What to Know

  • Dubai-based Shelbit is described by investigators as an unlicensed crypto exchange at the center of an alleged $4 billion Iranian sanctions-evasion network.
  • The operation is alleged to have connected an illegal gambling network, Iran’s central bank and other sanctioned Iranian entities to global crypto markets.
  • The gambling network is described as one of the world’s largest, with more than 2,000 platforms.
  • Shelbit is run by Iranian expatriate Siavash Kayvanpour, according to the findings cited by investigators.
  • Investigators say Shelbit moved hundreds of millions of dollars to major crypto companies, including Binance.
  • Binance said Shelbit never held an account on its platform and that transactions linked to Shelbit were not considered high risk.
  • Binance also said it investigated users associated with Shelbit, froze relevant accounts and reported them to law enforcement.
  • U.S. and independent investigators say the operation appears closely tied to Iran’s Islamic Revolutionary Guard Corps, though direct IRGC control over Shelbit or the gambling network has not been confirmed.
  • The Central Bank of Iran has been sanctioned under U.S. counterterrorism authorities since 2019 over support for the IRGC, its Quds Force and Hezbollah.
  • The case highlights how crypto rails can be used by high-risk actors to seek access to global liquidity, even when major exchanges maintain compliance controls.

Dubai Exchange Faces Questions Over Alleged Iran-Linked Crypto Flows

A Dubai-based crypto exchange called Shelbit is facing intense scrutiny after investigators linked it to an alleged $4 billion Iranian sanctions-evasion network. The case centers on claims that Shelbit helped move cryptocurrency for a sprawling illegal gambling network while also providing access to global crypto markets for Iran’s central bank and other sanctioned Iranian entities.

The allegations place Shelbit at the intersection of several pressure points in digital finance: offshore exchange activity, sanctions enforcement, illegal gambling, Iranian state-linked entities and the movement of funds through large global trading platforms. For the crypto industry, the episode is another reminder that blockchain transparency can expose complex money flows, but it also shows how sanctioned or high-risk networks may attempt to use layers of intermediaries to reach liquid markets.

Investigators describe Shelbit as an unlicensed exchange run by Iranian expatriate Siavash Kayvanpour. The platform is alleged to have served as a hub for a major Iranian money-moving operation, with funds connected to gambling sites and sanctioned Iranian actors entering broader crypto channels. While the scale of the alleged network is large, the exact nature of control and direction remains contested in key areas, especially around the role of Iran’s Islamic Revolutionary Guard Corps.

Illegal Gambling Network Allegedly Used Shelbit as a Crypto Gateway

The illegal gambling network tied to the case is described as vast, with more than 2,000 platforms. Investigators characterized it as a major customer of Shelbit, sending millions of dollars’ worth of cryptocurrency through the exchange. The network is also described as one of the largest of its kind, underscoring the scale of the alleged activity moving through crypto channels.

Illegal gambling networks often rely on fast settlement, pseudonymous wallets and cross-border transfer capability, all of which can make crypto attractive for operators trying to avoid conventional banking oversight. In this case, the key concern is not merely gambling activity, but the alleged convergence of gambling-related proceeds with a sanctions-evasion structure connected to Iranian entities.

John Wojcik, a former researcher at Infoblox and now senior analyst at TRM Labs, described the network as by far the biggest Iranian illegal gambling network ever discovered and one of the biggest in the world. His background includes seven years investigating illegal gambling for the United Nations Office on Drugs and Crime, giving additional weight to the assessment among compliance professionals and blockchain investigators following the case.

Sanctioned Iranian Entities Allegedly Reached Global Crypto Markets

Shelbit is alleged to have provided access to global crypto markets for Iran’s central bank and other sanctioned Iranian entities. The Central Bank of Iran has been sanctioned under U.S. counterterrorism authorities since 2019 over support for the Islamic Revolutionary Guard Corps, its Quds Force and Hezbollah. That sanctions status makes any alleged pathway to global crypto liquidity a serious compliance concern for exchanges, brokers, payment firms and stablecoin issuers.

Investigators also say Shelbit interacted directly with Iran’s central bank, wallets linked to the IRGC by the Israeli government, and Nobitex, an Iranian exchange that the U.S. government sanctioned earlier this year after investigative findings revealed its ties to the government. These alleged links place Shelbit within a broader ecosystem of Iranian digital-asset activity that has already drawn attention from sanctions authorities.

Some of the crypto flowing to Shelbit was described by investigative firms as coming from an Iranian bitcoin mining operation that creates new digital coins. Mining-linked flows can be difficult for compliance teams to evaluate because newly generated coins may not carry the same transaction history as assets that have passed through known illicit wallets. However, when mining proceeds are connected to sanctioned jurisdictions or state-linked entities, they can still create significant legal and reputational risk for service providers handling them.

Binance Says Shelbit Did Not Hold an Account

Investigators say Shelbit moved hundreds of millions of dollars to some of the most prominent crypto companies, including Binance, the world’s largest exchange. Binance said Shelbit never held an account on its platform and that transactions linked to Shelbit were not considered high risk. The exchange also said it investigated users associated with Shelbit, froze relevant accounts and reported them to law enforcement.

That distinction matters because blockchain flows can reach an exchange through many routes. A named entity may not maintain a direct account, but funds associated with that entity can still arrive through wallets, intermediaries, customers or nested structures. For compliance teams, the challenge is identifying whether a transaction is directly controlled by a sanctioned entity, indirectly linked to one, or merely part of a broader pattern that requires enhanced review.

Major crypto exchanges are under pressure to detect sanctioned flows while avoiding false positives that could disrupt legitimate users. The Shelbit case shows why that balance is difficult. Blockchain analytics can cluster wallets and identify exposure, but ownership attribution, beneficial control and intent can remain uncertain. That uncertainty is especially important when investigators identify alleged proximity to state-linked networks but direct control has not been established.

U.S. and independent investigators say the operation appears closely tied to Iran’s Islamic Revolutionary Guard Corps. The IRGC, founded in 1979, is Iran’s most powerful and influential military, political and economic institution. It plays a major role in the country’s security and economic structures, which is why alleged financial links to the organization attract heightened scrutiny from sanctions authorities and blockchain investigators.

Independent blockchain researcher Rich Sanders, who focuses on Iran, described Shelbit as an IRGC operation. However, direct IRGC control over Shelbit or the gambling network has not been confirmed. That distinction is important for market participants because a suspected connection and a legally established control relationship can carry different implications for enforcement, compliance treatment and public reporting.

Even without confirmed direct control, alleged interaction with wallets linked to the IRGC by the Israeli government, along with alleged dealings involving Iran’s central bank and Nobitex, creates a risk profile that compliance professionals are likely to view as severe. For crypto businesses, the case reinforces the need to monitor not only sanctioned names, but also counterparties, wallet clusters, regional exchange corridors and repeat exposure to high-risk services.

The alleged Shelbit network is being described as one of the largest Iranian sanctions-evasion networks discovered since 2016, when the U.S. broke up a roughly $20 billion IRGC gold-for-oil operation based in Turkey. The comparison highlights the scale of the alleged crypto operation, even though the asset class and transaction methods differ from earlier commodity-based evasion schemes.

The case also follows a separate U.S. seizure of $1 billion in crypto from Iran in May. Together, these developments show that digital assets have become a recurring focus in sanctions enforcement involving Iran. Crypto does not remove the need for counterparties, liquidity venues and conversion routes, but it can allow value to move quickly across borders before enforcement agencies or private compliance teams identify the full network.

For regulators and law enforcement, blockchain records can be a powerful investigative tool because transactions remain visible after the fact. For illicit networks, that permanence creates exposure. Yet the same transparency does not automatically prevent funds from moving in real time, particularly when transactions pass through multiple wallets, exchanges and services before suspicious patterns are fully understood.

What the Case Means for Crypto Compliance

The Shelbit allegations arrive as the crypto sector continues to face pressure to strengthen sanctions screening, customer due diligence and blockchain monitoring. Large exchanges, stablecoin issuers and infrastructure providers are expected to identify exposure to sanctioned entities, but sophisticated networks may use indirect routes, third-party accounts or platforms outside major regulatory centers.

Market participants are likely to focus on whether additional wallet clusters are identified, whether more exchanges disclose exposure, and whether enforcement agencies bring new actions tied to the alleged network. The case may also increase scrutiny of Dubai-based crypto services, illegal gambling payment flows and Iranian exchange corridors, particularly where unlicensed platforms appear to connect local or regional activity with global liquidity.

For the broader market, the immediate issue is not price direction for major digital assets, but trust in market infrastructure. Crypto adoption by institutions depends heavily on the ability of exchanges and service providers to prove they can detect and stop prohibited flows. High-profile sanctions-evasion allegations can raise concerns among banks, regulators and investors, especially when funds are said to have reached major global platforms.

At the same time, the case demonstrates why blockchain analytics have become central to financial crime investigations. Investigators can trace flows across wallets, identify exchange touchpoints and map relationships between services. The continuing challenge is converting transaction data into legally reliable conclusions about ownership, control and intent, particularly when networks span multiple jurisdictions and involve both sanctioned and non-sanctioned actors.

Why This Matters for the Digital Asset Industry

The allegations against Shelbit underscore a recurring tension in crypto markets. Digital assets can make payments faster and more open, but that same openness can be exploited by actors seeking to bypass traditional financial restrictions. When high-risk networks use unlicensed exchanges and then interact with global platforms, compliance responsibility can extend across the ecosystem.

FXCOINZ views the case as a significant development for crypto market oversight because it connects several enforcement priorities at once: sanctions evasion, illegal gambling, state-linked finance and exchange compliance. The outcome may shape how regulators assess indirect exposure, how exchanges classify risk tied to intermediary wallets, and how blockchain analytics firms support investigations involving sanctioned jurisdictions.

The key unresolved question is whether authorities can establish direct control links between Shelbit, the gambling network and the IRGC. Until that question is answered, the public record supports a cautious framing: investigators say the operation appears closely tied to the IRGC, while direct IRGC control has not been confirmed. That uncertainty does not reduce the seriousness of the allegations, but it does define the current state of the evidence.

For crypto businesses, the lesson is clear. Sanctions risk is not limited to accounts opened under a prohibited name. It can emerge through wallet exposure, nested services, mining-linked inflows, gambling proceeds and regional exchanges that act as gateways to larger platforms. As enforcement scrutiny deepens, firms that rely on global liquidity will be expected to demonstrate that they can identify these risks before they become systemic problems.

Frequently Asked Questions (FAQs)

What is Shelbit?

Shelbit is described by investigators as a Dubai-based, unlicensed crypto exchange run by Iranian expatriate Siavash Kayvanpour. It is alleged to have served as a hub in a $4 billion Iranian sanctions-evasion network.

How much money is Shelbit alleged to have moved?

Investigators link Shelbit to an alleged $4 billion sanctions-evasion operation. They also say Shelbit moved hundreds of millions of dollars to major crypto companies, including Binance.

What role did illegal gambling platforms allegedly play?

A major illegal gambling network with more than 2,000 platforms is described as a key Shelbit customer. The network allegedly sent millions of dollars’ worth of cryptocurrency through Shelbit.

Was Binance directly hosting Shelbit?

Binance said Shelbit never held an account on its platform. It also said transactions linked to Shelbit were not considered high risk, and that it investigated associated users, froze relevant accounts and reported them to law enforcement.

Is the IRGC confirmed to control Shelbit?

Direct IRGC control over Shelbit or the gambling network has not been confirmed. U.S. and independent investigators say the operation appears closely tied to the IRGC, and some investigators have described the connection in stronger terms.

Why is Iran’s central bank relevant to the case?

Investigators allege Shelbit provided access to global crypto markets for Iran’s central bank and other sanctioned Iranian entities. The Central Bank of Iran has been sanctioned under U.S. counterterrorism authorities since 2019.

What is Nobitex’s connection?

Shelbit is alleged to have interacted with Nobitex, an Iranian exchange sanctioned by the U.S. government earlier this year after investigative findings revealed ties to the government.

Why does bitcoin mining appear in the allegations?

Some crypto flowing to Shelbit was described by investigative firms as coming from an Iranian bitcoin mining operation that creates new digital coins. Mining-linked proceeds can create compliance concerns when connected to sanctioned jurisdictions or state-linked entities.

Why does this matter for crypto exchanges?

The case highlights the difficulty of detecting indirect exposure to sanctioned or high-risk networks. Exchanges may need to monitor wallet clusters, nested services and counterparties even when a named entity does not directly hold an account.

Photo by crazy motions on Pexels