$6.3 Billion Crypto Network Between Iran and Russia Exposed

Recent US sanctions have unveiled a significant crypto network valued at $6.3 billion, linking Russian and Iranian operations. Shelbit and Aban Tether, central to this operation, have been accused of facilitating transactions tied to Iran’s Islamic Revolutionary Guard Corps (IRGC) amidst growing concerns over cross-border sanctions evasion. The US Treasury Department's sanctions extend not just to these platforms but also to their founder, Siavash Kayvanpour, and several linked companies operating in Georgia, Poland, and the UAE.

Background on the Sanctioned Entities

In early August 2026, the US identified Shelbit and Aban Tether as key players in facilitating illegal crypto flows. Shelbit reportedly acted as a settlement network rather than a conventional crypto exchange. This distinction is vital, as traditional exchanges typically maintain substantial customer balances, while Shelbit's operations revealed a starkly different pattern.

The Treasury Department highlighted transactions where more than $1 million was sent from IRGC-linked wallets to Shelbit, with over $2 million moving in the opposite direction. Another focal point was Kayvanpour’s wallets, with significant transfers amounting to over $2 million directed to Nobitex, Iran’s largest crypto exchange.

Tracing the Funds Through Shelbit

TRM Labs, the blockchain analytics firm, conducted an in-depth audit revealing that from May 2024 to March 2026, more than $6.3 billion flowed through wallets associated with Shelbit. This period saw a dramatic increase in activity, with transactions climbing from single-digit millions in 2024 to an overwhelming $600 million for six consecutive months in the latter half of 2025. Notably, November 2025 alone accounted for about $735 million.

Unlike conventional exchanges which retain user funds, Shelbit's operational model reflected that of a payment relay system. TRM found that incoming and outgoing transfers in prominent wallets of Shelbit almost perfectly matched (within 0.1%), indicating that the platform functioned primarily as an intermediary rather than a holding entity.

Shelbit's Innovative Wallet Rotation

Another significant aspect revealed by TRM Laboratories was Shelbit's strategy of rapidly rotating high-volume wallets. On average, these wallets were replaced every one to four months, processing between $100 million and $350 million before becoming inactive. This wallet rotation scheme helped obfuscate the trail of funds, making it challenging for regulatory bodies to trace the origins and destination of the transactions.

Interestingly, around 30% of the Tron addresses involved had never engaged in any transactions, suggesting a planned provisioning and activation of wallets for specific operations.

Transaction Patterns and On-Chain Behavior

Shelbit's network primarily utilized the Tron blockchain, transacting large amounts of USDT– a dollar-pegged stablecoin. Approximately $5.56 billion, which constitutes 88% of the entire traced activity, was processed through Tron. Other blockchains such as Ethereum, Bitcoin, and BNB Smart Chain contributed smaller shares of $382 million, $235 million, and $140 million respectively.

This model is particularly effective for businesses requiring quick settlements devoid of traditional banking delays, with Tron transactions averaging around $54,500 and Bitcoin around $249,000 over fewer than 1,000 transactions. TRM’s analysis concluded that these transaction sizes align more with business settlements rather than typical retail trading activities, further confirming Shelbit’s operational intent.

International Connections: The Russian Angle

Significantly, TRM Labs identified about $318 million in transactions that connect Shelbit to the A7 payment network in Russia. This payment network facilitates international settlements for Russian users operating under heavy sanctions. The US imposed sanctions on A7 in August 2025 due to its role in facilitating sanctions evasion and supporting the Garantex exchange, which was previously targeted by US authorities. A7 is partially owned by both a sanctioned Russian bank and a Moldovan businessman.

Connections to other Russian entities, including Grinex and TokenSpot, totaling approximately $16.3 million, further illustrated Shelbit’s cross-border operations. The transactions do not necessarily indicate direct coordination between Iranian and Russian factions but display the network's capacity to serve multiple sanctioned economies.

Sanctions Enforcement and Future Implications

The US sanctions against Shelbit starkly illustrate the government’s capability to enforce sanctions through public blockchain networks, circumventing traditional banking systems. The Treasury Department had previously used controls to freeze approximately $475 million in USDT associated with Iranian transactions, demonstrating the ability to extend reach over crypto operations.

Shelbit cleverly integrated the quick settlement capabilities of stablecoins with a rotating wallet structure, enabling billions to flow through its channels without appearing as retained balances commonly associated with exchanges.

Western authorities are shifting their focus from isolated exchanges to encompass broader financial infrastructures that may enable such illicit operations. The European Union's recent sanctions package includes mechanisms to cut off transactions with crypto service providers in jurisdictions aiding Russia. This regulatory evolution could heighten the scrutiny and restrictions on crypto platforms globally.

Shelbit Transaction Flow

Key Takeaways

• US sanctions exposed Shelbit's role in a $6.3 billion crypto network.
• TRM Labs traced $318 million in transactions connected to Russia's A7 network.
• Shelbit operated with unique wallet rotation to obscure transaction trails.
• 88% of transactions involved the Tron blockchain and USDT, facilitating rapid settlements.
• Western authorities are increasingly targeting broader financial infrastructures.

The scrutiny from authorities is likely to intensify as they expand their focus beyond individual exchanges to combat the financial channels connecting illicit operations. It emphasizes the growing importance of compliance and oversight in the cryptocurrency space, particularly as these networks evolve and grow ever more complex.