OFAC Sanctions Shelbit: The $6.3 Billion Crypto Settlement Layer Behind Iran's Illicit Economy
On August 7, 2026, the US Treasury Department's Office of Foreign Assets Control designated Shelbit, its founder Siavash Kayvanpour, and a cluster of affiliated entities across the UAE, Poland, and Georgia. A concurrent, separate designation covered Aban Tether, an Iran-based exchange with its own links to previously sanctioned Iranian platforms. The designations arrive after blockchain intelligence firm TRM Labs traced more than USD 6.3 billion in flows through Shelbit's infrastructure between May 2024 and March 2026, painting a picture of a platform that functioned not as a genuine exchange but as a high-throughput settlement layer for Iran's illicit economy. For accounting firms, auditors, and CFOs managing digital asset exposure, the details of how Shelbit operated are at least as important as the designation itself.
What OFAC Actually Designated and Why
Treasury's action names Kayvanpour personally, along with UAE-incorporated entities Shelbit General Trading LLC, Shelbit Technologies Ltd, Crypto Home DMCC, and NFT Home DMCC. The legal basis is Executive Order 13224, which targets those who support or facilitate terrorism financing. Aban Tether was designated separately under Executive Order 13902, which targets entities operating in Iran's financial sector.
OFAC cited three specific grounds: digital currency transfers between Shelbit's wallets and addresses controlled by the Islamic Revolutionary Guard Corps (IRGC), a US-designated foreign terrorist organization; transfers from Kayvanpour-controlled addresses to Nobitex, itself a previously designated Iranian exchange; and Shelbit's role as the settlement infrastructure for a large-scale Persian-language online gambling network operating in defiance of Iranian law.
The Regulatory Pressure That Preceded the Designation
The OFAC action did not arrive without warning. Dubai's Virtual Assets Regulatory Authority issued a cease-and-desist order against Shelbit on July 24, 2026, citing violations of anti-money-laundering and terrorism-financing law and warning that the exposure identified went beyond consumer protection to what it described as egregious cross-border transactions with the potential to undermine the integrity of the UAE financial system. That order was itself a second enforcement action, following a 2025 penalty for unlicensed operation. Separately, OFAC had designated a group of Iranian platforms in June 2026 that together accounted for roughly 78% of Iran's attributed 2025 cryptocurrency volume according to TRM data, indicating a sustained campaign against Iran's crypto infrastructure rather than a one-off enforcement event.
The Scale and Structure of Shelbit's On-Chain Activity
TRM Labs developed its analysis independently of Treasury's designation, and the figures that emerge are striking. The USD 6.3 billion total dwarfs the specific transfers that OFAC cited in its notice, pointing to an operation whose documented government-facing exposure represents only a fraction of its actual throughput.
How the Money Moved: TRON, Stablecoins, and Near-Zero Balances
Approximately 88% of Shelbit's activity, around USD 5.56 billion, moved on the TRON blockchain, almost entirely in dollar-pegged stablecoins. The average transfer size was roughly USD 54,500, a size consistent with settlement between businesses or financial intermediaries rather than retail users cashing in or out. Crucially, Shelbit's wallets held virtually no balances at any point. Value entering the platform left almost immediately, with inbound and outbound amounts matching to within 0.1%. That near-perfect balance is the on-chain signature of a pure settlement conduit, a pass-through rather than a custodial exchange.
Wallet Rotation as a Deliberate Evasion Tactic
Shelbit rebuilt its wallet infrastructure every one to four months across two years of continuous operation. This rotation pattern, repeated consistently and at scale, is not consistent with routine operational hygiene. TRM's assessment is that it reflects a deliberate effort to limit traceability and stay ahead of blockchain analytics tools that flag known addresses. For compliance teams, this matters because it means a single OFAC list check at onboarding, without ongoing transaction monitoring, would not have caught the exposure.
Monthly Volume Trajectory
Monthly volumes peaked at approximately USD 735 million in November 2025, having more than doubled in a single month in July 2025 alone. Volumes held above USD 600 million for six consecutive months before the designation. The trajectory indicates a platform that was accelerating, not winding down, at the point OFAC acted.
Who Shelbit Was Serving: The Exposure Breakdown
TRM's analysis identifies several distinct sanctioned-actor clusters within Shelbit's transaction history. Each has different compliance implications for firms that may have had indirect exposure through counterparty chains.
IRGC and Hamas Connections
TRM identified direct exposure of approximately USD 5.6 million across 36 transfers to wallets associated with the IRGC. In September 2025, Shelbit sent approximately USD 2 million in four transfers on a single day to a wallet subsequently designated by Israel's National Bureau for Counter Terror Financing as Hamas infrastructure. These are not aggregated statistical links: they are specific, documented transfers to wallets tied to US-designated terrorist organisations.
Russian Sanctions-Evasion Networks
Shelbit's exposure extended well beyond Iran. TRM traced approximately USD 318 million to A7, a sanctioned Russian payment network. Additional exposure ran to Grinex, Rapira, and other sanctioned Russian and Central Asian services. The scale of this Russian-facing activity indicates that Shelbit was not a narrow Iran-only conduit but a general-purpose settlement infrastructure available to multiple sanctioned economies simultaneously.
Iran's Largest Identified Illegal Gambling Operation
TRM traced approximately USD 72.6 million in exposure spread across 55 separate online gambling platforms. The underlying gambling network comprised more than 2,000 Persian-language websites and is described as the largest illegal gambling operation ever identified in Iran, and one of the largest identified anywhere. Gambling is illegal in the Islamic Republic and has been explicitly prohibited online since 2023, yet the network obtained access to Iran's domestic payments infrastructure. Two Iranian social media figures with audiences in the millions publicly fronted the sites. An Iranian court convicted both figures along with Kayvanpour in a 2023 illegal gambling case, sentencing them in absentia. Both individuals deny the allegations made against them.
What the On-Chain Signature Means for Compliance Teams
The Shelbit case is instructive precisely because it did not look unusual at the wallet level without context. A near-zero-balance wallet cycling large TRON stablecoin volumes at regular intervals could, in isolation, resemble legitimate over-the-counter settlement or treasury management activity. The differentiation comes from pattern analysis across time, counterparty clustering, and comparison against known sanctioned infrastructure, exactly the kind of work that manual transaction review cannot perform at scale.
The Limits of Address-List Screening Alone
Shelbit's wallet rotation every one to four months means that OFAC's Specially Designated Nationals list would only flag an address after the fact, by which point the operator had already migrated to fresh infrastructure. Firms relying solely on static list screening against inbound and outbound addresses are structurally unable to catch this pattern. The compliance implication is clear: screening against known addresses is a necessary baseline, not a sufficient control. Crypto accounting software and digital asset accounting software integrated into a firm's workflow must be paired with behavioural monitoring, not treated as a standalone compliance answer.
TRON Stablecoin Flows Require Dedicated Monitoring
The dominance of TRON in Shelbit's activity is not coincidental. TRON carries a substantial share of global stablecoin volume, and its low fees make it the preferred rail for high-frequency settlement. Compliance frameworks built primarily around Ethereum or Bitcoin may have systematically lower coverage of TRON-based flows. Firms whose crypto compliance reporting infrastructure does not include TRON-native monitoring should treat this case as a prompt to audit that gap. Any VASP due diligence onboarding framework must now explicitly address TRON stablecoin counterparties and near-zero-balance, high-velocity wallet patterns.
Counterparty Chain Risk for Indirect Exposure
Accounting firms auditing clients with digital asset operations, and CFOs managing treasury exposure to stablecoins or OTC settlement desks, face a second-order risk. Direct exposure to Shelbit's designated wallets may be rare among regulated Western firms. Indirect exposure through an OTC intermediary, a liquidity provider, or a payment processor that itself routed through Shelbit is a different matter. The AML due diligence framework for financial institutions must extend to a firm's counterparties' counterparties, not just the immediate relationship. Crypto bookkeeping software used in practice should support second-tier relationship flagging, not only direct matches against the SDN list.
Practical Steps for Accounting Firms and CFOs Now
Given the size and duration of Shelbit's operation, and the range of sanctioned actors it touched, a reactive posture is not adequate. The following steps are grounded in what the TRM and OFAC disclosures actually show.
Immediate Screening and Documentation
Run all known counterparty wallet addresses, including those of OTC desks, stablecoin settlement providers, and any TRON-based payment rails used between May 2024 and March 2026, against the August 7, 2026, OFAC designations. Document the results. If your digital asset accounting software does not retain a complete counterparty address history for that period, that is itself a recordkeeping gap to remediate. Preserve all documentation in case of a regulatory inquiry: OFAC's enforcement history shows that firms which self-identify and document proactively receive materially different treatment from those that do not.
Review Ongoing Monitoring Controls
Check whether your transaction monitoring covers TRON explicitly, not just as a residual catch-all. Assess whether your alert rules would have flagged the specific behavioural pattern Shelbit exhibited: very high velocity, near-zero balance, and regular wallet address changes at intervals of one to four months. If the answer is no, those rules need updating before the next enforcement action, not after it.
Assess Client-Facing Exposure
For audit and accounting firms, the Shelbit case is a prompt to review digital asset disclosures and AML attestations from any client with stablecoin or TRON exposure in the relevant period. Where a client cannot provide adequate transaction-level documentation, that is a scope limitation requiring disclosure. Where the documentation reveals potential indirect exposure, legal advice is warranted before the firm proceeds with any assurance opinion.
Source: TRM Labs
Frequently Asked Questions
Which entities did OFAC designate on August 7, 2026, in connection with Shelbit?
OFAC designated Siavash Kayvanpour (Shelbit's founder), Shelbit General Trading LLC, Shelbit Technologies Ltd, Crypto Home DMCC, and NFT Home DMCC, all under Executive Order 13224. Aban Tether, an Iran-based exchange, was designated separately under Executive Order 13902 for operating in Iran's financial sector.
Why does Shelbit's near-zero wallet balance matter for AML compliance?
When inbound and outbound amounts match to within 0.1% and balances stay near zero, the platform is acting as a pass-through settlement conduit rather than a custodial exchange. This pattern reduces the window in which a compliance team can identify and freeze suspicious funds, and it means standard balance-threshold alerts will not trigger. Transaction-velocity and counterparty-cluster monitoring are needed instead.
What blockchain was Shelbit primarily using, and why does that matter?
Approximately 88% of Shelbit's USD 6.3 billion in flows moved on TRON, almost entirely in dollar-pegged stablecoins. TRON's low fees make it attractive for high-frequency settlement. Compliance systems that focus on Ethereum or Bitcoin without equivalent TRON coverage may have missed this activity entirely.
How should an accounting firm assess whether its clients have indirect exposure to Shelbit?
Start by identifying any counterparties that operated OTC desks, stablecoin settlement services, or payment processing on TRON between May 2024 and March 2026. Request blockchain transaction records or compliance attestations from those counterparties. If the digital asset accounting software in use does not support counterparty-chain analysis, a specialist blockchain analytics review may be warranted. Document the assessment to support any regulatory inquiry.
Does Shelbit's website going offline mean the underlying risk has ended?
No. TRM Labs explicitly notes that there is no indication the sanctions evasion and terrorism financing Shelbit supported has ceased. Unlicensed settlement infrastructure of this type typically migrates rather than dissolves. Compliance teams should monitor for successor wallet clusters and treat this designation as a signal to tighten ongoing monitoring rather than a closed matter.