The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned Dubai-based Shelbit Exchange and Iran-based Aban Tether on August 7, 2026, marking the fifth major crypto-targeting action under the "Economic Fury" campaign launched in April 2026. The designation followed a Reuters investiga...
"We have seized about a billion dollars of their crypto. Just outright grabbed the wallets." — Scott Bessent, U.S. Treasury Secretary, Reagan National Economic Forum, May 29, 2026
The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned Dubai-based Shelbit Exchange and Iran-based Aban Tether on August 7, 2026, marking the fifth major crypto-targeting action under the "Economic Fury" campaign launched in April 2026. The designation followed a Reuters investigation published July 31 that identified Shelbit as the hub of a $4 billion Iranian sanctions-evasion network funneling funds to the Islamic Revolutionary Guard Corps (IRGC), Iran's central bank, and one of the world's largest illegal online gambling operations.
The Shelbit action is part of a systematic, layered enforcement campaign that has, since January 2026, designated 12 crypto exchanges, frozen $344 million in USDT tied to Iran's central bank, and — according to Treasury Secretary Scott Bessent — seized approximately $1 billion in Iranian crypto assets total. The campaign reveals a structural shift: Washington now treats stablecoin rails and crypto exchanges not as peripheral financial channels but as primary conduits for state-sponsored sanctions evasion, warranting the same enforcement intensity previously reserved for correspondent banking networks.
OFAC's August 7 action targeted three entities and five front companies. The primary targets: Shelbit Exchange, a Georgia-registered, Dubai-operated crypto exchange; Aban Tether, an Iran-based exchange; and Siavash Kayvanpour, an Iranian expatriate identified as the founder and operator. The front company network included SHPS Shelbit (Georgia), Shelbit General Trading (UAE), Shelbit Technologies (Poland), Crypto Home DMCC (Dubai), and NFT Home DMCC (Dubai).
According to the Reuters investigation that preceded the designation, Shelbit processed at least $4 billion since May 2024. The fund flows spanned three categories:
IRGC-linked transfers. OFAC alleged that IRGC-affiliated wallets sent more than $1 million in crypto to Shelbit addresses, while more than $2 million flowed from Shelbit addresses back to IRGC wallets. Kayvanpour-controlled wallets separately sent over $2 million to Nobitex, Iran's largest crypto exchange, which OFAC had designated two months prior.
Central Bank of Iran flows. Reuters found that Shelbit moved crypto on behalf of Iran's central bank, a sanctioned entity since 2018. Tens of millions of dollars of the crypto that passed through Shelbit came from a suspected Iranian bitcoin mining operation.
Gambling network proceeds. Tens of millions of dollars in gambling proceeds from a Persian-language online gambling network — operated by two Iranian social media influencers — were cycled through Shelbit before being redirected to regime-connected wallets.
The downstream exposure was substantial. Blockchain analysis traced approximately $676 million from Shelbit-linked wallets to Binance. Binance confirmed that Shelbit never held a direct account, but stated it froze and reported connected accounts upon internal investigation. Of the $676 million, $540 million moved after Dubai's Virtual Assets Regulatory Authority (VARA) issued its initial cease-and-desist against Shelbit in January 2025.
Shelbit rejected suggestions of knowingly participating in money laundering or sanctions evasion and stated it had ceased operations in January 2026. OFAC's designation renders that claim moot — the sanctions apply regardless of operational status.
Treasury Secretary Bessent introduced the Economic Fury campaign on April 14, 2026, as the financial arm of the U.S. response to military conflict with Iran. The campaign has produced five distinct crypto-targeting enforcement actions, each striking a structurally different layer of Iran's digital asset economy:
| Date | Target | Layer | Scale | |------|--------|-------|-------| | Jan 30, 2026 | Zedcex, Zedxion (UK-registered) | IRGC-linked exchange infrastructure | $94B processed (Zedcex lifetime) | | Apr 23, 2026 | Central Bank of Iran wallets | Sovereign reserves | $344M USDT frozen | | May 27, 2026 | Persian Gulf Strait Authority | Maritime extortion (crypto payments) | $1/barrel transit fee on tankers | | Jun 2, 2026 | Nobitex, Wallex, Bitpin, Ramzinex | Domestic exchange layer | $7.7B (78% of Iran's $9.9B 2025 volume) | | Aug 7, 2026 | Shelbit, Aban Tether | Offshore exchange infrastructure | $4B+ processed |
The January action against Zedcex and Zedxion marked the first time OFAC had ever designated digital asset exchanges specifically linked to IRGC activities. Both were registered in the United Kingdom. Zedcex alone reportedly processed over $94 billion in transactions since its establishment in August 2022, according to TRM Labs.
The April action against the Central Bank of Iran represented the largest on-chain freeze of sovereign crypto reserves ever recorded. Tether blacklisted two Tron addresses that had collectively received approximately $370 million across nearly 1,000 transactions over five years, with inflows beginning in March 2021.
The May action expanded the campaign's scope beyond conventional exchange infrastructure. OFAC designated firms integral to an IRGC-backed extortion scheme that forces commercial vessels transiting the Strait of Hormuz to purchase mandatory maritime "insurance," with payments accepted in Bitcoin and other digital assets.
The June action was the Treasury Department's largest single action against Iran's digital asset economy. The four designated exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — accounted for roughly $7.7 billion, or 78% of Iran's $9.9 billion in attributed 2025 crypto volume. Blockchain analytics from Elliptic revealed that the four platforms collectively facilitated at least $40 billion in cryptocurrency transactions over their lifetimes. Four Iranian nationals tied to Nobitex were also blocked.
By May 29, Bessent disclosed at the Reagan National Economic Forum that the U.S. had seized approximately $1 billion in Iranian crypto assets cumulatively through the campaign.
The Economic Fury campaign operates against a backdrop of rapidly escalating crypto-mediated sanctions evasion. According to the Chainalysis 2026 Crypto Crime Report, sanctioned entities received at least $104 billion in cryptocurrency in 2025, a 694% increase over 2024. This drove total illicit on-chain volume to a record $154 billion.
The dominant driver was Russia's ruble-backed A7A5 token, launched in February 2025, which transacted over $93.3 billion in less than one year. The token functioned as a dedicated settlement system for sanctioned Russian businesses and entities. The EU and U.S. have since sanctioned cryptocurrency exchanges tied to the stablecoin's operation.
Iran's proxy networks facilitated over $2 billion through confirmed wallets identified in sanctions designations. North Korean hackers stole $2 billion in 2025. Chainalysis attributed approximately 76% of crypto-related hack losses globally in 2026 to state-backed actors linked to the Lazarus Group.
Stablecoins accounted for roughly 84% of illicit crypto transaction volume globally, according to Chainalysis. This concentration has turned stablecoin issuers into de facto compliance chokepoints.
The Shelbit case exposed a material enforcement gap in Dubai's crypto regulatory framework. VARA issued a cease-and-desist order against Shelbit in January 2025, citing unlicensed activity and failure to perform mandatory KYC checks. Despite this action, Shelbit continued operating for approximately 18 months.
VARA issued a second enforcement notice against Shelbit on July 24, 2026 — seven days before the Reuters investigation was published — citing violations of the UAE's money-laundering and terrorism-financing laws. The regulator stated it imposed financial penalties, exercised enforcement measures, and directed the entity to cease all unlicensed virtual asset activities immediately.
The gap between the January 2025 cease-and-desist and the July 2026 second action raises questions about VARA's enforcement capacity. During that 18-month window, $540 million of the $676 million in Shelbit-linked funds that reached Binance was transferred. The exchange processed billions in aggregate volume despite being formally warned.
VARA's broader regulatory framework imposes maximum fines of AED 10 million ($2.7 million) for certain violations, with penalties doubled for repeat offenses. For an operation processing $4 billion in flows, a $2.7 million fine is a rounding error. The mismatch between penalty scale and transaction scale raises structural questions about the deterrence value of VARA's current enforcement toolkit.
In June 2026, VARA separately fined Peken Global Limited and MX Global Ltd for operating unlicensed broker-dealer and exchange services. It also issued an enforcement notice against licensed VASP CoinMENA FZE over AML programme control failures. VARA's 2026 AML/CFT guidance mandates risk assessment refreshes every three months and separation of proliferation financing from general money-laundering assessments.
The Economic Fury campaign has accelerated an existing trend: stablecoin issuers functioning as on-demand enforcement arms of the U.S. Treasury.
Tether has supported over 2,300 global cases and frozen $4.4 billion in assets, including $2.1 billion tied to U.S. agencies. The company works with more than 340 law enforcement agencies across 65 countries. In 2026 alone, Tether froze $344 million in USDT linked to the Central Bank of Iran (April) and froze balances across 131 TRON addresses designated as linked to ISIS-K terrorism financing (July).
This cooperation model is efficient but raises governance questions. Tether's ability to blacklist wallets in real time effectively makes it a private-sector sanctions enforcement agent — a role with no statutory basis, no judicial oversight, and no appeal mechanism. The $344 million Central Bank of Iran freeze was executed on the basis of OFAC intelligence, with Tether acting as the technical executor.
For sanctioned actors, the operational implication is clear: USDT exposure is a liability. Iran's $9.9 billion in 2025 crypto volume was overwhelmingly stablecoin-denominated. The systematic blacklisting of wallets tied to Iranian exchanges has reduced the fungibility of USDT for any entity connected to sanctioned jurisdictions.
The Shelbit case carries several operational implications for crypto industry participants:
Downstream liability is real. The $676 million in Shelbit-linked funds that reached Binance demonstrates that sanctions exposure propagates through the transaction graph. Exchanges that receive funds from sanctioned or about-to-be-sanctioned entities face reputational and legal risk even when the sanctioned entity holds no direct account.
Cease-and-desist orders are not sufficient. The 18-month gap between VARA's initial action and the effective shutdown of Shelbit's operations suggests that domestic regulatory actions alone may not stop determined sanctions evaders. The OFAC designation — which carries the force of U.S. secondary sanctions — proved to be the binding constraint.
Front company networks increase exposure surface. Shelbit operated through five front companies across four jurisdictions (Georgia, UAE, Poland, Dubai). Compliance teams must screen not only for designated entities but for their affiliates, directors, and corporate networks.
State-actor volumes dwarf private illicit activity. The $104 billion in sanctioned entity crypto volume in 2025 is orders of magnitude larger than typical cybercrime or darknet market flows. Compliance frameworks designed for small-scale illicit activity are structurally inadequate for state-level sanctions evasion.
The Economic Fury campaign represents the most sustained application of U.S. financial sanctions power to crypto-native infrastructure to date. Five actions in five months have systematically targeted every layer of Iran's crypto economy: IRGC-linked offshore exchanges (January), sovereign reserves (April), maritime extortion schemes (May), domestic exchanges (June), and offshore facilitator networks (August).
The aggregate data point is stark: $104 billion in crypto flowed to sanctioned entities in 2025. The enforcement response — $1 billion seized, 12 exchanges designated, $344 million in USDT frozen — represents a fraction of that flow. The gap between illicit volume and enforcement capacity defines the structural challenge.
For the crypto industry, the implication is operational, not theoretical. Front company networks span multiple jurisdictions. Downstream fund flows create liability for uninvolved exchanges. Stablecoin blacklisting can render assets illiquid without warning. And domestic regulatory actions — even from a proactive regulator like VARA — may not be sufficient to halt determined state-backed actors.
The campaign continues. The next enforcement action is a question of timing, not probability.