Mabna Institute moved $16.8M via crypto since 2018, TRM Labs finds

The first federal indictment came in March 2018, charging nine defendants. An August 2026 superseding indictment added eight more names, bringing the total to 17 individuals facing charges related to cyber intrusions on behalf of Iranian state interests, the Department of Justice said.

On August 24, the U.S. Treasury Department designated five individuals connected to Mabna under what it called Operation Economic Outcast, invoking Executive Order 13902. That order identifies digital assets as a sanctionable sector, meaning entities that engage in significant Iran-related crypto activity now face secondary sanctions risk.

For crypto businesses, any address that interacted with the 30 flagged wallets, even indirectly through multiple hops, now carries elevated risk in transaction monitoring systems. The $16.8 million flowing through the network leaves a wide contamination radius for blockchain analytics exposure scoring. The Treasury’s invocation of Executive Order 13902 means exchanges that processed transactions for the flagged addresses could face secondary sanctions risk, particularly those that handled flows from Fayaz’s cluster.

The TRON component of the address cluster fits a pattern that U.S. authorities have flagged in multiple enforcement actions. TRON-based stablecoins, particularly USDT, have become a preferred rail for moving value across jurisdictions with limited banking access.

With 17 defendants indicted, five sanctioned, and a forensic trail stretching six years across three blockchains, the Mabna case provides one of the more detailed public examples of how state-linked actors use crypto infrastructure and how regulators intend to respond.