The U.S. Treasury sanctioned Iran-linked crypto platforms Shelbit and Aban Tether after blockchain analytics firm TRM Labs traced more than $6.3 billion through Shelbit's wallets over 23 months. The network moved funds almost entirely through Tron and USDT without holding customer balances, and TRM also found $318 million in transactions tied to Russia's sanctioned A7 payment network.
On Aug. 7, the U.S. Treasury Department sanctioned Shelbit and Aban Tether, two Iranian-linked crypto platforms accused of facilitating transactions tied to Iran's Islamic Revolutionary Guard Corps and other state-linked entities, along with Shelbit founder Siavash Kayvanpour and several companies tied to him in Georgia, Poland and the UAE.
Treasury said IRGC-linked wallets sent more than $1 million to Shelbit addresses, while more than $2 million flowed back the other way. Aban Tether, which does not appear to be affiliated with stablecoin issuer Tether, was separately accused of processing millions of dollars involving sanctioned Iranian exchanges Nobitex, Wallex, Bitpin and Ramzinex.
Shelbit moved billions without holding funds
TRM Labs traced more than $6.3 billion through Shelbit-linked wallets between May 2024 and March 2026. Monthly volume rose from single-digit millions in 2024 to more than $600 million for six consecutive months in the second half of 2025, yet the operation held almost none of that money.
Across every high-volume address TRM analyzed, incoming and outgoing amounts matched within 0.1%, and its busiest wallet received about $357.59 million while sending $357.58 million across more than 16,500 transactions. Shelbit replaced its high-volume wallets every one to four months, with successor addresses typically processing between $100 million and $350 million before going dormant. TRM found only about $370,000 of exposure to mixing services, relying on wallet rotation instead to obscure its trail.
Tron and USDT carried most of the flow
That settlement model depended on the Tron network. It ran mainly on Tether's dollar-linked USDT, which can settle value quickly without passing through the correspondent banking system used for conventional dollar transfers.
About $5.56 billion, or 88% of Shelbit's traced activity, moved over Tron, almost entirely through USDT-TRC20. Ethereum accounted for roughly $382 million, Bitcoin $235 million, and BNB Smart Chain $140 million.
Tron transactions averaged about $54,500, while Bitcoin transfers averaged roughly $249,000 across fewer than 1,000 transactions, sizes TRM said were more consistent with business settlement than retail trading. Neither Treasury nor TRM accused Tether of participating in Shelbit's operations.
Russian sanctioned networks ran through the same pipeline
TRM also traced about $318 million in transactions involving Shelbit and Russia's A7 payment network, its largest exposure to any single named sanctioned entity. The U.S. sanctioned A7 in August 2025, citing sanctions evasion and its support for Garantex, the Russian exchange previously targeted by Western authorities. A7 is partly owned by sanctioned lender Promsvyazbank and Moldovan businessman Ilan Shor.
Its Russian exposure went further: TRM identified roughly $16.3 million involving Grinex, the exchange that emerged after enforcement disrupted Garantex in March 2025, plus links to Rapira, TokenSpot and other Russian and Central Asian services. The transactions do not establish coordination between Iranian and Russian actors. Still, they show Shelbit's infrastructure served clients across separate sanctions-constrained networks at once.
Sources:
Trading involves risk.
Risk Disclaimer
