On 7 August 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated two crypto exchanges, Shelbit Exchange and Aban Tether, together with their operator Siavash Kayvanpour and a network of four affiliated front companies spanning Georgia, Poland and the UAE. The allegation: helping Iran's Islamic Revolutionary Guard Corps (IRGC) move money through the crypto system.
It is the latest in a steady drumbeat of enforcement action, following the June 2026 designation of Iran's largest domestic exchanges, Nobitex, Wallex, Bitpin and Ramzinex. Treasury Secretary Scott Bessent was characteristically blunt about the direction of travel, saying the designation showed that "the Iranian regime's reliance on digital assets and shadow banking networks is further evidence that Economic Fury is working", and adding that "whether in dollars, rials, or crypto, Treasury will hunt down and dismantle the illicit financial networks that keep the regime afloat". The message is simple: regulators are treating crypto rails as just another financial system to police, not a lawless frontier beyond their reach.
So what actually happened? OFAC says wallets linked to the IRGC sent over USD 1 million in crypto to Shelbit, and Shelbit sent more than USD 2 million back. Kayvanpour is also alleged to have sent over USD 2 million of his own to Nobitex, an exchange the U.S. had already sanctioned. Shelbit was registered in Georgia but ran commercially out of Dubai as Shelbit General Trading LLC, and was designated for materially supporting the IRGC. It was also reportedly tied to a Persian-language online gambling network run by Iranian influencers, said to have laundered tens of millions of dollars through the platform, even though the network's operators were convicted of illegal gambling in Iran back in 2023. Aban Tether, a separate Iran-based exchange, was designated for processing transactions on behalf of several other Iranian exchanges that were already under sanctions.
To put the scale in perspective, Reuters reporting that preceded the designation estimated total throughput through the Shelbit network at more than USD 4 billion since May 2024, with around USD 676 million traced to counterparty exposure with Binance. Dubai's Virtual Assets Regulatory Authority had already issued a cease-and-desist against Shelbit's UAE trading entity back in July 2026, and Shelbit itself put out a statement in early August denying any knowing involvement in money laundering, terrorist financing or sanctions evasion, and saying it had ceased operations in January 2026. OFAC designated it anyway, which is itself a useful reminder that a business winding down does not make its exposure to sanctions disappear.
The more interesting question is what this case tells us about where enforcement leverage in crypto sanctions actually sits, and it is not always where people expect. The blockchain itself is deliberately resistant to seizure: once a Bitcoin address lands on the Specially Designated Nationals (SDN) list, it becomes unlawful for U.S. persons to transact with it, but the coins cannot be physically confiscated without control of the private keys. What made this case prosecutable was the custodial layer sitting on top of the chain, the exchanges, wallet operators and stablecoin issuers who hold real, identifiable, KYC'd customer relationships. Every meaningful transaction in the IRGC's network, from the original wallet transfers through to the eventual off-ramp via Nobitex, passed through a permissioned intermediary that could be traced, named and sanctioned. Tether's own ability to freeze USDT balances at the issuer level, used the month before in a related action against Iranian central bank wallets, is the same principle again: centralised custody creates a legal and practical enforcement handle that a peer-to-peer, on-chain transfer simply does not. For exchanges, wallet providers, custodians and their institutional counterparties, that is exactly the point at which risk crystallises, and exactly the point at which good early advice can make the difference between a managed regulatory conversation and a sanctions designation.
This matters just as much for anyone interested in how these cases actually get built as it does for compliance teams. Businesses and individuals facing this kind of scrutiny, whether they are exchanges, financial institutions, investors, or individuals with crypto holdings, benefit from getting under the transaction data quickly: understanding exactly what has moved where, when, and through which counterparties, before deciding on next steps, whether that is engaging with a regulator, responding to a subpoena, defending an enforcement action, or pursuing a recovery claim against a counterparty who has misappropriated funds. Attributing wallet clusters to a real-world operator, tracing fund flows between designated and undesignated addresses, and pinpointing the custodial choke points through which proceeds have passed are all things that need to happen early and well, because they shape whatever comes next. Where a Reuters report can already put a named exchange's counterparty exposure at USD 676 million before a regulator has even acted, businesses are frequently playing catch-up on facts that could, and should, have been established proactively.
The broader lesson for anyone operating in or around digital assets is that sanctions risk in crypto rarely sits at the level of the blockchain itself; it sits in every custodial and counterparty relationship built on top of it, and those relationships are identifiable. That is exactly where our Mishcon's CRCI team's blockchain analytics capability comes in. We can trace and visualise a client's direct and indirect cryptocurrency exposure to sanctioned entities and terrorist financing networks, clustering wallet addresses and matching them against watchlists such as the OFAC SDN list, in much the same way regulators and enforcement agencies do. Used proactively, this allows clients to see, before a regulator or law enforcement does, exactly what their digital asset profile actually looks like, and to take informed decisions accordingly. We use the same techniques in support of asset recovery, and in source of funds and clean funds analyses for clients carrying out due diligence and assurance on counterparties, investors or targets, so that comfort on crypto exposure is grounded in real transaction tracing rather than assumption.
If there is one thing this case makes clear, it is that crypto never made illicit finance harder to see, it simply moved the point at which it becomes visible. Every sanctions case built this way has depended on the same insight: money can move on-chain in seconds, but it still has to land somewhere identifiable to be spent, converted or cashed out. As regulators get faster at using that fact, so too must anyone with digital assets exposure, whether they are a business, an investor, or an individual. The businesses that get ahead of this, by understanding their own wallet exposure before a regulator, counterparty or court asks the question, will be the ones best placed to respond quickly and credibly when the next designation lands. Given the pace of enforcement this year, it is a question of when, not if.