The US Treasury has sanctioned an Iranian crypto exchange accused of moving over $6 billion in illicit blockchain funds over two years.
Shelbit, a Dubai-registered platform that never held a license, has been hit with sanctions by the US Treasury Department’s Office of Foreign Assets Control (OFAC). The action also targets its founder, Siavash Kayvanpour, and a network of affiliated entities spread across the UAE, Poland, and Georgia. A separate Iran-based exchange, Aban Tether, was sanctioned too.
The move follows a detailed investigation by blockchain analytics firm TRM Labs, which published its findings on August 7. The firm’s report paints a stark picture: Shelbit was not a real exchange. It was a settlement conduit, a pipe for moving money.
According to TRM, between May 2024 and March 2026, Shelbit processed roughly $6.3 billion. Nearly all of it flowed to wallets controlled by the Islamic Revolutionary Guard Corps (IRGC). The scale is staggering. That’s more than $3 million per day, every day, for two years.
How Shelbit Worked: A Conduit, Not an Exchange
The analytics firm’s report shows that Shelbit’s wallets held virtually no balances at any given time. Money came in and went out almost immediately. Inbound and outbound amounts matched to within 0.1% — a pattern that screams settlement infrastructure, not a customer-facing exchange.
TRM Labs noted that this kind of precision matching is consistent with a platform designed to move value quickly, not to hold customer funds. It’s a technique used to obscure the trail.
The bulk of the activity — about 88%, or $5.6 billion — moved on the TRON blockchain, almost entirely in dollar-pegged stablecoins. The average transfer was around $54,500. That’s a lot of small, steady movements.
Wallet Rotation to Avoid Detection
Shelbit rebuilt its wallet infrastructure every one to four months across its two years of operation. TRM called this a deliberate effort to limit traceability. It’s a common tactic among illicit crypto services — constantly shifting addresses makes it harder for analytics firms and law enforcement to follow the money.
The platform also had direct connections to terrorism financing. In September, Shelbit apparently sent over $2 million in four transfers on a single day to a wallet controlled by Hamas.
Beyond the IRGC: Russian Sanctioned Networks and Gambling
The sanctions aren’t just about Iran. TRM traced $318 million from Shelbit to A7, a sanctioned Russian payment network. The exchange also had exposure to Grinex, Rapira, and other sanctioned Russian and Central Asian services. This was a multi-sanctioned-economy operation.
But the most intriguing finding is who Shelbit’s main customers were. TRM identified a Farsi-language online gambling network of more than 2,000 websites as the primary user base. That’s not a typo. Two thousand separate betting sites.
Two Iranian social media figures front these sites publicly. Sasha Sobhani, the son of a former senior Iranian diplomat and government minister, posts from a villa in Madrid. Pooyan Mokhtari, an influencer and singer, promotes the betting sites to his millions of followers. Both advertise conspicuous wealth, with links to betting sites pinned at the top of their profiles.
Both deny any wrongdoing. Sobhani says he categorically rejects involvement in money laundering, sanctions evasion, or terrorism financing, and that his role was limited to paid advertising. Mokhtari denies the allegations in Dubai and says he has no affiliation with the IRGC. Both say they never knew Kayvanpour and were unfamiliar with Shelbit. Kayvanpour has not responded to requests for comment.
What the Sanctions Mean
TRM traced around $72.6 million in exposure between Shelbit and online gambling services across 55 separate platforms. The largest single relationship accounted for approximately $46.4 million.
Treasury Secretary Scott Bessent issued a statement with the sanctions. He framed the action as part of a broader pressure campaign. “The Iranian regime’s reliance on digital assets and shadow banking networks is further evidence that Economic Fury is working,” he said. “We will continue to increase the economic pressure. Whether in dollars, rials, or crypto, Treasury will hunt down and dismantle the illicit financial networks that keep the regime afloat.”
This action is part of a larger pattern. Crypto sanctions have become a key tool in US financial warfare. A leaked database earlier this year shed light on how Iranian entities use crypto to evade sanctions. The Shelbit case shows the scale of the problem — and the sophistication of the networks involved.
For anyone tracking Iran crypto sanctions evasion, this is a major data point. It demonstrates that illicit crypto flows are not just a niche concern. They’re a systemic issue, involving gambling networks, terrorist financing, and sanctioned state actors across multiple jurisdictions.
The sanctions freeze any US-based assets of the designated entities and prohibit US persons from doing business with them. But the question remains: how many other Shelbits are out there, quietly moving billions through the shadows?
