US Treasury sanctions against Shelbit and Aban Tether
On August 7, 2026, the US Treasury's Office of Foreign Assets Control (OFAC) added to the sanctions list Shelbit — an entity registered in Georgia that operated the Shelbit exchange — its founder Siavash Keyvanpour, and a network of associated companies in the UAE, Poland, and Georgia. The sanctions decision names Keyvanpour, the UAE-registered company Shelbit General Trading LLC, Shelbit Technologies Ltd, Crypto Home DMCC, and NFT Home DMCC. The Iranian exchange Aban Tether, which has its own transaction history with previously sanctioned Iranian platforms, was sanctioned separately.
The US Treasury cited digital-asset transfers between Shelbit and IRGC-controlled addresses, transfers from addresses controlled by Keyvanpour to the US-sanctioned exchange Nobitex, and Shelbit's role in servicing a Persian-language online gambling network. The sanctions were imposed under Executive Order 13224. Aban Tether was sanctioned separately under Executive Order 13902 for activity in Iran's financial sector.
The watch shop that $6.3 billion flowed through
In Deira, one of Dubai's oldest trading districts, the company Velorix Watches Trading LLC occupies three rooms on the fourth floor of a building that can be entered through the lobby of a cheap hotel. Behind a locked door with an intercom and a camera are a desk, a cash-counting machine, and a small display case of watches that are not for sale.
According to Dubai corporate records, Velorix is registered at the same address and has the same owner as another company — Shelbit, through which more than $6.3 billion was traced over the study period.
What was Shelbit?
Shelbit operated as a cryptocurrency exchange registered in Dubai but without a license to conduct virtual-asset activities. It had a public website, shelbit.com, through which transactions were accepted, but marketing was practically nonexistent, customer service was weak, and Know Your Customer (KYC) checks were effectively a formality. Outwardly Shelbit looked like an exchange, but in essence it was barely one, and the blockchain data likewise does not show the behavior typical of an ordinary trading platform.
According to the same corporate records, its founder was Siavash Keyvanpour, an Iranian living outside Iran.
A Persian-language online gambling network: more than 2,000 sites
Among Shelbit's main clients was a Persian-language online gambling network comprising more than 2,000 sites. According to transaction analysis, it is one of the largest illegal gambling networks ever identified in the world, and by a wide margin the largest discovered in Iran.
The public faces representing these sites are two Iranian social-media celebrities: Sasha Sobhani, the son of a former high-ranking Iranian diplomat and government minister, who posts from a villa in Madrid, and Poyan Mokhtari, an influencer and singer. Both flaunt ostentatious luxury to their multimillion-strong audiences, with a link to the betting site pinned at the top of their profiles.
Gambling in the Islamic Republic is banned and punishable by imprisonment and flogging; since 2023 the ban explicitly extends to online betting as well. However, this did not stop the network from gaining access to Iran's domestic payment system, which is closely monitored by the country's central bank.
In 2023, an Iranian court found Sobhani, Mokhtari, and Keyvanpour guilty in a single case of illegal gambling. The organizers were sentenced in absentia to two years in prison, and the exchange operator received three months for assisting them. According to the court's findings, all three were partners.
Sobhani and Mokhtari deny wrongdoing. Sobhani says he categorically rejects any involvement in money laundering, sanctions evasion, or terrorist financing, and that his role was limited to paid advertising. Mokhtari denies the charges brought against him in Dubai and says he is not connected to the IRGC. Both claim they did not know Keyvanpour and were not familiar with Shelbit. Keyvanpour did not respond to requests for comment.
The VARA order and a wave of pressure on Iran's crypto infrastructure
On July 24, 2026, Dubai's Virtual Assets Regulatory Authority (VARA) ordered Shelbit to «immediately cease all unlicensed virtual-asset activity». The authority cited violations of anti-money-laundering and counter-terrorist-financing legislation and warned that the identified activity went beyond consumer protection and included «egregious cross-border transactions capable of affecting the integrity of the UAE's financial system». This was already the second enforcement action against the company, following a 2025 fine for operating without a license.
The order came after 18 months of steadily increasing pressure on Iran's cryptocurrency infrastructure. In January 2026, OFAC added the UK-registered Zedcex and Zedxion to the sanctions list as front companies for the Islamic Revolutionary Guard Corps. In June, OFAC listed four Iranian domestic cryptocurrency exchanges — Nobitex, Bit Pin, Wallex, and Ramzinex.
However, none of these measures affected the settlement layer that lay beneath the main infrastructure. Over 23 months, more than $6.3 billion in blockchain-confirmed flows was traced through Shelbit's infrastructure.
Shelbit did not operate as an exchange
Holding funds is one of the key functions of a cryptocurrency exchange. Clients transfer assets to the platform and leave them there between trades, so exchange wallets usually have noticeable balances that can be seen on the blockchain.
Shelbit's wallets behaved the opposite way. On each of the analyzed high-activity addresses, the volume of funds received and sent differed by less than 0.1%, and the balances were effectively zero.
For an operation of this scale, balances of this size can be considered a statistical margin of error.
Almost all activity went through TRON: 88% and $5.56 billion
Total volume of tracked funds by blockchain from May 2024 to March 2026.
| Blockchain | Detected volume | Share of total |
|---|---|---|
| TRON | ~$5.56 billion | ~88% |
| Ethereum | ~$382M | ~6% |
| Bitcoin | ~$235M | ~4% |
| BNB Smart Chain | ~$140M | ~2% |
| Four other networks | Negligible volume | <1% |
The assets moving through TRON were almost entirely USDT-TRC20.
This makes such an instrument attractive both to legitimate and to illicit actors who need to move funds quickly and cheaply.
The average transfer size on TRON was around $54,500. For Bitcoin, the average transfer size was approximately $249,000 across fewer than 1,000 transactions. Such figures are uncharacteristic of retail activity and correspond more to settlements between commercial entities.
The infrastructure was rebuilt every few months
Shelbit constantly changed its wallets. High-activity addresses were decommissioned and replaced with new ones roughly every one to four months throughout the entity's operation. Each new wallet managed to move between about $100M and $350M before becoming inactive.
Of the TRON addresses associated with Shelbit, transactions were conducted with only about seven out of ten. This is consistent with a model in which wallets are created in advance and then brought into service one after another. Such rotation limits the continuity of transaction chains, which would otherwise make it much easier to trace the movement of money.
Monthly volume reached $735M in November 2025
Monthly volume of tracked funds by blockchain from May 2024 to March 2026.
Throughout 2024 and the first half of 2025, volumes grew gradually — from a few million to around $230M per month. In July 2025, the monthly volume more than doubled, after which, from August to December 2025, it stayed each month in the range of roughly $604M to $735M. This was a sharp jump in scale rather than a gradual increase in activity.
A direct link to the IRGC: $5.6M across 36 transfers
About $5.6M in transactions across 36 transfers between Shelbit and IRGC-associated wallets was identified for the period from July 2024 to July 2025.
Thirty-six transfers spread over an entire year are more consistent with a stable relationship between the parties than with one-off transactional activity that might have happened to pass a compliance check. Blockchain analysis confirms that funds moved between these addresses, but on its own it does not establish whether the participants were aware of the nature of the operations or what their intentions were.
Shelbit was also found to have direct links to sanctioned Iranian cryptocurrency platforms: about $2.6M with Aban Tether, $1.9M with Nobitex across 101 transfers, $156,000 with Ramzinex, and smaller amounts with Wallex, Bit Pin, and Bit24. Another roughly $2.2M was traced to Zedcex — a UK-registered entity that OFAC identified in January 2026 as an IRGC front company.
At the same time, Shelbit's direct interaction with domestic Iranian exchanges looks small compared with the scale of the whole operation. When intermediate wallets are taken into account, the connection to the same platforms grows substantially: to roughly $10.7M for Nobitex, $5.8M for Wallex, and $4.3M for Ramzinex. This indicates that Shelbit was usually further down the chain relative to the Iranian exchange layer: it received funds that had already passed through one or more intermediate wallets rather than exchanging assets with the exchanges directly.
About $2M went to a wallet linked to Hamas
On September 17, 2025, Shelbit sent around $2M to a single wallet in four transfers over one day.
Israel's National Bureau for Counter Terror Financing subsequently identified this wallet as part of Hamas infrastructure. Before that date, it had no transaction history. Over its entire period of operation, the wallet received about $2.69M and sent a comparable amount.
Blockchain analysis confirms that funds moved between these addresses and that the recipient was subsequently identified as part of the relevant infrastructure. However, blockchain analysis on its own does not establish whether the participants were aware of the nature of the operations or what their intentions were.
A link to Russian sanctions-evasion infrastructure: $318M through A7
Iran remains the main center of this entity's activity. Shelbit was run by Iranians, its confirmed off-chain connections were tied to Iran, and the gambling network it serviced was also of Iranian origin. Against this backdrop, the scale of its interaction with Russian sanctions-evasion infrastructure looks especially noteworthy.
About $318M was traced to A7, a sanctioned Russian payment network. This is the largest volume of funds traced to any single named sanctioned entity in the data set under study.
Another roughly $16.3M is linked to Grinex — the operational successor to the seized Russian exchange Garantex. In addition, links were found to Rapira, TokenSpot, and other sanctioned Russian and Central Asian services.
An entity that moved Iranian gambling proceeds, IRGC-linked funds, and Russian sanctions-evasion flows through shared infrastructure looks more like a settlement service for several clients than a channel intended solely for one network. For countering such infrastructure, this has practical significance: taking down a single such intermediary can simultaneously affect several independent threat actors.
Links to 55 gambling platforms
In line with Reuters' data on the Persian-language online gambling network, about $72.6M in operations was traced between Shelbit and online gambling services. The funds were distributed across 55 separate platforms, with the largest of them accounting for about $46.4M.
Such broad coverage — dozens of platforms instead of one — is consistent with a model in which a settlement channel serves gambling as a separate line of business. The volume data shows where value moved, but on its own does not indicate that the platforms in question knew the origin of the funds that reached them.
Minimal use of mixers
About $370,000 of Shelbit funds linked to such mixers was traced. Against the backdrop of more than $6.3 billion in total volume, this amount is practically negligible.
Cryptocurrency money laundering is often associated with mixers, privacy coins, and chain-hopping — moving funds between different blockchains to complicate tracing. Shelbit used practically none of these methods.
Instead, the concealment of fund movement appears to have been built into the very structure of the infrastructure: numerous intermediate wallets and constant rotation of addresses.
For compliance specialists, this means that checking only direct counterparties would reveal just a small part of the activity. For most of the Iranian entities examined, the volume of funds that could be traced through intermediaries was two times — and in some cases hundreds of times — higher than the direct figures.
The state of Shelbit as of August 2026
Shelbit's website no longer works, and the structure itself appears inactive. VARA's July 24, 2026, cease-and-desist order remains in force as of publication.
However, there are no signs that the sanctions evasion and terrorist financing supported by this infrastructure have stopped. According to Reuters reports in July 2026, the network continued to operate.
The need for a settlement channel that Shelbit served — settlements for gambling, movement of Iranian funds, and sanctions evasion across several jurisdictions at once — exists independently of any specific infrastructure. The same applies to the practice, demonstrated by this entity, of rebuilding that infrastructure every few months.
What Shelbit's on-chain behavior means for compliance
It is precisely this behavior pattern that makes such an operation detectable, because the concealment was structural rather than technical. The near-total absence of mixers, combined with the use of intermediate wallets and constant changing of infrastructure, shows a laundering model that traditional checking of direct counterparties detects poorly.
Taken together, the structure of Shelbit's activity corresponds to infrastructure specially built for settlements within illicit financial activity, rather than an ordinary cryptocurrency exchange that simply failed to meet compliance requirements. Over 23 months, more than $6.3 billion passed through its wallets, while the wallets themselves held practically no funds; the main activity was concentrated on a single blockchain, the infrastructure changed every few months, and the counterparties included the IRGC, sanctioned Iranian exchanges, a wallet identified as Hamas infrastructure, and Russian payment infrastructure used for sanctions evasion.
