Thirty cryptocurrency addresses linked to members of Iran’s Mabna Institute received about $16.8 million since 2018, according to blockchain intelligence firm TRM Labs, as Washington broadens sanctions against Iran’s digital asset infrastructure.
The addresses, spanning Bitcoin, Ethereum and TRON, were identified in a wider US Treasury action announced on Aug. 24. TRM found that only about $202,662, or roughly 1% of the funds that passed through the wallets, remained at the time of its analysis.
The action follows a broader US effort to restrict Iran-linked crypto activity. In July, authorities froze more than $130 million in USDT held in four Tron wallets linked to Iran’s central bank, adding to a series of recent Iran crypto enforcement actions.
One Defendant Controlled 92% of Crypto Flows
Most of the activity was concentrated in wallets attributed to Keyvan Fayaz. Ten addresses linked to Fayaz received approximately $15.5 million between Jan. 6, 2018 and Aug. 20, 2026, representing 92% of the network’s total on-chain volume.
TRM said the concentration indicates Fayaz may have served as a treasury for the Mabna operation. Wallets connected to Behzad Mesri showed a different pattern, with funds moving through layers of addresses before hundreds of thousands of dollars reached a deposit address at a major centralized exchange.
Such transactions demonstrate why blockchain analytics have become increasingly important in sanctions enforcement. While digital assets can move across borders quickly, transaction histories remain publicly traceable, a characteristic that has shaped the long-running debate over sanctions evasion and cryptocurrency.
Treasury Expands Pressure on Iran’s Crypto Sector
The wallet designations followed a 14-count superseding indictment unsealed by the Justice Department on Aug. 18. Prosecutors charged 17 Mabna Institute members and alleged that the group carried out cyber intrusions on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian entities.
The campaign allegedly targeted 144 US universities, 178 foreign universities, dozens of companies and several government agencies, stealing more than 31 terabytes of academic data and intellectual property.
Washington has increasingly focused on Iran’s broader crypto infrastructure rather than individual wallets alone. The Treasury previously sanctioned Nobitex, Iran’s largest cryptocurrency exchange, while investigations have also highlighted large USDT flows linked to the IRGC.
The Aug. 24 measures go further by naming digital assets as a sanctionable Iranian economic sector alongside technology, gold, aviation and shipping. The designation does not automatically block every company operating in the sector, but it gives OFAC broader authority to target both Iranian and non-Iranian entities involved in relevant activity.
