US authorities have intensified actions against Iran’s use of digital assets, targeting 30 cryptocurrency addresses tied to individuals associated with the Iranian cyber group Mabna Institute. Blockchain analytics firm TRM Labs reported that these wallets received a combined $16.8 million since 2018, reflecting increased scrutiny of Iran’s digital asset networks as broader sanctions take effect.
Funds tracked across multiple blockchains
The identified addresses spanned Bitcoin, Ethereum, and TRON, and were cited in a US Treasury action announced on August 24. At the point of TRM Labs’ analysis, only $202,662—approximately 1% of the original volume—remained in these wallets, with the majority of funds having already moved elsewhere.
Ten addresses linked to Keyvan Fayaz accounted for $15.5 million of the total, covering activity from January 2018 through August 2026. This concentration led analysts to believe Fayaz may have functioned as a treasury operator for the Mabna network.
By contrast, wallets affiliated with Behzad Mesri displayed more complex patterns, moving funds through multiple layers of addresses before depositing hundreds of thousands of dollars at a major centralized exchange.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLMini dictionary: Mabna Institute, an Iranian cyber organization accused of conducting cyberattacks and intellectual property theft on behalf of Iranian state actors, including the Islamic Revolutionary Guard Corps.
Digital asset transactions linked to Iranian entities show how transparent on-chain analysis may assist in sanctions enforcement, as funds remain traceable even when moved across borders.
Broader US measures and enforcement actions
The designation emerged as part of a campaign by the US Treasury and Department of Justice to increase pressure on Iran’s financial infrastructure. In July, US authorities froze over $130 million in USDT held in four Tron wallets connected to Iran’s central bank. These steps expand recent efforts to disrupt Iran’s access to international finance via cryptocurrency channels.
The Justice Department unveiled a 14-count superseding indictment against 17 Mabna Institute members on August 18, alleging widespread cyber intrusions for Iran’s Islamic Revolutionary Guard Corps and related entities. Prosecutors claimed the Mabna operation targeted 144 US universities, 178 foreign universities, various companies, and governmental organizations, stealing more than 31 terabytes of academic and proprietary information.
Sanctions now cover digital assets sector
Alongside previous sanctions against Iran’s largest crypto exchange Nobitex, the new US Treasury measures designate digital assets as a sanctionable Iranian economic sector, placing the industry alongside technology, gold, aviation, and shipping. While the move does not automatically sanction every company in the digital asset industry, it strengthens the Office of Foreign Assets Control’s authority to act against any Iranian or foreign entity involved in designated activities.
These broader measures reflect Washington’s evolving approach, focusing not just on individual wallets but on the entire ecosystem supporting Iran’s use of cryptocurrencies.
| Category | Action/Amount |
|---|---|
| Crypto addresses sanctioned | 30 |
| Total value tracked | $16.8 million |
| Volume held at analysis | $202,662 |
| Main operator (Keyvan Fayaz) volume | $15.5 million |
| Funds frozen in July (USDT) | $130 million |
