Listen to this Post
A Crypto Exchange That Barely Looked Like an Exchange
The cryptocurrency industry was built around the promise that digital money could move across borders without relying on traditional banking systems. But the same speed, global reach and programmable infrastructure that make crypto attractive to legitimate businesses can also make it useful to organizations trying to move money outside conventional financial controls.
That tension is once again at the center of international sanctions enforcement.
U.S. authorities have sanctioned Iranian cryptocurrency businesses and individuals accused of facilitating billions of dollars in illicit digital-asset flows. At the heart of the case is Shelbit, an Iran-linked crypto operation that blockchain intelligence firm TRM Labs says processed approximately $6.3 billion between May 2024 and March 2026.
The allegation is particularly striking because investigators say Shelbit did not behave like a conventional crypto exchange. Instead of maintaining significant customer balances, its wallets reportedly received funds and moved them out almost immediately.
That pattern has led TRM Labs to characterize the operation as a settlement conduit rather than a traditional exchange.
The case illustrates a growing reality of modern financial enforcement: authorities are no longer looking only at banks, payment processors and obvious intermediaries. They are increasingly following blockchain transactions across wallets, stablecoins, exchanges, gambling platforms and cross-border payment networks.
U.S. Treasury Moves Against the Network
The U.S. Treasury
A separate Iran-based cryptocurrency exchange, Aban Tether, was also targeted.
According to the allegations, the network was connected to cryptocurrency wallets controlled by the Islamic Revolutionary Guard Corps (IRGC) and other sanctioned entities.
The U.S. Treasury has framed the action as part of a broader effort to disrupt financial infrastructure that allegedly helps Iran circumvent economic restrictions.
Treasury Secretary Scott Bessent said the Iranian
The message is straightforward: sanctions enforcement is expanding beyond traditional financial institutions and into the infrastructure surrounding digital currencies.
The $6.3 Billion Question
The most eye-catching number in the investigation is the estimated $6.3 billion in cryptocurrency flows attributed to Shelbit between May 2024 and March 2026.
That figure should not automatically be interpreted as $6.3 billion in stolen money, terrorist financing or criminal proceeds.
It represents the value of transactions that investigators say passed through the network.
This distinction is important.
A payment intermediary can process billions of dollars without personally owning billions of dollars. In Shelbit’s case, investigators argue that the extremely rapid movement of funds is precisely what made the operation suspicious.
TRM Labs reportedly found that the amounts entering and leaving Shelbit’s wallets matched to within approximately 0.1%.
In other words, very little value appeared to remain inside the wallets.
That is dramatically different from how a normal cryptocurrency exchange would typically operate.
Almost Nothing Stayed Behind
TRM Labs said
Funds would enter the infrastructure and then leave almost immediately.
That creates a distinctive blockchain fingerprint.
Instead of acting like a destination where customers deposit assets and later withdraw them, the operation allegedly functioned more like a financial pipeline.
Money entered.
The system processed or redirected it.
Money exited.
Then the process repeated.
From a blockchain-analysis perspective, this behavior can be extremely valuable because investigators can identify recurring transaction structures even when the organizations behind them attempt to change wallet addresses.
TRON Became the Main Highway
Approximately 88% of the reported activity — around $5.6 billion — moved across the TRON blockchain, according to TRM Labs.
Most of that activity reportedly involved dollar-pegged stablecoins.
This detail is particularly significant because stablecoins can provide something that traditional cryptocurrencies sometimes struggle to deliver: relatively stable dollar-denominated value while retaining the speed and borderless nature of blockchain transfers.
TRM estimated that the average transaction was roughly $54,500.
That suggests a system capable of processing a huge number of meaningful transfers without requiring every transaction to involve a massive single payment.
For compliance teams, the lesson is clear: a network does not need enormous individual transactions to move billions of dollars.
Scale can come from repetition.
The Wallet Rotation Strategy
Investigators also identified another unusual characteristic.
Shelbit reportedly rebuilt or replaced portions of its wallet infrastructure every one to four months during its two years of operation.
That kind of rotation can make attribution more difficult.
A cryptocurrency organization can abandon an old wallet and move to a new one relatively quickly. On the surface, that can create the impression that a new group has entered the ecosystem.
But blockchain analytics can connect these apparently separate wallets through transaction patterns, counterparties, timing and behavioral similarities.
The irony is that
Changing wallet addresses does not necessarily erase the historical relationships between them.
Links to Sanctioned Networks
TRM Labs also reportedly traced approximately $318 million in flows involving A7, a sanctioned Russian payment network.
The investigation further identified exposure to other sanctioned Russian and Central Asian services, including Grinex and Rapira.
That makes the case broader than an alleged Iran-only financial operation.
If the findings are accurate,
This is where blockchain analytics becomes especially important.
Traditional financial investigations can be slowed by national borders, different banking systems and fragmented records.
A public blockchain can provide investigators with a common transaction layer.
The identities may remain hidden, but the movement of value is recorded.
Alleged Hamas Connection
The investigation also identified a more serious alleged connection.
TRM Labs said that in September, Shelbit sent more than $2 million across four transfers in a single day to a cryptocurrency wallet it attributed to Hamas.
This is one of the most consequential allegations in the case because it moves the investigation beyond sanctions evasion and into the territory of suspected terrorist-financing infrastructure.
However, it is important to distinguish between an identified transaction and proof of criminal intent by every person or business connected to the transaction.
Blockchain addresses can be associated with organizations through investigative attribution, but attribution itself is an analytical conclusion that must be evaluated alongside other evidence.
A Gambling Economy Behind the Flows
One of the most surprising elements of the investigation is the alleged connection between Shelbit and a massive Farsi-language online gambling ecosystem.
TRM Labs said
The company reportedly traced approximately $72.6 million in exposure between Shelbit and online gambling services.
Those transactions involved 55 separate gambling platforms.
The largest individual relationship reportedly represented approximately $46.4 million.
This suggests that the crypto infrastructure was not operating in isolation.
Instead, it may have been embedded within a broader digital economy involving betting websites, influencers, cryptocurrency services and cross-border payment networks.
Social Media Influencers Enter the Investigation
TRM Labs also highlighted two Iranian social media personalities, Sasha Sobhani and Pooyan Mokhtari, who publicly promoted gambling websites.
The report described both as prominent figures with large audiences and public displays of wealth.
However, allegations involving individuals should be treated carefully.
According to the supplied report, both men denied wrongdoing.
Sobhani reportedly rejected allegations involving money laundering, sanctions evasion and terrorism financing, saying his involvement was limited to paid advertising.
Mokhtari also denied the allegations and said he had no affiliation with the IRGC.
Both reportedly said they did not know Kayvanpour and were unfamiliar with Shelbit.
Kayvanpour had not responded to requests for comment at the time of the report.
Those denials matter because appearing in an investigative report or being financially connected to a platform does not, by itself, establish criminal liability.
Why Stablecoins Matter So Much
Stablecoins are increasingly becoming central to the global cryptocurrency economy.
Unlike volatile assets such as Bitcoin, dollar-pegged stablecoins attempt to maintain a relatively stable value against the U.S. dollar.
That makes them particularly useful for international settlement.
The same characteristic can also make them attractive for illicit financial networks.
A person attempting to move money across borders may not want exposure to Bitcoin’s price fluctuations.
A stablecoin can provide the speed of cryptocurrency while approximating the accounting stability of dollars.
This is one reason investigators are paying increasingly close attention to stablecoin activity.
The Blockchain Paradox
There is a fascinating contradiction at the center of this case.
Cryptocurrency can make financial transfers easier to obscure from traditional institutions.
But public blockchains can also make transactions extraordinarily difficult to erase.
Every transaction can potentially leave a permanent record.
Investigators do not necessarily need to know
They can begin with a wallet.
Then they can map its counterparties.
Then they can identify recurring patterns.
Then they can connect those patterns to known exchanges, payment services, gambling platforms or sanctioned addresses.
Eventually, what initially looks like a collection of unrelated transactions can become a recognizable financial network.
Why Wallet Rotation Does Not Guarantee Anonymity
The alleged rotation of
Changing addresses is not equivalent to disappearing.
If an organization repeatedly transfers funds between its old and new infrastructure, those transactions can create links between wallet clusters.
Timing can also become an identifier.
So can transaction amounts.
So can recurring counterparties.
So can the order in which funds move.
Modern blockchain analytics can therefore focus less on individual addresses and more on behavioral fingerprints.
The New Era of Financial Intelligence
Cases such as Shelbit demonstrate how financial investigations are changing.
The investigator of the future may spend less time examining paper documents and more time studying transaction graphs.
The central question becomes:
Who is moving the money, where is it going, and what network connects the participants?
Blockchain technology provides the raw data required to answer part of that question.
Artificial intelligence and advanced analytics can then help investigators identify patterns across millions or billions of transactions.
The result is a new form of financial intelligence built around network behavior rather than traditional account statements.
Deep Analysis: How Blockchain Investigators Can Detect a Settlement Conduit
Transaction-Flow Analysis
A settlement conduit often produces a recognizable pattern: money enters a wallet cluster and leaves shortly afterward.
Investigators can calculate the time between incoming and outgoing transactions.
A consistently short holding period can become a risk signal.
Balance Analysis
A conventional exchange or custodial platform may maintain significant asset balances.
A conduit may instead operate with extremely low balances relative to its total throughput.
Analysts can compare:
Total inflows vs. average wallet balance
A very high ratio can indicate that the infrastructure is primarily processing funds rather than holding customer assets.
Flow-Matching Analysis
Investigators can compare inbound and outbound values.
If incoming and outgoing amounts repeatedly match within a narrow tolerance, the system may resemble a pass-through mechanism.
A simplified analytical calculation can look like:
flow_difference = abs(total_inbound - total_outbound)
flow_ratio = flow_difference / total_inbound
if flow_ratio < 0.001: flag_as_possible_settlement_conduit()
The threshold shown above is only an illustrative analytical concept, not an official law-enforcement rule.
Wallet-Cluster Analysis
Investigators can group addresses based on shared behavior.
A conceptual workflow could look like:
Example investigation workflow collect_transactions --entity shelbit cluster_wallets --method behavioral map_counterparties --risk sanctions calculate_flow_velocity generate_network_graph
The purpose is not to “break” blockchain encryption.
The objective is to analyze information that the blockchain already exposes.
Stablecoin Monitoring
Stablecoin transactions deserve special attention because their dollar-denominated value makes them attractive for settlement.
A monitoring system can prioritize:
stablecoin
↓
high-volume wallet
↓
rapid outbound transfers
↓
sanctioned counterparty
↓
cross-border service
↓
high-risk ecosystem
When several risk indicators appear together, the transaction cluster becomes substantially more interesting to investigators.
TRON’s Role
The reported dominance of TRON in
TRON has become an important blockchain for stablecoin transfers, particularly in markets where users prioritize inexpensive and fast transactions.
That does not mean TRON itself is illicit.
The overwhelming majority of blockchain infrastructure can support perfectly legitimate financial activity.
The issue is how individual networks, addresses and services use that infrastructure.
Transaction Velocity as a Signal
Speed can be as informative as volume.
If funds repeatedly enter a wallet and leave within minutes or hours, investigators can identify the wallet’s role as a possible routing point.
A simple conceptual metric is:
Run transaction_velocity = outbound_volume / average_holding_time
Higher velocity does not automatically prove wrongdoing.
But combined with sanctions exposure, wallet rotation and counterparty relationships, it can become a powerful investigative signal.
Network Graphs Reveal the Bigger Picture
A single wallet tells only part of the story.
A graph of hundreds or thousands of wallets can reveal the architecture.
Imagine:
Gambling Platforms
|
v
Shelbit
/
v v
TRON Stablecoins
| |
v v
A7 Other Services
| |
+-+-+
|
v
Sanctioned Ecosystem
The value of this approach is that investigators can study relationships rather than isolated transactions.
Automation Changes the Scale
The volume of cryptocurrency transactions makes manual investigation increasingly impractical.
Modern blockchain intelligence platforms can automatically identify suspicious clusters, trace flows and assign risk scores.
This means regulators can potentially investigate patterns that would have been impossible to analyze manually a decade ago.
The technology is evolving from simple transaction tracing toward continuous network surveillance.
The Limits of Blockchain Analysis
Blockchain analysis is powerful, but it is not magic.
An address does not always reveal the real-world identity of its owner.
Attribution generally requires additional evidence.
Investigators may combine blockchain records with company registrations, exchange data, sanctions lists, domain information, public statements and other intelligence.
The strongest cases therefore emerge when on-chain and off-chain evidence reinforce each other.
What Undercode Say:
1. Crypto Sanctions Are Becoming More Sophisticated
The Shelbit case demonstrates that sanctions enforcement is moving deeper into the digital-asset ecosystem.
- The Exchange Label May Mean Very Little
An organization can call itself an exchange while functioning primarily as a payment or settlement intermediary.
- Throughput Can Be More Important Than Holdings
A wallet holding little money can still facilitate billions of dollars in annual transaction volume.
4. Stablecoins Are Now Financial Infrastructure
Dollar-pegged tokens are no longer a niche crypto product.
They are increasingly being used as global settlement instruments.
5.
The reported $5.6 billion flowing through TRON illustrates how significant the network can become for high-volume stablecoin transfers.
6. Blockchain Transparency Creates a Double-Edged Sword
The same technology that allows rapid cross-border transfers also creates permanent transaction records.
- Wallet Rotation Is Not a Perfect Escape
Replacing addresses every few months may complicate investigations, but it does not necessarily break transaction relationships.
8. Behavioral Patterns Are Becoming Identifiers
A wallet can potentially be recognized by how it behaves, not simply by its address.
9. Timing Matters
Rapid movement of funds can reveal the operational purpose of a wallet.
10. Matching Inflows and Outflows Is Significant
When incoming and outgoing values consistently mirror each other, investigators may suspect settlement activity.
11. Sanctions Enforcement Is Becoming Network-Based
Authorities are increasingly targeting entire ecosystems rather than isolated companies.
- Iran Is Not the Only Jurisdiction in the Picture
The reported exposure to Russian and Central Asian services demonstrates how international these networks can become.
13. Cryptocurrency Has Become Borderless Financial Plumbing
Digital assets can connect markets that traditional banking systems struggle to connect.
14. That Connectivity Has Advantages
Legitimate businesses can use the same infrastructure for faster international payments.
15. But It Creates New Compliance Challenges
Regulators must distinguish legitimate global finance from illicit financial networks.
16. Gambling Adds Another Layer of Complexity
Online betting platforms can generate enormous transaction volumes and complicated payment relationships.
17. Influencer Marketing Can Obscure Financial Relationships
Advertising a platform does not necessarily establish knowledge of its financial infrastructure.
- Allegations Must Be Separated From Proven Facts
This is particularly important when individuals are named in investigative reports.
19. Blockchain Evidence Can Be Extremely Detailed
Investigators can reconstruct transaction histories down to individual transfers.
20. But Attribution Still Requires Context
A blockchain address does not automatically identify the person controlling it.
- The $6.3 Billion Figure Needs Careful Interpretation
It describes reported transaction flows, not necessarily $6.3 billion of criminal proceeds.
- Volume Alone Is Not Proof of Criminality
Large transaction volume can also occur in legitimate payment businesses.
23. Context Makes the Difference
Sanctions exposure, counterparties, transaction velocity and wallet behavior collectively create a stronger picture.
24. Stablecoin Compliance Will Become More Important
As stablecoin adoption increases, regulators will pay greater attention to the networks surrounding them.
25. Exchanges Face Increasing Pressure
Crypto platforms will need stronger screening and transaction-monitoring systems.
26. Regulators Are Learning Faster
Every major investigation gives authorities more information about how illicit networks operate.
27. Criminal Networks Are Learning Too
The relationship between investigators and financial criminals is becoming an arms race.
28. Privacy Techniques Will Continue Evolving
Wallet rotation is only one method.
Future networks may use increasingly sophisticated obfuscation techniques.
29. Analytics Will Also Improve
Machine learning can help identify patterns that humans might miss.
30. AI Could Transform Blockchain Investigations
AI systems can analyze transaction graphs at enormous scale.
- False Positives Will Become a Major Concern
More aggressive automated detection can also flag legitimate users.
32. Compliance Systems Must Balance Both Risks
Blocking every unusual transaction would damage legitimate financial activity.
- The Strongest Systems Will Combine Automation With Humans
Algorithms can discover patterns.
Investigators can interpret them.
- Public Blockchains May Become More Important to Governments
Their transparency offers an unusual investigative advantage.
- Traditional Banking Is No Longer the Only Financial Battlefield
Crypto exchanges, wallets, stablecoins and payment protocols are now part of geopolitical finance.
36. Sanctions Evasion Is Becoming Technological
Financial restrictions increasingly collide with software infrastructure.
- The Definition of a Financial Institution Is Changing
A wallet network can sometimes perform functions once associated with banks and payment processors.
38. Enforcement Will Likely Expand
The Shelbit case suggests that crypto infrastructure connected to sanctioned economies will remain under intense scrutiny.
39. Transparency Will Become a Competitive Advantage
Legitimate cryptocurrency companies that can demonstrate clean transaction histories may gain greater trust.
- The Bigger Story Is Not Just About Shelbit
It is about the transformation of cryptocurrency from an alternative financial experiment into a major component of global financial infrastructure.
✅ The U.S. Sanctions Action
The supplied
The broader role of OFAC in administering U.S. sanctions is well established, although the specific Shelbit designation should always be checked against the official sanctions record when publishing the article.
✅ The $6.3 Billion Transaction Figure
The approximately $6.3 billion figure is attributed to TRM Labs’ blockchain analysis.
It should be described as transaction volume or blockchain flows associated with Shelbit rather than automatically labeling the entire amount as illicit proceeds.
✅ The 88% TRON Figure
The article correctly attributes the reported concentration of activity to TRM Labs.
The approximately 88% / $5.6 billion figure describes the reported blockchain activity, primarily involving dollar-pegged stablecoins.
✅ The Wallet Rotation Claim
The claim that Shelbit repeatedly rebuilt its wallet infrastructure comes from TRM Labs’ analysis.
That behavior can be consistent with attempts to complicate tracing, but wallet rotation alone does not prove criminal intent.
⚠️ The Hamas Connection Requires Attribution
The alleged transfers to a Hamas-controlled wallet are serious, but the article should preserve the wording that this was TRM Labs’ attribution.
A blockchain transaction can demonstrate movement of funds; establishing the identities, purpose and intent behind those transfers requires additional evidence.
⚠️ Gambling and Influencer Allegations Require Care
The reported relationships between Shelbit, gambling services and named influencers should remain clearly attributed to TRM Labs.
The individuals mentioned in the report reportedly denied wrongdoing, so presenting the allegations as established criminal facts would go beyond the evidence described in the source.
Prediction
(+1) Blockchain Analytics Will Become a Core Weapon Against Sanctions Evasion
The most likely long-term outcome is that governments will increasingly treat blockchain analytics as an essential component of financial intelligence.
As stablecoins and other digital assets become more deeply integrated into international payments, investigators will have more data to analyze.
Future sanctions investigations are likely to combine blockchain graphs with artificial intelligence, exchange records, corporate registries, domain intelligence and traditional financial information.
The result could be a much more automated financial surveillance ecosystem capable of identifying suspicious networks before they reach the scale associated with the Shelbit case.
(+1) Stablecoin Compliance Will Become More Aggressive
Stablecoin issuers, exchanges and payment companies are likely to face greater pressure to identify suspicious counterparties and freeze assets associated with sanctioned entities.
This could ultimately make legitimate stablecoin infrastructure more trusted by banks and institutional investors.
(+1) Wallet Behavior Will Become a Digital Fingerprint
Even when organizations repeatedly change addresses, their transaction patterns may remain recognizable.
Future blockchain intelligence systems could identify networks through timing, transaction size, counterparties and movement patterns rather than relying primarily on known wallet addresses.
(-1) Criminal Networks Will Adapt
The opposing trend is equally important.
As blockchain surveillance becomes more powerful, illicit financial networks are likely to experiment with more complicated routing, cross-chain transfers, decentralized services and other obfuscation techniques.
That means the battle will not end with one sanctions action.
It will evolve into a continuous technological contest between financial investigators and organizations attempting to bypass them.
The Bigger Warning for the Crypto Industry
The Shelbit investigation sends a message that extends far beyond Iran.
The cryptocurrency ecosystem is no longer operating outside the traditional financial system’s field of vision.
Governments now have sophisticated tools capable of following digital money across blockchains, exchanges, wallets and payment networks.
For legitimate crypto businesses, this creates both a challenge and an opportunity.
The challenge is obvious: compliance requirements will become more demanding.
The opportunity is equally significant: companies capable of proving that their infrastructure is transparent, traceable and resistant to abuse may gain an advantage as institutional adoption grows.
The fundamental lesson is that blockchain does not make money invisible.
It changes how money can be followed.
And in an era when billions of dollars can cross borders without passing through a conventional bank, that distinction may become one of the most important developments in global financial security.
trmlabs.com
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
