OFAC sanctions Shelbit and other entities associated with Iranian regimeOFAC sanctions Shelbit and other entities associated with Iranian regime

On Friday, August 7, the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned Shelbit as well as its operator, Siavash Kayvanpour, and a number of other businesses he operates. In addition, OFAC sanctioned a second exchange, Iran-based Aban Tether. 

In the accompanying press release, OFAC highlighted that Friday’s actions were designed to move against “digital asset exchanges that the Iranian regime relies on to launder billions of dollars, maintain covert access to international financial systems, and support the Islamic Revolutionary Guard Corps (IRGC), among other terrorist groups.”

Elliptic’s analysis of Shelbit identified tens of millions of dollars of funds flowing between Shelbit and Iranian entities, including the Central Bank of Iran and IRGC-associated entities. 

While operating between 2024 and February 2026, Shelbit presented itself as a conventional cryptoasset exchange. Despite Shelbit’s corporate ties to Poland and Georgia, and its LinkedIn claiming a headquarters in Tbilisi, Georgia, it appears that Shelbit operated from Dubai.

Between July 2024 and February 2026, Shelbit processed billions of dollars worth of cryptoassets, with much of its inflows occurring between July 2025 and January 2026. Despite some initial online engagement driven by promotions, Shelbit never appeared to develop an online community to match those volumes. Shelbit ceased public operations around February 2026. There was no formal closure announcement. Rather, its website went offline and its social media accounts went dormant. Elliptic did not identify any public complaints from genuine users who were unable to access their funds as a result of the shutdown.

Shelbit's wallets appear to be a convergence point for Iran regime-linked funds. In particular, significant amounts of funds linked to the Central Bank of Iran arrive at Shelbit. Elliptic also identified direct interactions with addresses belonging to the IRGC and an IRGC-linked OFAC-sanctioned individual. Some of this activity is detailed below.  

Earlier this year, Elliptic published research documenting the Central Bank of Iran’s acquisition of at least $507 million worth of USDT. Prior to June 2025, the acquired USDT was predominantly sent to Iran’s largest cryptoasset exchange, Nobitex. However, the flow of funds changed significantly at this point, a pivot that coincided with a security breach at Nobitex which was attributed to pro-Israel group Gonjeshke Darande ("Predatory Sparrow").

After June 2025, the Central Bank of Iran’s funds were handled in a more convoluted way. Portions of the USDT were bridged across multiple chains, with around $71.8M worth of these particular funds later deposited into Shelbit.

The multi-stage route taken by a portion of the Central Bank of Iran funds.

In the press release accompanying Friday’s sanctions, OFAC stated “digital currency addresses belonging to the IRGC have sent the equivalent of over $1 million in digital assets to Shelbit Exchange digital currency addresses. More than the equivalent of $2 million has also been transferred from Shelbit Exchange addresses to IRGC digital currency addresses.” 

Elliptic’s analysis has identified that IRGC-attributed addresses have sent around $1.68M worth of funds to several Shelbit deposit addresses. Funds have also moved in the other direction: $2.3M has been withdrawn directly from Shelbit to IRGC-attributed addresses.

IRGC-attributed address interacting with Shelbit (deposits and withdrawals)

Alireza Derakhshan is an Iranian national sanctioned by the US (OFAC). OFAC's designation stated that Derakhshan has used a network of front companies to transfer cryptoassets in support of the IRGC's operations. 

In September 2025, a Tron address that OFAC associated with Derakhshan deposited to Shelbit, shown below. 

Sanctioned Individual, Alireza Derakhshan, sending funds to Shelbit.

OFAC's designation of Aban Tether did not include any cryptoasset addresses. Elliptic had, however, already identified and labeled addresses connected to the exchange which have now been recategorized as sanctioned, meaning customers can screen for exposure even in the absence of published addresses. The same is true of Shelbit: whilst OFAC did include several addresses associated with Shelbit during Friday’s designation, the activity described above was already attributed to the exchange in Elliptic’s products. 

We have updated our monitoring and investigative solutions to reflect Friday’s designations. If you would like to discuss the implications of today's designations for your business, or how Elliptic's data and solutions can support your compliance and investigations work, please get in touch with our team.