US Treasury and OFAC Escalate Sanctions Against Crypto-Linked Terrorist and Criminal Networks

U.S. regulatory and enforcement agencies are intensifying their crackdown on transnational criminal organizations and terrorist groups utilizing digital assets to circumvent traditional financial controls. Recent actions by the Office of Foreign Assets Control and allied departments highlight a coordinated strategy to dismantle the digital financial infrastructure of groups ranging from the Islamic Revolutionary Guard Corps to Latin American syndicates and Hamas militants.

This aggressive enforcement posture demonstrates that authorities are increasingly capable of mapping complex blockchain transactions to real-world illicit activities. By designating specific individuals, shell companies, and crypto addresses, the government is cutting off vital financial arteries that sustain these global illicit networks. The targeting of shared laundering infrastructure also reveals how disparate criminal enterprises often rely on the same underground financial services to move their capital.

Iranian Exchanges and IRGC Financing

The U.S. Department of the Treasury's Office of Foreign Assets Control took action against digital asset platforms utilized by the Iranian government to launder funds and support the Islamic Revolutionary Guard Corps, according to an August 7, 2026, statement ². The sanctions specifically targeted Tehran-based digital asset exchanges and a network of front companies operating internationally ².

Siavash Kayvanpour, an individual holding citizenship in Iran, Dominica, and Afghanistan, was designated for operating a multinational corporate network facilitating unauthorized digital currency movements ². Kayvanpour runs the Shelbit Exchange through a Republic of Georgia-based entity known as SHPS Shelbit ². Authorities allege that digital currency addresses associated with the Islamic Revolutionary Guard Corps transferred the equivalent of more than $1 million to addresses controlled by Shelbit Exchange ². Furthermore, over $2 million flowed from Shelbit addresses back to the paramilitary organization ². Kayvanpour's controlled wallets also transmitted in excess of $2 million to Nobitex, a previously sanctioned Iranian exchange ².

Shelbit provided financial services to a substantial Persian-language gambling network operated by two Iranian influencers living abroad ². Tens of millions of dollars originating from this betting enterprise were laundered via Shelbit, exposing the Iranian regime's selective enforcement, as the influencers were convicted of illegal gambling in 2023 but retained access to state-regulated online payment systems ².

The United Arab Emirates-based Shelbit General Trading LLC, which conducts business as Shelbit Exchange, was also designated ². The Virtual Assets Regulatory Authority in the UAE previously issued enforcement actions against this trading firm in January 2025 and July 2026, though the business continued operations ². Kayvanpour also manages UAE-based Crypto Home DMCC and NFT Home DMCC, alongside owning a Poland-based entity named Shelbit Technologies Ltd ². All these entities face sanctions for their connections to Kayvanpour ². Another platform, Aban Tether, was designated for operating within the Iranian financial sector and processing millions in transactions with sanctioned platforms such as Bitpin, Wallex, and Ramzinex ².

Related coverage: US Treasury Sanctions Crypto Exchanges Shelbit and Aban Tether Over IRGC Ties

Latin American ATM Jackpotting Ring

In a separate enforcement action on Sept. 30, 2026, the Office of Foreign Assets Control designated 10 individuals connected to Tren de Aragua, a transnational criminal organization operating out of Venezuela ¹. The state department previously classified this group as a Foreign Terrorist Organization in February 2025 ¹.

The designated network orchestrated an ATM jackpotting campaign across the United States, utilizing digital assets to launder the stolen cash ¹. Anibal Alexander Canelon Aguirre, known by the alias Prometheus and listed among the Federal Bureau of Investigation's Ten Most Wanted Fugitives, purportedly led the conspiracy ¹. According to a December 2025 indictment, the perpetrators infected banking machines with Ploutus malware utilizing Raspberry Pi hardware ¹.

The physical execution of these breaches required specialized crews. One group scouted and photographed the machines while checking for alarms, a second installed the malicious software by removing and reinserting the hard drives, and a final team collected the dispensed currency ¹. The malware featured automated deletion capabilities to erase operational traces, complicating forensic investigations ¹. As of August 2025, estimated losses from over 1,500 associated jackpotting incidents reached $40.73 million ¹.

To move these illicit proceeds, the criminal syndicate relied heavily on stablecoins ¹. Blockchain analysis revealed that the wallets associated with Tren de Aragua transacted with entities connected to significant money laundering networks utilized by Mexican and Colombian drug cartels, as well as a Venezuelan individual accused of laundering one billion dollars ¹. Seven specific cryptocurrency deposit addresses at a prominent exchange were sanctioned in connection to Aguirre and six of his associates: Carlos Javier Martinez Armenta, Alejandro Mejia Castillo, Jose Dario Galeano Bazurto, Eric Gabriel Cardenas Arzola, Oscar Leonardo Martinez Pirona, and Anthony Wuiliam Hernandez Guerrero ¹. The stablecoin issuer Tether had previously frozen USDT balances associated with wallets linked to these newly sanctioned addresses ¹.

Related coverage: Tether Freezes Nearly $550M in Iran-Linked USD₮ as US Sanctions Tighten

Sham Charities Funding Hamas

The Treasury Department also moved against a sophisticated financing network funneling capital to Hamas militants through deceptive philanthropic organizations and cryptocurrency transactions ³. The government designated Saleem Abdallah Saleem al-Zaq, a Gaza-based deputy in the Hamas military wing ³. Al-Zaq managed a financial web that leveraged various money services businesses and digital asset wallets to route substantial funds to the Al-Qassam Brigades ³.

Operating from France, Faouzi Barika and Amel Oualid were designated for managing purported humanitarian charities that actually served as fundraising vehicles for the militant group ³. Over a six-year span stretching from 2020 to 2026, the trio successfully collected more than $2 million intended for Hamas operations ³. A significant portion of this capital, totaling $1.5 million, was accumulated following the Hamas attack on Israel that occurred on October 7, 2023 ³.

Barika and Oualid transmitted hundreds of thousands of dollars in digital currency directly to al-Zaq ³. The military wing deputy openly promoted their fundraising accounts on his personal social media profiles ³. To facilitate these operations, Barika co-founded the France-based Association Baraka with al-Zaq, soliciting public donations that were subsequently transferred to the militant organization ³. Similarly, Oualid established Ensemble C Mieux in France to pool resources for the same purpose ³. Both Association Baraka and Ensemble C Mieux were officially designated as blocked entities by the regulatory authorities ³.

Implications

These concurrent actions illustrate a maturing regulatory framework designed to isolate malicious actors from the global financial system. By mapping the on-chain footprints of these organizations, the Office of Foreign Assets Control is systematically dismantling the infrastructure that enables sanctions evasion and terrorist financing.

The designation of corporate entities, exchange platforms, and specific blockchain addresses carries strict liability for United States persons and financial institutions ². Entities engaging with these blocked persons risk severe civil and criminal penalties ³. Foreign financial institutions also face the threat of secondary sanctions, which could result in the termination of their U.S. correspondent accounts if they knowingly facilitate significant transactions for the designated parties ³.

The overlapping use of laundering networks by different cartels and terrorist organizations provides authorities with centralized targets. As digital asset analytics improve, the ability of these groups to obscure the origins of their funds through shell companies and unregulated platforms is rapidly diminishing. The utilization of stablecoins for cross-border settlements, while offering price stability to criminals, simultaneously exposes them to advanced monitoring and immediate freezing actions by centralized issuers ¹.

What to Watch

The enforcement landscape is shifting toward holding infrastructure providers accountable. Market participants must monitor how centralized exchanges and stablecoin issuers respond to the expanding sanctions lists. The integration of on-chain analytics into standard compliance procedures will become increasingly mandatory as the government tightens its grip on illicit financial flows.

The Internal Revenue Service's Criminal Investigation division and the Federal Bureau of Investigation are likely to pursue further indictments based on the financial intelligence gathered from these operations ²³. The U.S. Department of State's Rewards for Justice program continues to offer up to $15 million for actionable intelligence regarding the financial mechanisms of the Islamic Revolutionary Guard Corps ². Similarly, whistleblower incentives exceeding $1 million are available for information leading to successful enforcement actions involving sanctions violations ³. The continued operation of entities like Shelbit General Trading despite prior regulatory warnings in the United Arab Emirates suggests that international jurisdictional friction will remain a critical area of focus for U.S. authorities seeking global compliance ².