TRM Labs Traces $16.8 Million Across 30 Sanctioned Iran-Linked Crypto Wallets

Roughly $16.8 million flowed into 30 cryptocurrency addresses tied to members of Iran’s Mabna Institute, according to blockchain intelligence firm TRM Labs.

The US Treasury listed those addresses as part of a wider action against Iran. One defendant’s wallets received 92% of that total.

Iran’s Mabna Institute Wallets Took In $16.8M, TRM Labs Says

The designated addresses span Bitcoin (BTC), Ethereum (ETH), and TRON (TRX). They belong to four of the 17 defendants also named in a superseding indictment unsealed by the Department of Justice (DOJ). Activity on the wallets dates back to January 2018.

According to TRM, Keyvan Fayaz controlled 10 of the addresses. Those wallets received a combined $15.5 million between January 6, 2018, and August 20, 2026. That figure represents 92% of the network’s total on-chain volume.

TRM said the concentration suggests Fayaz may have functioned as a treasury for the operation. Addresses belonging to Behzad Mesri, separately accused of breaching HBO, show layered transfers between his own wallets. Hundreds of thousands of dollars eventually reached a deposit address at a large centralized exchange.

However, little value remains. TRM puts the combined residual balance across all 30 addresses at $202,662, or roughly 1% of what passed through them.

Follow us on X to get the latest news as it happens

Treasury Targets Iran’s Digital Assets Sector

Meanwhile, the DOJ unsealed a 14-count superseding indictment on August 18. Prosecutors allege the Mabna Institute, an Iran-based company, ran cyber intrusions since at least 2013 for the Islamic Revolutionary Guard Corps (IRGC), targeting 144 US universities and 178 foreign ones.

Furthermore, the Office of Foreign Assets Control (OFAC) designated nearly 60 Iran-linked targets on Monday. This follows earlier designations of Iranian platforms, including Shelbit earlier this month.

“We are launching an economic onslaught against Iran’s financial connections around the globe. Our objective is to sever every economic lifeline that sustains this tyrannical regime until Tehran stands alone,” Secretary of the Treasury Scott Bessent said.

Treasury also issued five sectoral determinations under Executive Order 13902 covering digital assets, technology, gold, aviation, and shipping. 

The determination reaches beyond the listed addresses. Under Executive Order 13902, OFAC can now designate persons operating in Iran’s digital assets sector, and the authority also covers non-Iranian persons. It does not automatically block every firm active in the sector.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights