Iran’s sanctioned crypto exchangers: $483M in stablecoins, and every dollar of it went into Binance and OKX

On 7 August 2026 OFAC, the Treasury’s sanctions office, announced action against crypto exchanges that, in its words, fund the Islamic Revolutionary Guard Corps. Among those designated are Siavash Kayvanpour, whom the Treasury describes as the organiser of a network of front companies; Crypto Home DMCC, a company in Dubai; and Shelbit, an exchange registered in Georgia. Their entries carry addresses on Bitcoin, Ethereum, Tron and other chains.

Who the addresses belong to is OFAC’s statement, not ours. Below is what they did on chain. We count only real USDT and USDC — the Ethereum addresses are also littered with look-alike tokens sent by scammers, which we excluded by checking the token contract.

Kayvanpour, 2019 – March 2022. His Tron address, TPgxjjB6AJeMSQFngbUM6dMMxPHa9GEtYa, received 75.37 million USDT from 67 senders and paid out to exactly two addresses, both labelled as Binance’s. His Ethereum address, 0x8d79c73dAae8630C88De372ba8f57592FA987607, received 15.51 million USDT and paid out to two addresses, both Binance’s. Together 90.9 million, almost all of it in 2021.

Crypto Home DMCC, April 2022 – February 2025. The Tron address, TTVJuXWCusAURrpNShiypauagEH1N4CrxV, received 99.37 million USDT and forwarded all of it to two Binance wallets. The Ethereum address, 0xBb69e01921b17cD22080968bcc96Ba6115Da6062, received 240.72 million in USDT and USDC from 71 senders and forwarded all of it to a single Binance wallet. Together 340.1 million. One sender alone accounts for 154.4 million. The same address also passed 1,280 ETH to Binance.

Shelbit, December 2025 – March 2026. The Tron address, TXN3hVukebhyYR31YPCYd7aJAvmUeXu1ab, received 10.01 million USDT and forwarded it to one wallet labelled as OKX’s. The Ethereum address, 0xe05F529f5284D75624eBa386CB716928c3b54A2A, received 41.72 million and forwarded it to two OKX wallets. Together 51.7 million in three months.

The three took over from one another: the first stops in March 2022, the second starts in April 2022 and stops in early 2025, the third starts in December 2025. The exchange changes from Binance to OKX with the third.

A wallet that someone controls pays many people: suppliers, other wallets, other services. These six addresses, across seven years and 482.7 million dollars, paid only the main wallets of one exchange each, always the full amount. That is what happens when an exchange gives a customer an address to pay into: money arrives, and the exchange sweeps it into its own wallets. The customer never holds a key.

We cannot see inside Binance or OKX, so we put it as what the chain shows rather than as a confirmed fact. But it is hard to read it any other way, and it changes what the listing means. Sanctioning a deposit address and blacklisting it at Tether freezes nothing — the three Tron addresses held exactly zero when Tether blacklisted them at 21:47–21:48 UTC on 7 August. The money was credited to accounts, and what matters is those accounts: who opened them, what they did with the balance, and when the exchange learned whose they were.

It also means the trail is not lost. There is an account record behind each of these addresses. That does not show the exchanges did anything wrong — Kayvanpour’s addresses went quiet in 2022 and Crypto Home’s in February 2025, long before this designation. It shows where the answers are.

The same entries list five Bitcoin addresses. They are empty too. Over their lifetime they received about 12.3 BTC (Kayvanpour), 515.1 BTC (Crypto Home) and 161.2 BTC (Shelbit). We have not traced where that went and make no claim about it here.

This is the third sanctions case we have read this week in which the listed addresses turned out to be empty and the money had long since moved. The seven Hamas-linked wallets held 28 dollars when they were listed. The seven Tren de Aragua addresses held 20, and they too paid only into Binance. The exception was ISIS-K and Iran’s central bank, where the wallets were still in use and hundreds of millions were caught.

In our database the listed addresses carry the sanctions label from OFAC’s list, and an address that paid into them shows that link as its risk. We did not mark the exchanges’ own wallets. You can check any address on the address check page.

It does not say who owns any address beyond repeating OFAC’s attribution. It does not say the senders knew whom they were paying, or that Binance or OKX knew whose accounts these were or broke any rule. It covers USDT and USDC on Tron and Ethereum; one further Ethereum address in Shelbit’s entry handled 10,000 USDT and is not in the totals, and the addresses on other chains are outside it. Exchange names refer to wallets labelled as the exchanges’ own in our database.