Blockchain intelligence firm TRM Labs has identified approximately $16.8 million in cryptocurrency transactions across 30 addresses tied to members of Iran's Mabna Institute. The US Treasury previously listed these addresses as part of a broader action against Iran, with one defendant's wallets accounting for the vast majority of the funds.
The designated addresses involve Bitcoin, Ethereum, and TRON. They are linked to four of the 17 defendants named in a superseding indictment unsealed by the Department of Justice (DOJ), with wallet activity dating back to January 2018.
According to TRM Labs, Keyvan Fayaz controlled 10 of the addresses, which collectively received $15.5 million between January 2018 and August 2026. This amount represents 92% of the total on-chain volume for the network. TRM noted that this concentration suggests Fayaz may have acted as a treasury for the operation. Additionally, addresses belonging to Behzad Mesri—who is separately accused of breaching HBO—show layered transfers between his wallets, with hundreds of thousands of dollars ultimately reaching a deposit address at a large centralized exchange.
Despite the millions that passed through the network, TRM Labs reports that little value remains, estimating the combined residual balance across all 30 addresses at $202,662, or roughly 1% of the total volume.
The findings follow a 14-count superseding indictment unsealed by the DOJ on August 18, which alleges that the Iran-based Mabna Institute has conducted cyber intrusions for the Islamic Revolutionary Guard Corps (IRGC) since at least 2013. The operations reportedly targeted 144 US universities and 178 foreign ones.
Concurrently, the Office of Foreign Assets Control (OFAC) designated nearly 60 Iran-linked targets, following earlier actions against Iranian platforms like Shelbit.
“We are launching an economic onslaught against Iran’s financial connections around the globe. Our objective is to sever every economic lifeline that sustains this tyrannical regime until Tehran stands alone,” said Treasury Secretary Scott Bessent.
In addition to these designations, the Treasury issued five sectoral determinations under Executive Order 13902 covering digital assets, technology, gold, aviation, and shipping. Under this order, OFAC now holds the authority to designate persons operating within Iran's digital assets sector, a measure that also extends to non-Iranian individuals while stopping short of automatically blocking every firm active in the sector.
