TRM Labs traces $16.8 million across 30 sanctioned Iran-linked wallets

TRM Labs traced roughly $16.8 million flowing into 30 cryptocurrency addresses tied to members of Iran's Mabna Institute. The US Treasury listed the addresses in a wider action against Iran. Keyvan Fayaz controlled 10 addresses that received a combined $15.5 million between January 6, 2018, and August 20, 2026. That amount represented 92% of the network's total on-chain volume. The addresses covered Bitcoin, Ethereum, and TRON. The addresses belonged to four of the 17 defendants named in a superseding indictment unsealed by the Department of Justice. The wallet activity dates back to January 2018. TRM Labs said the concentration may indicate that Fayaz's wallets functioned as a treasury for the operation. Wallets belonging to Behzad Mesri showed layered transfers between his own addresses. Mesri was separately accused of breaching HBO. Hundreds of thousands of dollars eventually reached a deposit address at a large centralized exchange. The combined residual balance across all 30 addresses was $202,662, or roughly 1% of the amount that passed through them, according to TRM Labs. The Department of Justice unsealed a 14-count superseding indictment on August 18. Prosecutors allege that the Iran-based Mabna Institute conducted cyber intrusions for the Islamic Revolutionary Guard Corps since at least 2013. The alleged intrusions targeted 144 US universities and 178 foreign universities. The Office of Foreign Assets Control designated nearly 60 Iran-linked targets on Monday. The action followed earlier designations of Iranian platforms, including Shelbit earlier this month. Treasury Secretary Scott Bessent said the United States was launching an economic campaign against Iran's financial connections and sought to sever every economic lifeline supporting the regime. The Treasury issued five sectoral determinations under Executive Order 13902. The determinations covered digital assets, technology, gold, aviation, and shipping. The authority allows OFAC to designate persons operating in Iran's digital assets sector. The authority also covers non-Iranian persons. The authority does not automatically block every firm active in the sector.