On Aug. 7, US authorities sanctioned Shelbit and Aban Tether, two Iranian-linked crypto platforms accused of facilitating transactions tied to Iran’s Islamic Revolutionary Guard Corps and other state-linked entities.
The Treasury Department also sanctioned Shelbit founder Siavash Kayvanpour and several companies connected to him in Georgia, Poland and the United Arab Emirates.
It said IRGC-linked wallets sent more than $1 million to Shelbit addresses, while more than $2 million flowed in the opposite direction. Wallets controlled by Kayvanpour also sent more than $2 million to Nobitex, Iran’s largest crypto exchange.
Aban Tether, which does not appear to be affiliated with stablecoin issuer Tether, was separately accused of processing millions of dollars involving sanctioned Iranian exchanges including Nobitex, Wallex, Bitpin and Ramzinex.
Shelbit operated more like a settlement network than an exchange
While Shelbit presented itself as a crypto exchange, its blockchain activity looked markedly different from a conventional trading venue.
TRM Labs traced more than $6.3 billion through Shelbit-linked wallets over 23 months between May 2024 and March 2026.
According to the blockchain analytical firm, activity accelerated sharply during that period, with monthly volume rising from single-digit millions in 2024 to more than $600 million for six consecutive months in the second half of 2025. November alone accounted for about $735 million.
Yet little of that money remained with Shelbit.
Crypto exchanges typically hold customer assets between trades, leaving substantial balances in their wallets.
Across every high-volume Shelbit address analyzed by TRM, incoming and outgoing amounts matched within 0.1%, with virtually no residual holdings. Its busiest wallet received about $357.59 million and sent $357.58 million across more than 16,500 transactions.
TRM said the pattern was consistent with relaying payments rather than taking assets into custody.
Shelbit also replaced its high-volume wallets every one to four months, with successor addresses typically processing between $100 million and $350 million before going dormant.
About 30% of the Tron addresses attributed to the operation never transacted at all, suggesting wallets were provisioned in advance and cycled into use.
Moreover, the operation made little use of tools normally associated with concealing crypto flows. TRM found only about $370,000 of exposure to mixing services across the $6.3 billion network, concluding that Shelbit relied instead on intermediary wallets and continuous address rotation to make its transaction chains harder to follow.
That settlement model depended overwhelmingly on Tron and Tether’s dollar-linked USDT.
About $5.56 billion, or 88% of Shelbit’s traced activity, moved over Tron, almost entirely through USDT-TRC20. Ethereum accounted for roughly $382 million, Bitcoin $235 million, and BNB Smart Chain $140 million, while other networks represented less than 1% combined.
Tron transactions averaged about $54,500, while Bitcoin transfers averaged roughly $249,000 across fewer than 1,000 transactions. TRM said those amounts were more consistent with business settlement than retail crypto trading.
USDT also offered dollar-denominated value that could settle quickly without passing through the correspondent banking system used for conventional international dollar payments.
Neither Treasury nor TRM accused Tether of participating in Shelbit’s operations. The platform’s dependence on USDT nevertheless highlights a limitation of using stablecoins to move dollars outside traditional banking channels: the issuer can still block the tokens.
CryptoSlate previously reported that US authorities used Tether’s controls to freeze about $475 million in USDT linked to Iran in less than three months, including funds held in Tron wallets.
The actions showed how Washington can extend sanctions enforcement onto public blockchains even when transactions never pass through a bank.
Shelbit therefore combined the speed and reach of stablecoin settlement with a constantly rotating wallet infrastructure, allowing billions of dollars to pass through its network without accumulating the balances normally associated with a crypto exchange.
Shelbit connection runs into Russia
Meanwhile, blockchain records also show that Shelbit had evolved into a cross-border settlement network serving actors across multiple sanctioned economies, including Russia.
For context, TRM Labs traced about $318 million in transactions involving Shelbit and Russia’s A7 payment network, making it the platform’s largest exposure to any single named sanctioned entity.
A7 operates cross-border payment infrastructure designed to facilitate international settlement for Russian users facing restrictions on access to Western financial channels. The US sanctioned the company in August 2025, citing its role in sanctions evasion and its support for Garantex, the Russian crypto exchange previously targeted by Western authorities.
The network is partly owned by sanctioned Russian lender Promsvyazbank and Moldovan businessman Ilan Shor. It also operates A7A5, a ruble-backed stablecoin used within its payment system, and has expanded beyond Russia into markets including Africa.
Shelbit’s Russian exposure extended beyond A7. TRM identified roughly $16.3 million involving Grinex, the exchange that emerged after US-led enforcement disrupted Garantex in March 2025. OFAC later sanctioned Grinex, saying Garantex employees used the platform to migrate customer balances and continue operating.
TRM also found links to Rapira, TokenSpot and other Russian and Central Asian services.
While the transactions do not establish coordination between Iranian and Russian actors, they show that Shelbit’s infrastructure was being used across separate sanctions-constrained financial networks.
That distinction is important. An operation carrying IRGC-linked funds and Iranian gambling proceeds alongside Russian sanctions-evasion flows more closely resembles a settlement service serving multiple clients than a conduit dedicated to a single country or organization.
Western authorities are increasingly targeting that broader infrastructure rather than individual exchanges alone.
The European Union’s latest sanctions package introduced a mechanism allowing it to prohibit transactions with crypto providers across an entire third country when services there are used to help Russia circumvent sanctions. The measure could restrict dealings between EU operators and providers located in jurisdictions that host such activity.
