Shelbit Sanctioned for $6.3B Crypto Laundering

Twelve findings from the designation

• OFAC sanctioned Shelbit, Siavash Kayvanpour, and associated corporate vehicles in the UAE, Poland and Georgia on August 7, 2026, alongside a separate designation of Iran-based Aban Tether, for IRGC exposure and laundering gambling proceeds.
• Between May 2024 and March 2026, TRM traced more than USD 6.3 billion moving through Shelbit's blockchain infrastructure — a Dubai-registered, unlicensed cryptocurrency operation with sham compliance controls.
• Residual wallet balances were effectively zero: deposits exited immediately, with inflows and outflows balanced to 0.1%, indicating a relay conduit rather than an intermediary holding client funds.
• TRON carried roughly 88% of total volume — around USD 5.56 billion — almost exclusively in USDT-TRC20 stablecoins, averaging USD 54,500 per transfer.
• High-volume wallet addresses were retired and replaced every one to four months over two years, a deliberate rotation strategy that fragments on-chain continuity.
• TRM documented USD 5.6 million in direct transfers across 36 transactions to IRGC-associated wallets between July 2024 and July 2025.
• Four same-day transfers in September 2025 delivered approximately USD 2 million to a wallet Israel's National Bureau for Counter Terror Financing later designated as Hamas infrastructure; those four transfers represented 74% of the wallet's lifetime inflows.
• Exposure to sanctioned Russian infrastructure totals approximately USD 318 million involving A7, plus further flows to Grinex, Rapira and other designated Russian and Central Asian services.
• TRM identified approximately USD 72.6 million distributed across 55 online gambling platforms, consistent with large-scale settlement for wagering operations.
• Peak monthly throughput reached approximately USD 735 million in November 2025; volumes remained above USD 600 million for six consecutive months after doubling in July 2025.
• The platform no longer operates and its website is offline, but no evidence suggests the underlying sanctions-evasion and terrorism-financing activity has ceased.
• VARA issued a cease-and-desist order on July 24, 2026, citing money-laundering and terrorism-financing violations and warning of cross-border transactions threatening UAE financial-system integrity.

{{horizontal-line}}

Treasury's designation and scope

OFAC's August 7, 2026 action targeted Shelbit, a Georgia-based entity operating the Shelbit Exchange, alongside founder Siavash Kayvanpour and corporate affiliates UAE-based Shelbit General Trading LLC, Shelbit Technologies Ltd, Crypto Home DMCC and NFT Home DMCC. A separate designation under Executive Order 13902 sanctioned Aban Tether, an Iran-based exchange with prior links to other sanctioned Iranian platforms. Shelbit's designation cited Executive Order 13224, referencing digital-currency transfers to IRGC-controlled addresses, flows from Kayvanpour-controlled wallets to the previously sanctioned exchange Nobitex, and the platform's role servicing a Persian-language gambling network.

TRM's independent forensic analysis, conducted separately from Treasury's investigation, reveals a far larger operational footprint: more than USD 6.3 billion in blockchain-verified flows between May 2024 and March 2026. That figure dwarfs the specific transfers cited in the designation and points to an infrastructure functioning not as a licensed exchange but as a settlement backbone for Iran's illicit economy.

A Deira office and USD 6.3 billion in traced volume

Velorix Watches Trading LLC occupies three rooms on the fourth floor of a building in Deira, accessed through a budget hotel lobby. Behind a locked door fitted with a buzzer and camera are a desk, a cash-counting machine and a small display of watches not offered for sale. Dubai corporate records show Velorix shares its registered address — and its listed owner — with Shelbit, the cryptocurrency platform through which TRM has now traced more than USD 6.3 billion.

Operational model and corporate identity

Shelbit presented itself as a Dubai-registered cryptocurrency exchange, maintaining a public website at shelbit.com and accepting transactions without holding a virtual-asset license. Marketing was negligible, customer service poor, and KYC procedures amounted to theatre. The platform had the appearance of an exchange but lacked the operational substance, and its blockchain behavior diverged entirely from that of a custody intermediary. Corporate filings identify Siavash Kayvanpour, an expatriate Iranian, as founder.

The Farsi gambling network

Among Shelbit's principal counterparties was a Farsi-language online gambling network spanning more than 2,000 websites — by TRM's assessment, one of the largest illegal gambling operations identified globally and by far the largest traced to Iran. Two Iranian social-media figures publicly front the sites: Sasha Sobhani, son of a former senior Iranian diplomat and government minister, posting from a villa in Madrid; and Pooyan Mokhtari, an influencer and singer. Both advertise conspicuous wealth to audiences numbering in the millions, with betting-site links pinned to their profiles.

Gambling is illegal in the Islamic Republic, punishable by imprisonment and lashing; since 2023, the prohibition explicitly extends to online wagering. Despite this, the network obtained access to Iran's domestic payments infrastructure, which Iran's central bank closely supervises.

A 2023 Iranian court convicted Sobhani, Mokhtari and Kayvanpour in the same illegal-gambling case, sentencing the promoters in absentia to two years and the exchange operator to three months for assisting them. The court found the three to be partners.

Sobhani and Mokhtari deny wrongdoing. Sobhani categorically rejects involvement in money laundering, sanctions evasion or terrorism financing, stating his role was limited to paid advertising. Mokhtari denies allegations made against him in Dubai and states he has no affiliation with the IRGC. Both say they did not know Kayvanpour and were unfamiliar with Shelbit. Kayvanpour has not responded to requests for comment.

VARA enforcement and the broader Iranian exchange crackdown

Dubai's Virtual Assets Regulatory Authority ordered Shelbit to cease all unlicensed virtual-asset activities on July 24, 2026, citing money-laundering and terrorism-financing violations and warning that identified exposure extended beyond consumer-protection concerns to cross-border transactions threatening UAE financial-system integrity. The order followed a 2025 penalty for operating without a license.

The action came amid 18 months of sustained pressure on Iranian cryptocurrency infrastructure. OFAC designated UK-registered Zedcex and Zedxion in January 2026 as IRGC front companies. In June, OFAC sanctioned four Iranian domestic exchanges — Nobitex, Bit Pin, Wallex and Ramzinex — collectively accounting for roughly 78% of Iran's attributed 2025 cryptocurrency volume per TRM data. Iran's attributed volumes have held at approximately USD 10 billion annually regardless.

That enforcement wave did not reach the settlement layer beneath it. TRM has traced more than USD 6.3 billion in blockchain-verified flows through Shelbit infrastructure over 23 months.

Zero-balance wallets and relay behavior

Custody defines a cryptocurrency exchange: customers deposit assets and leave them on the platform between trades, so exchange wallets carry balances — often substantial ones — visible on-chain.

Shelbit's wallets exhibited the opposite pattern. Across every high-volume address TRM analyzed, inbound and outbound value balanced to within 0.1%, with residual holdings effectively zero. The single busiest wallet received approximately USD 357.59 million and sent approximately USD 357.58 million across more than 16,500 transactions, ending with no meaningful balance. The pattern repeats across all four blockchains the operation used.

At this scale, residual holdings of that magnitude are a rounding error. The behavior is inconsistent with intermediating trades and consistent with relaying payments: value accepted at one end and delivered at the other, with nothing held in custody.

TRON dominance and stablecoin settlement

Roughly 88% of traced volume — around USD 5.56 billion — moved on TRON. Ethereum accounted for approximately USD 382 million, Bitcoin for approximately USD 235 million, and BNB Smart Chain for approximately USD 140 million. Four other networks carried negligible amounts.

The asset moving across TRON is overwhelmingly USDT-TRC20, the TRON-native version of Tether. As a dollar-pegged stablecoin, it settles within seconds at negligible cost and functions as a dollar substitute bypassing the correspondent banking system, attractive to both lawful and illicit actors seeking efficient fund movement.

TRON transfers averaged approximately USD 54,500; Bitcoin transfers approximately USD 249,000 across fewer than 1,000 transfers — figures inconsistent with retail activity and more consistent with business-to-business settlement.

Continuous wallet rotation

Shelbit retired and replaced high-volume addresses on a rolling cadence of roughly one to four months throughout its operational life, with successor wallets each carrying between approximately USD 100 million and USD 350 million before falling dormant. Of the TRON addresses TRM attributed to the operation, only around seven in ten ever transacted, consistent with wallets provisioned in advance and cycled through in sequence. Rotation of this kind fragments the continuity that makes a money-movement operation straightforward to follow.

Peak monthly throughput of USD 735 million

Volumes grew steadily through 2024 and the first half of 2025, from single-digit millions to approximately USD 230 million per month. In July 2025, monthly volume more than doubled and then held between approximately USD 604 million and USD 735 million every month through December 2025 — a step change in scale rather than incremental growth.

February 2026 saw a marked single-month decline to approximately USD 114 million, coinciding with the outbreak of hostilities between Iran, the United States and Israel. Reuters reported that during the same period, a drone struck less than a kilometer from Shelbit's registered Dubai office. Activity recovered to approximately USD 340 million the following month.

IRGC exposure and sanctioned Iranian platforms

TRM identified approximately USD 5.6 million across 36 transfers between Shelbit and wallets associated with the IRGC, spanning July 2024 to July 2025. The IRGC is the branch of the Iranian state overseeing commercial enterprises worth billions of dollars and is a US-designated foreign terrorist organization.

Thirty-six transfers distributed across a full year is more consistent with a sustained relationship than with isolated activity passing a compliance check. Blockchain analysis establishes that funds moved between these addresses; it does not establish the knowledge or intent of any party to those transfers.

Direct exposure to sanctioned Iranian cryptocurrency platforms includes approximately USD 2.6 million with Aban Tether, USD 1.9 million with Nobitex across 101 transfers, USD 156,000 with Ramzinex, and smaller amounts with Wallex, Bit Pin and Bit24. TRM traced a further approximately USD 2.2 million with Zedcex, the UK-registered entity OFAC designated in January 2026 as an IRGC front company.

Shelbit's direct exposure to Iran's domestic exchanges is modest relative to the operation's scale. When traced through intermediary wallets, however, exposure to those same platforms rises substantially — to approximately USD 10.7 million for Nobitex, USD 5.8 million for Wallex and USD 4.3 million for Ramzinex. This suggests Shelbit generally sat downstream of Iran's exchange layer, receiving value that had already moved through one or more intermediate hops, rather than transacting wallet-to-wallet with those platforms.

Four transfers totaling USD 2 million to a Hamas-designated wallet

On September 17, 2025, Shelbit sent approximately USD 2 million to a single wallet across four same-day transfers.

Israel's National Bureau for Counter Terror Financing subsequently designated that wallet as Hamas infrastructure. It had no transaction history prior to that date. Over its operational life it received approximately USD 2.69 million and sent an equivalent amount, meaning Shelbit's four transfers account for roughly 74% of everything the wallet ever received, delivered on the day it first became active.

Blockchain analysis establishes that funds moved between these addresses and that the recipient was subsequently designated. It does not establish the knowledge or intent of any party to those transfers.

USD 318 million exposure to A7 and Russian sanctions-evasion networks

Iran remains the operation's primary nexus: Shelbit is Iranian-run, its documented off-chain relationships are Iranian, and the gambling network it served is Iranian. Against that backdrop, the scale of exposure to Russian sanctions-evasion infrastructure is a notable secondary finding.

TRM traced approximately USD 318 million involving A7, a sanctioned Russian payment network — the largest traced exposure to any single named sanctioned entity in the dataset. A further approximately USD 16.3 million involves Grinex, the operational successor to the seized Russian exchange Garantex, alongside exposure to Rapira, TokenSpot and other sanctioned Russian and Central Asian services.

An operation moving Iranian gambling proceeds and IRGC-linked value alongside Russian sanctions-evasion flows through common infrastructure is more consistent with a settlement service serving multiple sanctioned economies than with a platform specializing in one.