Blockchain / Sanctions Enforcement
Shelbit’s $4B Iran Network Sent $676M to Binance
A one-room office above a budget hotel in Dubai just became the center of the crypto industry’s next sanctions headache. Reuters investigators traced $4 billion in transactions through an unlicensed exchange called Shelbit, and $676 million of it landed on Binance, the world’s largest crypto platform. If you run compliance for an exchange, a fund, or an OTC desk with any UAE exposure, this is the story to read before Monday’s risk meeting.
Contents
What Is Shelbit, and Why Does It Matter?
Shelbit has no public website. No app. No visible way for an ordinary customer to sign up. According to the Reuters investigation published July 31, 2026, it’s registered above a budget hotel in Dubai’s Deira district, and staff on site reportedly denied knowing anything about the company or crypto when asked. Yet on-chain data reviewed by Reuters shows the exchange processed at least $4 billion since May 2024.
The person behind it is identified as Siavash Kayvanpour, an Iranian expatriate. His main customers: a Farsi-language online gambling network spanning more than 2,000 websites, fronted by influencers Sasha Sobhani (operating out of Madrid) and Pooyan Mokhtari (recently expelled from Dubai to Hong Kong). All three were convicted together, in absentia, in a 2023 Iranian illegal-gambling case.
That’s the surface layer. Underneath it, Shelbit reportedly interacted directly with Iran’s central bank, with wallets Israeli officials have linked to the IRGC, and with Nobitex, the Iranian exchange the US Treasury sanctioned earlier this year.
“This is by far the biggest Iranian illegal gambling network” ever uncovered. John Wojcik, Senior Analyst, TRM Labs (former UN Office on Drugs and Crime investigator) via Reuters, July 31, 2026
The Money Trail: $676 Million and a January Fine
Here’s the number that pulls Binance into the story. Blockchain forensic firms tracked $676 million flowing from Shelbit-linked wallets into Binance since May 2024. The uncomfortable detail: roughly $540 million of that moved after Dubai’s Virtual Assets Regulatory Authority (VARA) fined Shelbit in January 2025 for operating without a license.
Independent researcher Rich Sanders says he personally flagged Shelbit’s Iran ties to Binance in October 2025. Funds kept moving after that warning, according to Reuters.
| Figure | Amount | What It Shows |
|---|---|---|
| Total processed by Shelbit since May 2024 | $4 billion | Scale of the network |
| Shelbit funds sent to Binance | $676 million | Direct exchange exposure |
| Sent to Binance after VARA’s Jan. 2025 fine | $540 million | Flow continued post-red flag |
| Routed directly from Iran’s central bank | $125 million | Ties to a sanctioned state institution |
| Processed for a single gambling site | $130 million | Gambling volume alone is enormous |
| Gambling websites in the network | 2,000+ | Dwarfs the prior largest known case (54 sites) |
Reuters is careful to note what it couldn’t confirm: whether the IRGC has direct operational control of the network, and where much of the crypto ultimately ended up. Sanders is more blunt about his own read of the evidence.
“It’s an IRGC operation, and that’s plain as day.” Rich Sanders, Independent Blockchain Researcher, via Reuters, July 31, 2026
Dubai Regulators Move Fast, for Once
What’s genuinely new here isn’t just the dollar figure. It’s the timing. On July 24, 2026, one week before the Reuters story ran, VARA issued a formal Notice of Fines against Shelbit General Trading L.L.C., citing continued unlicensed virtual-asset activity, onboarding customers without mandatory KYC checks, and unauthorized marketing.
Compare that to the Nobitex precedent. Reuters first reported on that exchange’s Iran ties in May 2026, and it took roughly a month for the US Treasury to formally sanction it, on June 2, 2026, along with three other Iranian platforms and named individuals including chairman Amir Hossein Rad. This time, a regulator moved in near-lockstep with the journalism rather than trailing it by weeks or years.
Regulatory context you need: On April 8, 2026, FinCEN and OFAC issued joint rulemaking on AML and sanctions compliance for stablecoin issuers under the GENIUS Act. That’s the broader enforcement climate this story lands in. For the full breakdown of what’s changed across jurisdictions this year, see NeuralWired’s Crypto Regulation by Country 2026 guide.
Binance’s Defense, and Its Blind Spot
Binance’s position is specific and, on its face, defensible: Shelbit itself never held a Binance account, was never formally sanctioned, and the exchange says its own compliance program acted correctly when Shelbit-linked users showed up on the platform.
“Our compliance program operated as it should have.” Binance, official statement to Reuters, July 31, 2026
Binance also says the flagged flows were not deemed high risk by an unnamed independent third-party analytics firm, and that it could not reconcile Reuters’ post-fine flow figures with its own records. Reuters says Binance did not answer what, if anything, it did after Sanders’ October 2025 warning.
That gap is the real story for risk teams. A major exchange’s defense rests on a third-party risk score that missed $540 million in flows from an entity a regulator had already fined. If that score can miss this, what else is it missing?
This Isn’t Binance’s First Iran Headline
Shelbit is chapter four of an escalating pattern, not a standalone incident:
- 2022: A Reuters investigation found Binance processed $8 billion in Iranian transactions since 2018, with $7.8 billion of that moving directly between Binance and Nobitex.
- 2023: Binance paid a $4.3 billion settlement to US authorities for anti-money-laundering and sanctions violations.
- February 2026: Reports surfaced that Binance fired an internal investigator who had flagged Iran sanctions issues, around the same time 11 US senators requested a federal probe into the exchange’s AML compliance.
- July 2026: Shelbit.
Binance’s own February 2026 compliance report claimed a 96.8% drop in sanctions-jurisdiction exposure since 2024, down to 0.009% of exchange volume. The Shelbit numbers are the first real stress test of that claim since it was published, and they don’t make the claim look stronger.
The Case for Skepticism
It’s worth pushing back on the cleanest version of this story before you act on it.
First, the core forensic conclusion, that this is an IRGC-run operation, comes primarily from one independent researcher’s assessment, corroborated by two investigative firms whose underlying data Reuters did not independently re-verify. That’s a real limitation, not a fatal one, but it matters for how much weight you put on the IRGC framing specifically.
Second, Binance’s rebuttal is specific enough to be testable: it disputes the risk characterization and disputes the reconciliation of the post-fine numbers. Neither Reuters nor other outlets have resolved that disagreement.
Third, ask why enforcement keeps stalling. Treasury has now said, across multiple cycles this year, that it’s “aware” and “taking allegations seriously.” That phrasing preceded the Nobitex sanctions by about a month back in June. Whether Shelbit follows the same timeline, or joins a longer list of allegations that never convert into formal action, is genuinely unresolved.
Our read: the structural weak point nobody’s fixed yet is that Shelbit has no public footprint at all, no website, no visible onboarding, nothing for KYC frameworks to latch onto. VARA’s licensing regime and Binance’s third-party risk scoring are both built to monitor identifiable counterparties. A ghost exchange with zero public presence can move billions specifically because it doesn’t fit the categories those systems are designed to catch.
What Compliance Teams Should Do Now
If you’re running risk or AML for an exchange, fund, or OTC desk with UAE counterparties, three things follow directly from this story:
- Audit your reliance on single-vendor risk scores. Binance’s defense hinges on one unnamed analytics firm’s assessment. If your program leans on a single score the same way, this is your case study for why that’s a liability, not a shield.
- Expect more VARA scrutiny on UAE-routed volume. The speed of the July 24 enforcement notice suggests Dubai regulators are done waiting for foreign journalism to force their hand.
- Reactive freezing won’t satisfy regulators much longer. OFAC applies a strict-liability standard. If Shelbit-linked wallets get formally designated, downstream exposure risk exists for any US-nexus entity that touched them, regardless of intent or how quickly accounts were frozen afterward.
Frequently Asked Questions
What is Shelbit crypto exchange?
Shelbit is an unlicensed Dubai exchange founded by Iranian expatriate Siavash Kayvanpour. Reuters reported it processed at least $4 billion since May 2024, linking Iran’s central bank, IRGC-connected wallets, and a 2,000-site gambling network to global crypto markets, including Binance.
Did Binance violate Iran sanctions through Shelbit?
No violation has been formally confirmed. Binance says Shelbit never held an account on its platform and disputes the “high risk” characterization of the flows. OFAC says it’s reviewing the allegations but hasn’t announced enforcement action against Binance as of August 2026.
What happened with Nobitex and Iran sanctions?
The US Treasury sanctioned Nobitex, Iran’s largest exchange, on June 2, 2026, along with three other Iranian platforms and named individuals, citing ties to Iran’s central bank and the IRGC. Nobitex reportedly handled roughly 70% of Iran’s crypto trading volume before the designation.
How much was Binance fined in 2023?
Binance paid a $4.3 billion settlement to US authorities in 2023 after pleading guilty to anti-money-laundering and sanctions violations, part of a broader pattern of Iran-linked scrutiny that stretches from 2022 through the current Shelbit story.
Is VARA investigating Shelbit?
Yes. Dubai’s Virtual Assets Regulatory Authority confirmed it’s investigating Shelbit’s alleged role in money laundering and sanctions evasion, and it issued a formal Notice of Fines against the company on July 24, 2026 for operating without a license.
Where This Goes Next
Here’s what you now know that you didn’t twenty minutes ago: a ghost exchange with no public footprint moved $4 billion, $676 million of it reached Binance, and Dubai regulators acted before the story even broke. That last part is the shift worth watching. Everything before it, including the Nobitex case, followed a slower pattern where journalism led and enforcement trailed by months.
Over the next six to eighteen months, watch for three things: whether OFAC moves from “aware and reviewing” to a formal designation against Shelbit-linked wallets, whether Binance names the third-party analytics firm behind its risk assessment, and whether VARA’s faster enforcement timeline becomes the new normal for UAE-based crypto oversight or stays a one-off.
None of the earlier headline cycles this year, the fired investigator, the Senate probe, the self-reported exposure numbers, produced a formal OFAC action against Binance itself. Shelbit is the biggest test yet of whether that pattern holds.
Want stories like this before they hit your feed?
Subscribe to The Neural Loop
Subscribe to The Neural Loop
More posts
-
DoorDash Agrees to Buy Instacart for $17 Billion. Here’s What the Deal Means and the Regulatory Test Ahead
DoorDash has agreed to buy Instacart for about $17 billion, but the hardest part may be convincing regulators. The DoorDash Instacart acquisition could take until the first half of 2028 to close, with analysts expecting a close FTC look. Here is what the deal means for how you order dinner and groceries.
-
Stablecoin Rules Are Arriving Without Congress: What the OCC, Ripple and Bessent Just Signaled
In one week, the OCC finalized its GENIUS Act rulebook, Ripple won its federal trust charter, and the Treasury Secretary pitched stablecoins as demand for US debt. Meanwhile, the CLARITY Act sits stalled in the Senate. Here is what the OCC GENIUS Act final rule means before the January 18, 2027 deadline.
-
Israel Election Result: Netanyahu and Eisenkot Locked in a Deadlock, With Arab Parties Possibly Holding the Balance
Israel voted in record numbers, and the exit polls still could not name a winner. Netanyahu and Eisenkot are both short of 61 seats, the Arab parties may hold the balance, and the final count is days away. Here is what the Israel election results mean and how a government could still be formed.
-
Anthropic’s IPO Filing Shows $16.3 Billion in Half-Year Revenue, an $80.7 Billion Loss, and a Governance Structure Few Public Companies Share
Anthropic’s first-half revenue topped $16 billion, yet its net loss neared $81 billion. The S-1 explains why those numbers don’t contradict each other, and who keeps control after the Anthropic IPO. Here is what the filing shows and what to watch before shares price.
-
Pentagon and Lockheed Martin Announce a 10-Year, 850-Jet F-35 Framework That Congress Has Not Yet Approved
The Pentagon and Lockheed Martin have announced a 10-year framework for at least 850 US F-35s, but no jets have been ordered and no price has been disclosed. Congress still has to authorize and fund the Lockheed Martin F-35 deal before it becomes a contract. Here is what is confirmed, what is not, and what…
-
PHP2Shell Explained: Two Critical PHP Flaws, an AI Discovery Race, and a Patch Scramble Across the Internet
Two critical flaws in PHP, the language behind roughly 70% of websites, leaked days before their fix and set off a global patching scramble. The PHP2Shell vulnerability was found with AI tools, and the story of who found it first is still disputed. Here is what the flaws do, which versions are fixed, and what…
-
US Orders Diplomats Out of Saudi Arabia as Houthi Strikes Hit Airports and Oil Field
The US has ordered some diplomats and their families to leave Saudi Arabia, and a Houthi strike on Dammam’s airport hours later showed why. Here is what the US ordered departure covers, what is still disputed, and what to watch next.
-
ConnectWise Cloud Backup Breach: How a Stolen App Credential Opened Microsoft 365 Tenants
A trusted backup app signed in to Microsoft 365 tenants like clockwork, and the credential was not the customers’ to protect. Here is what the ConnectWise Cloud Backup breach exposed, what is still unknown, and why backups remain offline.