Shelbit’s $4B Iran Network Sent $676M to Binance

A one-room office above a budget hotel in Dubai just became the center of the crypto industry’s next sanctions headache. Reuters investigators traced $4 billion in transactions through an unlicensed exchange called Shelbit, and $676 million of it landed on Binance, the world’s largest crypto platform. If you run compliance for an exchange, a fund, or an OTC desk with any UAE exposure, this is the story to read before Monday’s risk meeting.

What Is Shelbit, and Why Does It Matter?

Shelbit has no public website. No app. No visible way for an ordinary customer to sign up. According to the Reuters investigation published July 31, 2026, it’s registered above a budget hotel in Dubai’s Deira district, and staff on site reportedly denied knowing anything about the company or crypto when asked. Yet on-chain data reviewed by Reuters shows the exchange processed at least $4 billion since May 2024.

The person behind it is identified as Siavash Kayvanpour, an Iranian expatriate. His main customers: a Farsi-language online gambling network spanning more than 2,000 websites, fronted by influencers Sasha Sobhani (operating out of Madrid) and Pooyan Mokhtari (recently expelled from Dubai to Hong Kong). All three were convicted together, in absentia, in a 2023 Iranian illegal-gambling case.

That’s the surface layer. Underneath it, Shelbit reportedly interacted directly with Iran’s central bank, with wallets Israeli officials have linked to the IRGC, and with Nobitex, the Iranian exchange the US Treasury sanctioned earlier this year.

“This is by far the biggest Iranian illegal gambling network” ever uncovered. John Wojcik, Senior Analyst, TRM Labs (former UN Office on Drugs and Crime investigator) via Reuters, July 31, 2026

The Money Trail: $676 Million and a January Fine

Here’s the number that pulls Binance into the story. Blockchain forensic firms tracked $676 million flowing from Shelbit-linked wallets into Binance since May 2024. The uncomfortable detail: roughly $540 million of that moved after Dubai’s Virtual Assets Regulatory Authority (VARA) fined Shelbit in January 2025 for operating without a license.

Independent researcher Rich Sanders says he personally flagged Shelbit’s Iran ties to Binance in October 2025. Funds kept moving after that warning, according to Reuters.

Reuters is careful to note what it couldn’t confirm: whether the IRGC has direct operational control of the network, and where much of the crypto ultimately ended up. Sanders is more blunt about his own read of the evidence.

“It’s an IRGC operation, and that’s plain as day.” Rich Sanders, Independent Blockchain Researcher, via Reuters, July 31, 2026

Dubai Regulators Move Fast, for Once

What’s genuinely new here isn’t just the dollar figure. It’s the timing. On July 24, 2026, one week before the Reuters story ran, VARA issued a formal Notice of Fines against Shelbit General Trading L.L.C., citing continued unlicensed virtual-asset activity, onboarding customers without mandatory KYC checks, and unauthorized marketing.

Compare that to the Nobitex precedent. Reuters first reported on that exchange’s Iran ties in May 2026, and it took roughly a month for the US Treasury to formally sanction it, on June 2, 2026, along with three other Iranian platforms and named individuals including chairman Amir Hossein Rad. This time, a regulator moved in near-lockstep with the journalism rather than trailing it by weeks or years.

Binance’s Defense, and Its Blind Spot

Binance’s position is specific and, on its face, defensible: Shelbit itself never held a Binance account, was never formally sanctioned, and the exchange says its own compliance program acted correctly when Shelbit-linked users showed up on the platform.

“Our compliance program operated as it should have.” Binance, official statement to Reuters, July 31, 2026

Binance also says the flagged flows were not deemed high risk by an unnamed independent third-party analytics firm, and that it could not reconcile Reuters’ post-fine flow figures with its own records. Reuters says Binance did not answer what, if anything, it did after Sanders’ October 2025 warning.

That gap is the real story for risk teams. A major exchange’s defense rests on a third-party risk score that missed $540 million in flows from an entity a regulator had already fined. If that score can miss this, what else is it missing?

This Isn’t Binance’s First Iran Headline

Shelbit is chapter four of an escalating pattern, not a standalone incident:

• 2022: A Reuters investigation found Binance processed $8 billion in Iranian transactions since 2018, with $7.8 billion of that moving directly between Binance and Nobitex.
• 2023: Binance paid a $4.3 billion settlement to US authorities for anti-money-laundering and sanctions violations.
• February 2026: Reports surfaced that Binance fired an internal investigator who had flagged Iran sanctions issues, around the same time 11 US senators requested a federal probe into the exchange’s AML compliance.
• July 2026: Shelbit.

Binance’s own February 2026 compliance report claimed a 96.8% drop in sanctions-jurisdiction exposure since 2024, down to 0.009% of exchange volume. The Shelbit numbers are the first real stress test of that claim since it was published, and they don’t make the claim look stronger.

The Case for Skepticism

It’s worth pushing back on the cleanest version of this story before you act on it.

First, the core forensic conclusion, that this is an IRGC-run operation, comes primarily from one independent researcher’s assessment, corroborated by two investigative firms whose underlying data Reuters did not independently re-verify. That’s a real limitation, not a fatal one, but it matters for how much weight you put on the IRGC framing specifically.

Second, Binance’s rebuttal is specific enough to be testable: it disputes the risk characterization and disputes the reconciliation of the post-fine numbers. Neither Reuters nor other outlets have resolved that disagreement.

Third, ask why enforcement keeps stalling. Treasury has now said, across multiple cycles this year, that it’s “aware” and “taking allegations seriously.” That phrasing preceded the Nobitex sanctions by about a month back in June. Whether Shelbit follows the same timeline, or joins a longer list of allegations that never convert into formal action, is genuinely unresolved.

Our read: the structural weak point nobody’s fixed yet is that Shelbit has no public footprint at all, no website, no visible onboarding, nothing for KYC frameworks to latch onto. VARA’s licensing regime and Binance’s third-party risk scoring are both built to monitor identifiable counterparties. A ghost exchange with zero public presence can move billions specifically because it doesn’t fit the categories those systems are designed to catch.

What Compliance Teams Should Do Now

If you’re running risk or AML for an exchange, fund, or OTC desk with UAE counterparties, three things follow directly from this story:

1. Audit your reliance on single-vendor risk scores. Binance’s defense hinges on one unnamed analytics firm’s assessment. If your program leans on a single score the same way, this is your case study for why that’s a liability, not a shield.
2. Expect more VARA scrutiny on UAE-routed volume. The speed of the July 24 enforcement notice suggests Dubai regulators are done waiting for foreign journalism to force their hand.
3. Reactive freezing won’t satisfy regulators much longer. OFAC applies a strict-liability standard. If Shelbit-linked wallets get formally designated, downstream exposure risk exists for any US-nexus entity that touched them, regardless of intent or how quickly accounts were frozen afterward.

Frequently Asked Questions

Where This Goes Next

Here’s what you now know that you didn’t twenty minutes ago: a ghost exchange with no public footprint moved $4 billion, $676 million of it reached Binance, and Dubai regulators acted before the story even broke. That last part is the shift worth watching. Everything before it, including the Nobitex case, followed a slower pattern where journalism led and enforcement trailed by months.

Over the next six to eighteen months, watch for three things: whether OFAC moves from “aware and reviewing” to a formal designation against Shelbit-linked wallets, whether Binance names the third-party analytics firm behind its risk assessment, and whether VARA’s faster enforcement timeline becomes the new normal for UAE-based crypto oversight or stays a one-off.

None of the earlier headline cycles this year, the fired investigator, the Senate probe, the self-reported exposure numbers, produced a formal OFAC action against Binance itself. Shelbit is the biggest test yet of whether that pattern holds.