Dubai Exchange Shelbit Moved $4B for Iran's IRGC-Linked Sanctions Network
An unlicensed Dubai exchange called Shelbit processed at least $4 billion for Iran's IRGC-linked gambling empire and sanctioned entities including Iran's central bank, with $676 million traced to Binance. Dubai's VARA acted on July 24. OFAC is next.
An unlicensed brokerage in Dubai became the financial backbone of one of the largest Iranian sanctions-evasion operations ever discovered, routing billions through custodial platforms while regulators watched.
Key takeaways
- Shelbit, an unlicensed Dubai exchange run by Iranian expatriate Siavash Kayvanpour, processed at least $4 billion for Iran's IRGC-linked gambling network and sanctioned entities, including $676 million traced to Binance, first reported by Reuters.
- Dubai's Virtual Assets Regulatory Authority issued a cease-and-desist and monetary fines against Shelbit General Trading L.L.C. on July 24, 2026; OFAC is reviewing the operation and has signaled action against Iranian regime-linked digital assets.
- The operation ran entirely through the custodial counterparty layer. The IRGC didn't break Bitcoin's base layer; it exploited an unlicensed middleman with brokerage access to compliant exchanges.
Shelbit, an unlicensed Dubai-based crypto exchange active since at least May 2024, processed a minimum of $4 billion for a network of IRGC-linked gambling platforms and U.S.-sanctioned Iranian entities, including Iran's central bank, first reported by Reuters on July 31, 2026. At least $676 million in Shelbit-linked flows was traced by Reuters blockchain investigators to Binance, the world's largest exchange.
The scope makes it one of the largest Iranian sanctions-evasion networks uncovered in years, and the mechanics expose something the compliance industry has refused to reckon with: a single unlicensed brokerage in a free-trade zone can absorb state-level illicit flows and route them directly into regulated platforms.
How the Operation Ran
Shelbit served as the hub. On one side: a network of more than 2,000 Farsi-language gambling sites, fronted by influencers Sasha Sobhani and Pooyan Mokhtari, both convicted in Iran in 2023 alongside Shelbit operator Siavash Kayvanpour on illegal gambling charges. On the other side: Iran's central bank (sanctioned by OFAC), wallets identified by the Israeli government as IRGC-connected, and Nobitex, the Iranian exchange sanctioned by Treasury earlier in 2026 after a prior Reuters investigation.
Some of the crypto flowing into Shelbit originated from what investigators described as an Iranian bitcoin mining operation, generating coins with no prior custodial history before entering the network.
"This is by far the biggest Iranian illegal gambling network ever discovered and one of the biggest in the world," said John Wojcik, a former seven-year investigator of illegal gambling for the United Nations Office on Drugs and Crime. Rich Sanders, an independent blockchain investigator focused on Iran, was less circumspect: "It's an IRGC operation, and that's plain as day."
Reuters stated it could not confirm direct IRGC control of Shelbit or the gambling network. That caveat matters legally. It does not change the documented financial flows.
Binance told Reuters that Shelbit never held an account on its platform, that transactions linked to Shelbit were not flagged as high risk, and that once investigators surfaced the connections, it froze relevant accounts and reported them to law enforcement. Binance paid a $4.3 billion settlement with U.S. authorities in 2023 over prior sanctions and AML failures.
The Custodial Layer Is the Vulnerability
Dubai's VARA issued a cease-and-desist and monetary fines against Shelbit General Trading L.L.C. on July 24, 2026, citing operation without a license, KYC failures, money laundering, and terrorism financing. OFAC has signaled it will target Iranian regime-linked digital assets broadly, meaning wallet blacklist expansion is coming.
That is where the OFAC wallet designation precedent becomes directly relevant. OFAC designations attach to wallet addresses, not to exchange accounts. Any custodial platform that processed Shelbit-linked flows, knowingly or not, now carries downstream compliance exposure.
The freeze-and-report response Binance described is the post-facto version of compliance. The $676 million moved before anyone froze anything.
The falsifiable thesis here: custodial exchanges are structurally incapable of being sanctions-neutral in real time. If Binance's on-chain monitoring had detected and blocked Shelbit-linked flows before Reuters investigators surfaced them, and if OFAC had no complaints about the response, that would be evidence compliance actually prevents state-level evasion rather than documenting it afterward. The $676 million figure is the answer.
The IRGC didn't need to crack cryptography. It needed one unlicensed middleman in Dubai with brokerage relationships to compliant platforms. The entire operation ran on custodial counterparty risk: Shelbit brokering for Iran's central bank, Nobitex as the domestic node, Binance as the exit ramp.
Chainalysis data puts the Iranian crypto ecosystem at $7.78 billion in 2025, with IRGC inflows exceeding $3 billion. Shelbit is one node in a system that is operating at scale.
For anyone holding bitcoin on a custodial platform, counterparty risk includes both exchange insolvency and geopolitical dragnet exposure. When OFAC expands its blacklist to cover Shelbit-linked addresses, every platform that touched those flows faces the compliance reckoning, and their users sit behind that wall.
What Comes Next
OFAC's signaled review will likely produce new SDN designations targeting Shelbit-linked wallet addresses and potentially affiliated entities. Any exchange that processed those addresses faces potential secondary liability.
VARA's action against Shelbit establishes a regulatory paper trail Dubai cannot now walk back. Kayvanpour's prior 2023 conviction in Iran and the documented Nobitex connection give U.S. prosecutors a ready-made jurisdictional argument for extraterritorial enforcement. Watch the next Treasury press release.
Sources
- U.S. Treasury / OFAC, Nobitex sanctions press release
- Chainalysis 2026 Crypto Crime Report, Iran ecosystem data
- First reported by Reuters, July 31, 2026
Frequently Asked Questions
Binance says no: Shelbit never held a Binance account, and the flows were not flagged as high risk by its compliance systems. That framing matters. OFAC's liability standard does not require knowledge. It applies to the address, not the account relationship.
When a broker-dealer routes funds through intermediary wallets to a compliant exchange, the exchange may never see a "Shelbit" account. It sees wallet addresses. The question regulators will ask is whether Binance's address-screening caught those wallets in real time. The $676 million figure suggests it did not, which is the exposure.
Yes. OFAC designations apply to specific wallet addresses listed on the SDN (Specially Designated Nationals) list, regardless of which platform those addresses interact with. Once OFAC designates Shelbit-linked addresses, any custodial exchange holding funds in or connected to those addresses is legally required to freeze them and block further transactions.
Platforms that processed flows before the designation are not automatically liable, but they face compliance scrutiny and potential civil penalties if OFAC determines they had reason to know. This is the same mechanism used in the Tornado Cash designations, now operating at state-sponsored scale.
State-linked mining is specifically structured to produce coins with no prior custodial history. A freshly mined bitcoin has no on-chain transaction record connecting it to a sanctioned exchange or flagged wallet. It enters circulation appearing clean.
Routing block subsidy coins through Shelbit before they touch any exchange gives the operation a layer of origin obfuscation that post-hoc blockchain tracing can partially unwind but real-time screening rarely catches. It means the laundry starts at the block subsidy, not at a deposit window.
