US sanctions expose $6.3B crypto conduit linking Iran, Russia

On Aug. 7, U.S. authorities sanctioned Shelbit and Aban Tether and named Shelbit founder Siavash Kayvanpour along with several companies tied to him in Georgia, Poland and the United Arab Emirates. The Treasury identified a network of rotating wallets that it says moved roughly $6.3 billion in USDT.

Treasury records show IRGC-linked wallets sent more than $1 million to addresses tied to Shelbit and that more than $2 million flowed back to accounts linked to the Islamic Revolutionary Guard Corps. Wallets controlled by Kayvanpour are reported to have sent over $2 million to Nobitex, Iran’s largest crypto exchange. Aban Tether, which is not affiliated with the stablecoin issuer Tether, was linked to processing millions of dollars for Iranian exchanges including Nobitex, Wallex, Bitpin and Ramzinex.

Analysis by blockchain firm TRM Labs traced about $6.3 billion through wallets attributed to Shelbit from May 2024 to March 2026. Monthly activity rose from single-digit millions in 2024 to more than $600 million per month for six months in the second half of 2025. November 2025 accounted for roughly $735 million.

TRM’s account records show incoming and outgoing amounts on high-volume Shelbit addresses matched within 0.1%, leaving almost no residual balances. The platform’s busiest wallet received about $357.59 million and sent $357.58 million across more than 16,500 transactions. High-volume addresses were replaced every one to four months; successor wallets typically processed between $100 million and $350 million before becoming inactive. About 30% of Tron addresses associated with the operation never transacted, consistent with pre-provisioned wallets cycled into use.

TRM reported minimal use of crypto-mixing services-about $370,000-across the $6.3 billion network. The traced flows relied heavily on the Tron network and USDT-TRC20: roughly $5.56 billion, or 88% of activity, moved on Tron. Ethereum accounted for about $382 million, Bitcoin about $235 million, and BNB Smart Chain about $140 million. Average Tron transfers were about $54,500, while Bitcoin transfers averaged roughly $249,000 across fewer than 1,000 transactions.

U.S. authorities have previously used controls over stablecoin issuers to freeze holdings on public blockchains; earlier actions froze about $475 million in USDT linked to Iran. Treasury and TRM have not accused Tether of participating in Shelbit’s operations.

TRM also traced roughly $318 million in transactions between Shelbit and Russia’s A7 payment network, making A7 the single largest named sanctioned entity connected to the operation. A7 was sanctioned in August 2025 for sanctions evasion and links to Garantex; it is partly owned by sanctioned lender Promsvyazbank and Moldovan businessman Ilan Shor, and it operates a ruble-backed stablecoin called A7A5. TRM identified about $16.3 million involving Grinex and found additional links to Rapira, TokenSpot and other Russian and Central Asian services.

The transaction records do not establish direct coordination between Iranian and Russian actors. U.S. and European authorities have increased focus on payment and settlement infrastructure used to move value across borders for sanctioned actors. The European Union has introduced a mechanism that can bar transactions with crypto providers located in third countries when those services are used to help Russia evade sanctions.