What is Operation Economic Outcast
On August 24, 2026, the US Department of the Treasury launched Operation Economic Outcast, describing it as a whole-of-government economic campaign against the Islamic Republic of Iran and structures associated with it.
According to the Treasury, as part of this operation the US Office of Foreign Assets Control (OFAC) added nearly 60 organizations, individuals and vessels to its sanctions lists. They are linked to networks involved in procuring equipment for nuclear and missile programs, cyber operations, and generating revenue from oil activities. US Treasury Secretary Scott Bessent, in his statement, described the campaign as a large-scale economic offensive aimed at severing the financial ties that support the Iranian regime. In addition, OFAC issued five sectoral sanctions determinations regarding the Iranian economy, including the digital-assets sector.
The five people sanctioned on August 24 were also charged by the US Department of Justice on August 18, 2026 in connection with their activity at the Mabna Institute — an Iran-based company that, according to the US DOJ, carried out cyber intrusions on behalf of the Islamic Revolutionary Guard Corps (IRGC) and other Iranian state and university structures. Four of these five people control crypto addresses that the Treasury listed as part of the sanctions decision. Their blockchain activity is examined below.
Digital assets named a sanctions-significant sector
The US Treasury issued five sectoral sanctions determinations on the basis of Executive Order 13902. These determinations expand the categories of Iran-related activity that can become grounds for applying secondary sanctions, and allow OFAC to impose sanctions on any person or organization providing services in support of five sectors of the Iranian economy.
This list includes digital assets, technology, gold, aviation and shipping.
What this means for blockchain compliance teams
The new sanctions measures of August 24 followed recent investigations into Shelbit, Zedcex and Coinex — exchanges that had previously been viewed as financial infrastructure for Iran and structures associated with it.
The superseding indictment against the Mabna Institute
The five sanctioned people are connected to the Mabna Institute — an Iran-based company that, according to the US DOJ, has since at least 2013 conducted a coordinated campaign of cyber intrusions, effectively operating as a hacking-for-hire group.
A few days earlier, on August 18, 2026, the US DOJ unveiled a superseding indictment against 17 members of the Mabna Institute. They are charged with hacking-related crimes, and the document names all five people sanctioned on August 24.
According to the DOJ, the Mabna Institute gained access to the systems of 144 US universities, 178 foreign universities, at least 42 private companies in the US, at least 11 foreign private companies, no fewer than five US federal and regional government agencies, and at least two non-governmental organizations. During this campaign, the US agency alleges, more than 31 terabytes of academic data and intellectual property were stolen.
Nine of the 17 defendants previously appeared in a 2018 indictment. According to the DOJ, the new indictment adds another eight defendants and describes ongoing attacks on US and international organizations. In particular, it concerns the compromise of email accounts of employees of US federal and regional government agencies and international organizations.
The Mabna Institute's trail on the blockchain
In OFAC's sanctions decisions regarding the Mabna Institute, 30 crypto addresses on the Bitcoin, Ethereum and TRON networks belonging to four of the 17 defendants were listed. Analysis of all 30 addresses shows that a combined total of around $16.8M was received on them, and activity on them can be traced back at least to January 2018.
The volume of funds was extremely unevenly distributed among the participants. Keyvan Fayaz, who, according to the indictment, used the online aliases Achilles, The Joker and bc.monster, controlled ten addresses that together received $15.5M in the period from January 6, 2018 to August 20, 2026.
Thus, his addresses accounted for around 92% of the entire network's operation volume. Such concentration may indicate that he performed a kind of financial-hub or treasury function for the Mabna Institute's hacking-for-hire activity.
The addresses associated with Behzad Mesri, who is separately charged with hacking HBO, show a different characteristic pattern. Funds were repeatedly moved between his own addresses, after which hundreds of thousands of dollars were ultimately sent to a deposit address of a large centralized crypto exchange, probably for subsequent cash-out (fiat). Such a sequence of operations is often used to hide the original source of funds.
What this means for teams doing blockchain compliance
Despite the fact that the specific addresses connected to Mabna Institute members and included in the sanctions lists on August 24 now have relatively little money left on them, crypto compliance teams should still review the historical transaction records for interaction with these addresses.
In addition, compliance teams must be ready to check secondary-sanctions risks and flag incoming transactions from any wallets that have a connection to Mabna Institute addresses.
In a broader sense, the new sectoral sanctions on Iran's digital-assets sector make the task of identifying and blocking transactions linked to Iranian organizations even more important.
