US sanctions exposed a $6.3 billion crypto pipeline linking Iran and Russia
On Aug. 7, US authorities sanctioned Shelbit and Aban Tether, two Iranian-linked crypto platforms accused of facilitating transactions tied to Iran’s Islamic Revolutionary Guard Corps and different state-linked entities.
The Treasury Department additionally sanctioned Shelbit founder Siavash Kayvanpour and a number of firms related to him in Georgia, Poland and the United Arab Emirates.
It mentioned IRGC-linked wallets despatched greater than $1 million to Shelbit addresses, whereas greater than $2 million flowed in the other way. Wallets managed by Kayvanpour additionally despatched greater than $2 million to Nobitex, Iran’s largest crypto exchange.
Aban Tether, which doesn’t seem like affiliated with stablecoin issuer Tether, was individually accused of processing tens of millions of {dollars} involving sanctioned Iranian exchanges together with Nobitex, Wallex, Bitpin and Ramzinex.
Shelbit operated extra like a settlement community than an alternate
While Shelbit offered itself as a crypto alternate, its blockchain exercise seemed markedly completely different from a typical buying and selling venue.
TRM Labs traced greater than $6.3 billion by means of Shelbit-linked wallets over 23 months between May 2024 and March 2026.
According to the blockchain analytical agency, exercise accelerated sharply throughout that interval, with month-to-month quantity rising from single-digit tens of millions in 2024 to greater than $600 million for six consecutive months within the second half of 2025. November alone accounted for about $735 million.
Yet little of that cash remained with Shelbit.
Crypto exchanges sometimes maintain buyer belongings between trades, leaving substantial balances of their wallets.
Across each high-volume Shelbit deal with analyzed by TRM, incoming and outgoing quantities matched inside 0.1%, with nearly no residual holdings. Its busiest pockets acquired about $357.59 million and despatched $357.58 million throughout greater than 16,500 transactions.
TRM mentioned the sample was per relaying funds quite than taking belongings into custody.
Shelbit additionally changed its high-volume wallets each one to 4 months, with successor addresses sometimes processing between $100 million and $350 million earlier than going dormant.
About 30% of the Tron addresses attributed to the operation by no means transacted in any respect, suggesting wallets had been provisioned prematurely and cycled into use.
Moreover, the operation made little use of instruments usually related to concealing crypto flows. TRM discovered solely about $370,000 of publicity to mixing companies throughout the $6.3 billion community, concluding that Shelbit relied as a substitute on middleman wallets and steady deal with rotation to make its transaction chains tougher to observe.
That settlement mannequin depended overwhelmingly on Tron and Tether’s dollar-linked USDT.
About $5.56 billion, or 88% of Shelbit’s traced exercise, moved over Tron, nearly solely by means of USDT-TRC20. Ethereum accounted for roughly $382 million, Bitcoin $235 million, and BNB Smart Chain $140 million, whereas different networks represented lower than 1% mixed.
Tron transactions averaged about $54,500, whereas Bitcoin transfers averaged roughly $249,000 throughout fewer than 1,000 transactions. TRM mentioned these quantities had been extra per enterprise settlement than retail crypto buying and selling.
USDT additionally provided dollar-denominated worth that would settle shortly with out passing by means of the correspondent banking system used for typical worldwide greenback funds.
Neither Treasury nor TRM accused Tether of collaborating in Shelbit’s operations. The platform’s dependence on USDT nonetheless highlights a limitation of utilizing stablecoins to maneuver {dollars} exterior conventional banking channels: the issuer can nonetheless block the tokens.
CryptoSlate beforehand reported that US authorities used Tether’s controls to freeze about $475 million in USDT linked to Iran in lower than three months, together with funds held in Tron wallets.
The actions confirmed how Washington can prolong sanctions enforcement onto public blockchains even when transactions by no means move by means of a financial institution.
Shelbit due to this fact mixed the pace and attain of stablecoin settlement with a always rotating pockets infrastructure, permitting billions of {dollars} to move by means of its community with out accumulating the balances usually related to a crypto alternate.
Shelbit connection runs into Russia
Meanwhile, blockchain data additionally present that Shelbit had developed into a cross-border settlement community serving actors throughout a number of sanctioned economies, together with Russia.
For context, TRM Labs traced about $318 million in transactions involving Shelbit and Russia’s A7 payment network, making it the platform’s largest publicity to any single named sanctioned entity.
A7 operates cross-border cost infrastructure designed to facilitate worldwide settlement for Russian customers going through restrictions on entry to Western monetary channels. The US sanctioned the corporate in August 2025, citing its position in sanctions evasion and its assist for Garantex, the Russian crypto exchange previously targeted by Western authorities.
The community is partly owned by sanctioned Russian lender Promsvyazbank and Moldovan businessman Ilan Shor. It additionally operates A7A5, a ruble-backed stablecoin used inside its cost system, and has expanded past Russia into markets together with Africa.
Shelbit’s Russian publicity prolonged past A7. TRM recognized roughly $16.3 million involving Grinex, the alternate that emerged after US-led enforcement disrupted Garantex in March 2025. OFAC later sanctioned Grinex, saying Garantex staff used the platform emigrate buyer balances and proceed working.
TRM additionally discovered hyperlinks to Rapira, TokenSpot and different Russian and Central Asian companies.
While the transactions don’t set up coordination between Iranian and Russian actors, they present that Shelbit’s infrastructure was getting used throughout separate sanctions-constrained monetary networks.
That distinction is essential. An operation carrying IRGC-linked funds and Iranian playing proceeds alongside Russian sanctions-evasion flows extra intently resembles a settlement service serving a number of purchasers than a conduit devoted to a single nation or group.
Western authorities are more and more concentrating on that broader infrastructure quite than particular person exchanges alone.
The European Union’s newest sanctions bundle launched a mechanism permitting it to ban transactions with crypto suppliers throughout a whole third nation when companies there are used to assist Russia circumvent sanctions. The measure may limit dealings between EU operators and suppliers positioned in jurisdictions that host such exercise.
The submit US sanctions exposed a $6.3 billion crypto pipeline linking Iran and Russia appeared first on CryptoSlate.
