How Reuters uncovered Iran’s secret crypto notework and what the government record adds

Posted on

More than 3 Billion traced

By Jeff Newman, Esq., MBA

A locked door in Dubai

In early July, a Reuters reporter went to the registered address of a crypto exchange called Shelbit, in the Deira district of Dubai. Behind a locked door on the fourth floor was a small watch-trading company. Its staff said they had never heard of the exchange. The watch company, according to Dubai corporate filings cited by Reuters, is registered to the man who founded Shelbit.

Reuters published its investigation on July 31, 2026, under the headline “Illicit Iranian gambling network helped pull off a $4 billion sanctions dodge.” It reported that Shelbit had moved at least $4 billion since May 2024 and served as a channel for Iranian money into global crypto markets.

One week later, the U.S. Treasury sanctioned Shelbit and its founder.

This post sets out what Reuters reported, what the government record now shows, and where the two differ. Where something could not be confirmed, I say so.

What Reuters reported

All of the following is as reported by Reuters.

  • The exchange. Shelbit was an unlicensed exchange run by Siavash Kayvanpour, an Iranian living abroad. Two crypto investigative firms, which asked not to be named, and an independent blockchain researcher, Rich Sanders, analyzed its flows and put the total at no less than $4 billion since May 2024.
  • The counterparties. Shelbit dealt with Iran’s central bank, with wallets the Israeli government has linked to the Islamic Revolutionary Guard Corps (IRGC), and with Nobitex, Iran’s largest crypto exchange. The analysts traced at least $125 million from the central bank and at least $20 million from what they believe is an Iranian bitcoin-mining operation.
  • The customers. A main customer was a Farsi-language online gambling network of more than 2,000 websites, mapped by the cybersecurity firm Infoblox. Shelbit handled at least $130 million for a single one of those sites.
  • The faces. Reuters identified two Iranian influencers, Sasha Sobhani and Pooyan Mokhtari, as the public faces of the network. An Iranian court convicted both in absentia in 2023 over an earlier illegal-gambling network and gave Kayvanpour a three-month sentence for assisting them. Reuters found the two still promoting sites from that prosecution. Both deny wrongdoing, and both told Reuters they did not know Kayvanpour or Shelbit.
  • The Guards’ role. Former insiders told Reuters the IRGC moved into Iran’s online gambling business about a decade ago, a business that depends on the central bank, which runs the domestic payment system. Reuters says it is the first news organization to detail that takeover.

Sanders’ conclusion was blunt: “It’s an IRGC operation, and that’s plain as day.” Miad Maleki, a former official at Treasury’s Office of Foreign Assets Control (OFAC), described the pattern this way: “Ideology is the IRGC’s branding while profit is its business model.”

Reuters was careful about the limits of its proof. It said it could not determine whether the IRGC directly controlled Shelbit or the gambling network, who in the Iranian state ran the operation, or where much of the money ended up.

The money that went to Binance

The finding with the widest consequences concerns Binance. Reuters reported that at least $676 million moved from Shelbit addresses to Binance, the world’s largest crypto exchange, since May 2024. About $540 million of that moved after Dubai’s regulator acted against Shelbit. Sanders said he warned Binance about Shelbit’s ties to Iran in October 2025, and the blockchain data show the money kept flowing.

Binance told Reuters that Shelbit never held a Binance account and had not been sanctioned. It said an unnamed outside analytics firm had not rated the flows high risk, and that when Shelbit-linked users touched its platform, its compliance team investigated, froze accounts and reported them to law enforcement. Binance did not dispute handling hundreds of millions of dollars tied to Shelbit. It did not answer Reuters’ questions about what it did after Sanders’ warning.

For context: in 2023, Binance pleaded guilty in the United States to anti-money-laundering and sanctions violations, including processing Iranian trades, and agreed to pay about $4.3 billion.

What Dubai’s regulator found

Dubai’s Virtual Assets Regulatory Authority (VARA) oversees crypto businesses in Dubai outside the DIFC free zone. Its public record on Shelbit has two parts.

  • January 2, 2025. VARA’s list of unlicensed firms shows Shelbit General Trading L.L.C with that date. A later VARA notice describes it as a cease-and-desist notice and enforcement action.
  • July 24, 2026. VARA published a Notice of Fines. Reuters reports it came soon after Reuters asked VARA for comment. The notice says Shelbit kept providing crypto services in or from Dubai without a licence, onboarded users without required identity checks, and marketed in Dubai without authorization. It orders Shelbit to stop all unlicensed activity, and it says the concern went beyond consumer protection to cross-border transactions that could affect the integrity of the UAE financial system.

The notice does not state the amount of the fines. Reuters writes that about $540 million moved to Binance after VARA “fined Shelbit last year.” The public record shows a 2025 enforcement action and a 2026 notice of fines. VARA confirmed to Reuters that it acted in 2025, so Reuters may have information not in the public notices. From the public record alone, I could not confirm a 2025 fine.

Reuters also reports, citing one person with direct knowledge, that VARA is investigating Shelbit’s alleged role in laundering money for Iran and evading sanctions. The published notice does not use the word “sanctions.”

One week later: the Treasury acts

On publication day, Treasury told Reuters only that OFAC was aware of the allegations and taking them seriously. On August 7, 2026, OFAC sanctioned Shelbit and Kayvanpour. Treasury did not credit Reuters. The sequence is a matter of record; I draw no conclusion from it.

The official sanctions list adds facts Reuters did not report:

  • The founder. Kayvanpour was designated a Specially Designated Global Terrorist under Executive Order 13224, with an IRGC tag and a secondary-sanctions warning. Foreign banks that knowingly do significant business with him risk losing access to the U.S. financial system. OFAC lists him as Iranian, with alternate nationalities of Dominica and Afghanistan, and addresses on Iran’s Kish Island and in Dubai, and it published his bitcoin, Ethereum and Tron wallet addresses.
  • The structure. The Shelbit companies span at least three countries: SHPS Shelbit in Tbilisi, Georgia, through which Treasury says the exchange is operated; Shelbit General Trading in Dubai; and Shelbit Technologies in Warsaw, now in liquidation. Two more Dubai free-zone companies, Crypto Home DMCC and NFT Home DMCC, were also designated; Treasury says Kayvanpour is sole manager of both.
  • A second exchange. The same day, OFAC sanctioned Aban Tether, a Tehran exchange, for dealing with Iranian exchanges already under sanctions, including Nobitex. OFAC had designated Nobitex and three other large Iranian exchanges on June 2, 2026.

Treasury’s dollar figures were far smaller than Reuters’. It said IRGC-linked addresses sent more than $1 million to Shelbit, Shelbit sent more than $2 million back, and tens of millions of dollars from the Persian-language gambling network moved through Shelbit. Treasury independently confirmed two of Reuters’ points: the influencers behind the sites were convicted of illegal gambling in Iran in 2023, and their sites still have access to Iran’s centrally regulated payment systems.

Three things are missing from Treasury’s announcement. It does not use the $4 billion figure. It does not mention Binance. And it does not name Sobhani or Mokhtari, neither of whom was designated. The government confirmed the IRGC connection, but in millions of dollars, not billions.

One observation, not a finding: Reuters reports that Mokhtari lived in the UAE under a Vanuatu identity, and OFAC lists Kayvanpour with a Dominica passport. Both countries sell citizenship to investors.

A second count: $6.3 billion

On the day of the sanctions, the blockchain analytics firm TRM Labs published its own analysis. It traced more than $6.3 billion through Shelbit from May 2024 through March 2026, about 88 percent of it in the stablecoin USDT on the Tron blockchain. TRM found that Shelbit’s wallets held almost nothing and that money in matched money out almost exactly, and concluded that the exchange “had the outward form of an exchange and almost none of the substance.”

TRM added two facts not in Reuters’ story:

  • Russia. The largest exposure to a single named sanctioned party was about $318 million with A7, a sanctioned Russian entity.
  • Hamas. On September 17, 2025, Shelbit sent about $2 million to a wallet Israel later designated as Hamas infrastructure.

Two cautions. TRM states that its tracing does not establish the knowledge or intent of anyone involved in those transfers. And TRM is not wholly independent of the Reuters story: John Wojcik, a former Infoblox researcher quoted by Reuters, now works there. I could not determine whether TRM was one of Reuters’ two unnamed firms. The differing totals are normal in blockchain tracing, where results depend on which wallets are attributed to whom. The direction is consistent; the precise figures are estimates.

Shelbit’s side: the London law firm Mishcon de Reya reports that Shelbit denied knowingly supporting money laundering, terrorist financing or sanctions evasion, and said it stopped operating in January 2026. Kayvanpour did not respond to Reuters.

Binance’s year

Shelbit lands on top of a year of scrutiny of Iran-linked money at Binance:

  • October 23, 2025. President Trump pardoned Binance founder Changpeng Zhao, who had pleaded guilty in 2023.
  • February 2026. The New York Times reported that Binance’s own investigators found about $1.7 billion flowing from two accounts to Iran-linked entities. Binance denied that any investigator was dismissed for raising concerns and said its controls had worked.
  • April 19, 2026. Treasury sent Binance a letter seeking records and interviews about possible sanctions violations, according to Bloomberg. Binance said it was cooperating fully.
  • September 22, 2026. Bloomberg reported that federal prosecutors in Manhattan and the Justice Department’s Criminal Division are investigating whether Binance violated Iran sanctions. Binance said it has zero tolerance for sanctions violations.

Binance has not been charged in connection with Shelbit, and the September report did not mention Shelbit. Binance’s statement that Shelbit “had not been sanctioned” has not been true since August 7.

What this could mean (my analysis, not a finding). Shelbit is a cleaner test than most of Binance’s position that its controls worked. Dubai listed Shelbit as unlicensed in January 2025. A researcher says he warned Binance in October 2025. Hundreds of millions of dollars kept moving, and the U.S. government has now formally tied Shelbit to the IRGC. Civil sanctions penalties do not require proof that a company knew. Criminal charges, and any claim that Binance breached its 2023 plea, would turn on what it knew and when. That is why the October 2025 warning matters.

Credit where it is due

This story was built the hard way. Reuters spoke to more than 30 people, reviewed Iranian legal filings, mapped the gambling sites with Infoblox, and put reporters on the ground in Dubai and Hong Kong. Dubai’s regulator published its notice soon after Reuters asked questions, and Treasury acted a week after publication.

The reporting team was Gavin Finch, Feras Dalatey, Denise Ajiri, Tom Wilson and Farah Master. Work like this takes months and money, and it is increasingly rare. It deserves to be read in full.

A note for people on the inside

Sanctions evasion runs through ordinary-looking businesses: exchanges, payment firms, trading companies, watch shops. The people who see it first are often employees. In 2022 Congress expanded the Financial Crimes Enforcement Network’s whistleblower program to cover sanctions violations, with awards of up to 30 percent of what the government collects. FinCEN proposed rules to fully implement the program in 2026; as of that proposal, it had not yet paid awards.

What could not be verified

In keeping with this blog’s rule that what cannot be established will not be stated:

  • Whether the IRGC directly controlled Shelbit or the gambling network. Reuters could not determine this, and Treasury’s figures are in millions, not billions.
  • Whether VARA fined Shelbit in 2025, as Reuters reports.
  • The identity of the two analytics firms behind Reuters’ figures.
  • What Binance did after the October 2025 warning, and the current status of the compliance monitorship Binance accepted in its 2023 plea.

Jeff Newman Law is a national whistleblower law firm that handles whistleblower cases under the False Claims Act, including healthcare and tariff fraud matters and other kinds of cases. You can reach the firm at www.jeffnewmanlaw.com or at 617-823-3217.

Sources

  • Reuters, “Illicit Iranian gambling network helped pull off a $4 billion sanctions dodge,” July 31, 2026 (updated Sept. 16, 2026). [Add reuters.com URL]
  • U.S. Treasury, OFAC Recent Actions, Aug. 7, 2026.
  • U.S. Treasury, “Treasury Sanctions Crypto Exchanges Funding Iran’s IRGC and Enabling Illicit Finance,” press release sb0598, Aug. 7, 2026.
  • VARA, Notice of Fines, Shelbit General Trading L.L.C, July 24, 2026; VARA, Unlicensed Virtual Asset Service Providers list.
  • TRM Labs, “How Shelbit Became a USD 6.3 Billion Settlement Layer for Iran’s Illicit Economy,” Aug. 7, 2026.
  • Mishcon de Reya, “What the Shelbit and Aban Tether crypto sanctions tell us about tracing illicit finance.”
  • Elliptic, “OFAC sanctions Nobitex and three other Iranian cryptoasset exchanges,” June 3, 2026.
  • CoinDesk, “Binance said to be facing U.S. DOJ investigation into alleged Iranian sanctions activity,” Sept. 22, 2026 (citing Bloomberg).
  • The Block, “Binance denies firing investigators over reported $1.7 billion crypto flows to Iran,” Feb. 24, 2026.
  • Crypto Briefing, “Binance receives Treasury letter over potential sanctions violations tied to Iran,” May 2026 (citing Bloomberg).
  • GV Wire (Reuters), “Trump pardons convicted Binance founder Zhao, White House says,” Oct. 23, 2025.
  • Constantine Cannon, “FinCEN moves another step closer to issuing its first award under its AML/sanctions whistleblower program,” Apr. 1, 2026.