Iran’s Mabna Institute, a hacking organization accused of stealing intellectual property for the Islamic Revolutionary Guard Corps, has received roughly $16.8 million in cryptocurrency inflows through approximately 30 addresses since 2018, according to blockchain intelligence firm TRM Labs.
The funds, tracked between January 2018 and August 2026, spanned Bitcoin, Ethereum, and TRON. The transaction flows were heavily concentrated, with defendant Keyvan Fayaz controlling 10 scrutinized addresses that accounted for about $15.5 million, or 92% of the total inflows. A second defendant, Behzad Mesri, was linked to layered transactions that routed toward a centralized exchange deposit. At the time of the analysis, the residual balance across all 30 addresses was approximately $202,662.
Founded around 2013 in Tehran, the Mabna Institute has operated as a cyber-mercenary outfit for the IRGC, allegedly compromising 144 U.S. universities, 178 foreign universities, and various private companies and government entities while siphoning more than 31 terabytes of data.
U.S. prosecutors issued an initial federal indictment in March 2018 against nine defendants, followed by a superseding indictment in August 2026 from the Department of Justice that added eight more names, bringing the total to 17 individuals facing charges. Concurrently, the U.S. Treasury Department designated five individuals connected to Mabna under Operation Economic Outcast, invoking Executive Order 13902, which identifies digital assets as a sanctionable sector.
For crypto compliance teams, any address that has interacted with the 30 flagged wallets now carries elevated risk within transaction monitoring systems. Exchanges and OTC desks that processed transactions for Fayaz's cluster may face regulatory inquiries, while the involvement of TRON highlights the ongoing use of alternative networks in sanctions-adjacent contexts.
