’s pairing of sanctions with TRM’s chain analysis ties technical blockchain signals to named actors and concrete dollar flows: a $6.3bn ledger of transactions, concentrated on TRON stablecoins, routed through wallets that exchanged value almost instantaneously and rotated infrastructure repeatedly. The action leaves an explicit policy line: whether denominated in “dollars, rials, or crypto,” the Treasury said it will “hunt down and dismantle the illicit financial networks that keep the regime afloat.”
Source: Infosecurity Magazine — US Sanctions Iranian $6bn Crypto “Exchange” Shelbit
