Treasury's press release put the number at $1 million in and $2 million out—IRGC-linked wallets sending crypto to Shelbit, Shelbit sending it back.
A week earlier, Reuters had traced $4 billion through the same exchange.
That gap is the entire story. The provable, court-ready flow OFAC cited in its August 7 designation is a rounding error against what investigators believe actually moved—by the author's own calculation, less than a tenth of a percent.
The provable, court-ready flow OFAC cited is a rounding error against what investigators believe actually moved—less than a tenth of a percent.
This may not be a case of the government overstating its evidence, but arguably the opposite. OFAC appears to have named the smallest, cleanest, most defensible number it could stand behind in a legal document, and left the $4 billion to the journalists and the analytics firms.
Which tells you something precise about how sanctions enforcement works on-chain now: attribution has gotten cheap, and provability for a specific designation is a narrow subset of what everyone can already see.
Chainalysis made that explicit within hours. It published a Reactor graph showing both Shelbit and Aban Tether receiving funds from IRGC-linked wallets, noted it had already labeled the entities in its products, and told customers they could screen for exposure immediately.
The forensics appeared to be done before the ink dried. The wallets are tagged, the flows are mapped, the counterparties—Nobitex, Wallex, Bitpin, Ramzinex—are named. Nobitex alone processed more than half of all Iranian crypto inflows in 2025, per OFAC.
None of that is the hard part anymore. The hard part is stopping the money before it clears.
And on that count, the Shelbit file reads less like a story about crypto enabling evasion and more like a story about a licensed hub jurisdiction that couldn't—or wouldn't—enforce.
Dubai's Virtual Assets Regulatory Authority fined Shelbit General Trading in January 2025 for operating without a license. That was the moment the system was supposed to work: identify the unlicensed operator, penalize it, shut it down.
Shelbit kept operating.
Reuters found that roughly $540 million moved from Shelbit-linked wallets to Binance after that January fine—part of at least $676 million to Binance across the two-year window. VARA issued a second enforcement action in July and ordered the exchange to halt.
So the timeline is not "crypto let Iran evade detection." The timeline is: a regulator in a jurisdiction that markets itself as the compliant, licensed home for digital assets fined an exchange, watched it move over half a billion dollars anyway, and reportedly needed a second try more than eighteen months later to order it closed.
Binance, for its part, told The Block that Shelbit held no account on its platform, disputed the $540 million figure, and said accounts tied to Shelbit users had already been frozen and reported. Take that at face value and the picture barely improves: the funds still routed through the world's largest exchange before anyone caught them.
The point isn't that any single party failed maliciously. It's that the chokepoint that matters—the fiat-and-jurisdiction seam where crypto touches the regulated financial system—is exactly where enforcement remains slow, contested, and jurisdictionally fractured.
This is the contradiction the maximum-pressure campaign can't resolve. Attribution is now nearly instantaneous and nearly free. Enforcement at the point of exit is still expensive, political, and dependent on a regulator in another country actually pulling the plug.
Bessent framed the campaign as omnidirectional: "Whether in dollars, rials, or crypto, Treasury will hunt down and dismantle the illicit financial networks that keep the regime afloat." The on-chain half of that promise is real. The dollar-and-jurisdiction half is where it keeps arriving late.
Look at what Shelbit was actually plumbing. Reuters tied it to $125 million-plus from Iran's central bank and $20 million-plus from suspected Iranian crypto mining operations since 2024. OFAC added a network of more than 2,000 gambling websites, promoted by a pair of Iranian influencers, laundering tens of millions—money that, per Chainalysis, circled back to the IRGC through the Central Bank of Iran's regulated payments system, with the count of websites and influencers reported by The Block.
That is a full-stack sanctions-evasion machine: state actor, mining revenue, illicit consumer volume, and a friendly offshore exchange stitching them to the global dollar system.
Kayvanpour ran it from the UAE and Georgia, with entities in Poland, holding citizenship in Dominica and Afghanistan. The structure was built to be jurisdictionally slippery. It worked.
Now consider the asymmetry facing every compliant exchange under NSPM-2, the authority OFAC cited for the action. Secondary-sanctions exposure is genuine: keep dealing with an SDN-listed entity and a foreign firm risks being cut off from the U.S. financial system entirely. That is the real teeth.
But the teeth bite after the designation. And the designation comes after Chainalysis has labeled the wallets, which comes after the $4 billion has already moved.
For a legitimate exchange, this means the compliance burden is now near-total and near-continuous—screen every counterparty, monitor for the labels, freeze on contact. The tooling exists to do it. Binance's own account of freezing Shelbit-linked users suggests the mechanism functions when an exchange chooses to run it hard.
For an exchange courting illicit-adjacent volume, the same asymmetry is an opportunity. As long as one hub jurisdiction tolerates unlicensed operators to build its ambitions—fines them, waits, fines them again—the money finds the seam. Attribution catches it eventually. Eventually is the whole margin.
That is why Dubai is the weak link in this specific chain, and why the Shelbit designation is more indictment of VARA's follow-through than of blockchain permissionlessness. The chain did its job: it left a public, traceable, forensically clean record that let Reuters and Chainalysis reconstruct $4 billion in flows. The permissioned regulator was the one that let a fined entity keep running.
The takeaway for anyone operating an exchange or holding USDT-denominated exposure is unglamorous but binding. Screening is no longer optional and no longer hard—the labels arrive fast and the secondary-sanctions risk is real enough to end a business.
But designations will keep landing after the money clears, because the constraint was never seeing the flow. It was closing the door in a jurisdiction that had every reason to keep it propped open.
Until the hub jurisdictions enforce their own licenses on the first fine rather than the second, on-chain forensics will keep producing beautiful, timestamped maps of exactly where the money went—maps drawn once it's already gone.