US Sanctions Expose $6.3B Crypto Pipeline Linking Iran and Russia

Woofun AI reports that the U.S. Treasury Department has sanctioned Shelbit founder Siavash Kayvanpour alongside several affiliated companies operating in Georgia, Poland, and the United Arab Emirates, while separately accusing Aban Tether—an entity not affiliated with stablecoin issuer Tether—of processing millions of dollars for sanctioned Iranian exchanges including Nobitex, Wallex, Bitpin, and Ramzinex.

The operational profile of Shelbit diverged significantly from that of a conventional crypto exchange, as evidenced by a dramatic surge in transaction volume during 2024 and 2025. Monthly processing amounts escalated from single-digit millions in 2024 to exceed $600 million for six consecutive months in the second half of 2025, with November alone accounting for approximately $735 million in activity.

Woofun AI data shows that blockchain analysis by TRM revealed incoming and outgoing amounts on high-volume Shelbit addresses matched within 0.1%, indicating virtually no residual holdings. Its busiest wallet received about $357.59 million and sent $357.58 million across more than 16,500 transactions, a pattern consistent with relaying payments rather than taking assets into custody.

Shelbit employed a strategy of replacing high-volume wallets every one to four months, with successor addresses typically processing between $100 million and $350 million before going dormant.

Notably, about 30% of the Tron addresses attributed to the operation never transacted at all, suggesting wallets were provisioned in advance and cycled into use only when needed.

The operation made little use of traditional obfuscation tools, with TRM finding only about $370,000 of exposure to mixing services across the $6.3 billion network. Instead, Shelbit relied on intermediary wallets and continuous address rotation, with Tron transactions averaging about $54,500 and Bitcoin transfers averaging roughly $249,000 across fewer than 1,000 transactions, amounts more consistent with business settlement than retail crypto trading.

USDT provided dollar-denominated value that could settle quickly without passing through the correspondent banking system used for conventional international dollar payments. While neither Treasury nor TRM accused Tether of participating in Shelbit's operations, the platform's dependence on USDT highlights a regulatory limitation: the issuer can still block the tokens, allowing Washington to extend sanctions enforcement onto public blockchains even when transactions never pass through a bank.

Blockchain records indicate Shelbit evolved into a cross-border settlement network serving actors in sanctioned economies, including Russia. The network is partly owned by sanctioned Russian lender Promsvyazbank and Moldovan businessman Ilan Shor, operates A7A5—a ruble-backed stablecoin—and has expanded into markets including Africa, with links found to Rapira, TokenSpot, and other Central Asian services connecting Iranian and Russian actors.

Western authorities are increasingly targeting this broader infrastructure rather than individual exchanges alone. The European Union's latest sanctions package introduced a mechanism allowing it to prohibit transactions with crypto providers across an entire third country when services there are used to help Russia circumvent sanctions, potentially restricting dealings between EU operators and providers in such jurisdictions.

Shelbit combined the speed of stablecoin settlement with a rotating wallet infrastructure, allowing billions of dollars to pass through without accumulating balances typical of a crypto exchange. This marks a significant expansion of enforcement scope, revealing how a cross-border settlement network can operate across sanctioned economies despite regulatory pressures.