Treasury sanctioned Shelbit and Aban Tether after TRM traced $6.3B through wallets tied to Iranian and Russian sanctions-evasion. EU-wide bans could be next.
Alpha Score of 43 reflects weak overall profile with moderate momentum, weak value, weak quality. Based on 3 of 4 signals — score is capped at 90 until remaining data ingests.
On Aug. 7, the US Treasury sanctioned Shelbit and Aban Tether, two Iranian-linked crypto platforms it accused of processing transactions for the Islamic Revolutionary Guard Corps and other state-linked entities. Treasury also sanctioned Shelbit founder Siavash Kayvanpour and companies connected to him in Georgia and Poland, plus a separate entity in the United Arab Emirates. IRGC-linked wallets sent more than $1 million to Shelbit addresses, and more than $2 million moved in the opposite direction, the department said. Wallets controlled by Kayvanpour also sent more than $2 million to Nobitex, Iran's largest crypto exchange.
Aban Tether, which Treasury said does not appear to be affiliated with stablecoin issuer Tether, was separately accused of processing millions of dollars involving sanctioned Iranian exchanges Nobitex, Wallex, Bitpin and Ramzinex.
Shelbit presented itself as a crypto exchange. Onchain, it did not look like one. TRM Labs traced $6.3 billion through Shelbit-linked wallets between May 2024 and March 2026. Monthly volume climbed from single-digit millions in 2024 to more than $600 million for six consecutive months in the second half of 2025. November alone came to about $735 million.
Little of that money stayed parked. Across every high-volume Shelbit address TRM analyzed, incoming and outgoing amounts matched within 0.1%, leaving virtually no residual balances. Its busiest wallet received $357.59 million and sent $357.58 million across more than 16,500 transactions. TRM said the pattern is consistent with relaying payments, not holding customer assets. Shelbit rotated its busiest wallets every one to four months. Successors typically processed $100 million to $350 million before going quiet. About 30% of the Tron addresses tied to the operation never transacted. TRM said that suggested wallets were provisioned in advance and cycled into use.
For all the volume, the operation made little use of mixers. TRM found about $370,000 of exposure to mixing services across the network and concluded that Shelbit relied on intermediary wallets and constant address rotation to obscure transaction chains.
The settlement stack was overwhelmingly Tron and USDT. About $5.56 billion, or 88% of traced activity, moved over Tron, almost all of it in USDT-TRC20. Ethereum accounted for roughly $382 million and BNB Smart Chain $140 million. Bitcoin accounted for about $235 million. Other networks combined for less than 1%. Tron transactions averaged around $54,500. Bitcoin transfers averaged about $249,000 across fewer than 1,000 transactions. TRM said those amounts were more consistent with business settlement than retail crypto trading.
USDT gave the network dollar-denominated value that settled without passing through the correspondent banking system used for conventional international dollar payments. Neither Treasury nor TRM accused Tether of participating in Shelbit's operations. The reliance on USDT still exposes a limit on stablecoin-based dollar flows: the issuer can freeze the tokens. US authorities used Tether's controls to freeze about $475 million in USDT linked to Iran in less than three months, CryptoSlate previously reported, including funds in Tron wallets. The actions showed how Washington can extend sanctions enforcement onto public blockchains even when a transaction never passes through a bank.
Shelbit's network also reached Russia. TRM traced about $318 million in transactions involving Shelbit and Russia's A7 payment network. That was the largest exposure TRM found to any single named sanctioned entity. The US sanctioned A7 in August 2025 for sanctions evasion and for supporting Garantex, the Russian exchange hit by Western enforcement. A7 is partly owned by Promsvyazbank and Moldovan businessman Ilan Shor. It operates A7A5, a ruble-backed stablecoin, and has expanded into Africa.
Shelbit's Russian ties went further. TRM found roughly $16.3 million involving Grinex, the exchange that emerged after US-led enforcement disrupted Garantex in March 2025. OFAC sanctioned Grinex, saying Garantex employees used the platform to migrate customer balances and continue operating. TRM also identified links to Rapira and TokenSpot, among other services in Russia and Central Asia.
The blockchain data does not establish coordination between Iranian and Russian actors. The same data shows Shelbit's infrastructure served separate sanctions-constrained networks at the same time. TRM said an operation carrying IRGC-linked funds and Russian evasion flows looks more like a settlement service than a dedicated conduit for a single country.
Western authorities are increasingly targeting that infrastructure rather than individual exchanges alone. The EU's latest sanctions package includes a mechanism to prohibit transactions with crypto providers in an entire third country when those providers help Russia circumvent sanctions. The measure could restrict EU operators from dealing with providers in jurisdictions that host such activity.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.