An unlicensed Dubai crypto exchange called Shelbit moved at least $676 million into Binance wallets as part of an Iranian sanctions-evasion network that processed roughly $4 billion in digital assets since May 2024, according to a Reuters investigation published July 31, 2026. Reuters blockchain analysts traced Shelbit’s counterparties to Iran’s central bank, wallets Israeli authorities identify as connected to the Islamic Revolutionary Guard Corps, and Nobitex, the Iranian exchange the US Treasury sanctioned earlier in 2026. Dubai’s Virtual Assets Regulatory Authority issued a cease-and-desist order and fines against Shelbit General Trading L.L.C. on July 24, 2026, a week before the report ran.
A sanctions designation by the US Office of Foreign Assets Control attaches to a specific wallet address on the Specially Designated Nationals list, not to a named account, which means any exchange that later touches that address is required to freeze the funds regardless of who deposited them.
Key takeaways
- Reuters traced about $676 million from Shelbit-linked wallets to Binance, with roughly $540 million arriving after Dubai’s regulator first fined the firm in 2025.
- Shelbit handled at least $4 billion in total flows since May 2024, including $250 million tied to a Farsi-language gambling network of more than 2,000 sites.
- Binance says Shelbit never held an account on its platform, that the transfers were not flagged as high risk, and that it froze and reported connected accounts after investigators surfaced them.
- VARA’s July 24 cease-and-desist cites unlicensed operation, KYC failures, money laundering and terrorism financing, and OFAC has signaled it will expand designations to Iranian regime-linked wallets.
Published: August 2, 2026, 16:15 UTC
How the money moved
Shelbit operated as a broker rather than a consumer exchange, which is why it never appeared as a Binance customer. Reuters reported the firm ran from a three-room office in Dubai’s Deira district, registered alongside a watch trading business, with no functional public website.
Its largest identified client was a Farsi-language gambling operation spanning more than 2,000 websites and fronted by influencers Sasha Sobhani and Pooyan Mokhtari. Both were convicted on illegal gambling charges in Iran in 2023, alongside Shelbit operator Siavash Kayvanpour. The network kept running after the convictions, and at least $250 million tied to those sites passed through Shelbit.
Some of the inbound crypto came from an Iranian bitcoin mining operation, according to investigators cited by Reuters. Newly mined coins carry no prior transaction history, so they arrive at a screening system with nothing to match against a watchlist.
“This is by far the biggest Iranian illegal gambling network ever discovered and one of the biggest in the world,” said John Wojcik, a former illegal gambling investigator at the United Nations Office on Drugs and Crime, in comments to Reuters. Reuters said it could not confirm direct IRGC control of Shelbit or the gambling network.
Why Binance’s response is the pressure point
Binance’s account of events is internally consistent and still leaves it exposed, because OFAC liability does not depend on whether a customer relationship existed. The exchange told Reuters that Shelbit held no account, that the linked transactions were not scored as high risk by its systems, and that it froze and reported the accounts once the connections were identified.
The timing is the problem. Roughly $540 million of the $676 million total arrived after VARA fined Shelbit in 2025 for unlicensed operation, according to the Reuters analysis. That gap between a public regulatory action in one jurisdiction and address-level screening at a global exchange is the specific failure regulators tend to price.
Binance settled with US authorities in 2023 for $4.3 billion over sanctions and anti-money-laundering violations, and former chief executive Changpeng Zhao pleaded guilty to related charges. A second Iran-linked matter lands against that record, not on a clean sheet.
What comes next for exchanges and their customers
The practical risk for the rest of the industry is a wave of address-level designations rather than a single enforcement action against one company. OFAC has signaled it will target Iranian regime-linked digital assets more broadly, which points to new SDN listings covering Shelbit-connected wallets.
Once those addresses are listed, every custodial platform that processed them has to review historical exposure and freeze anything still connected. Platforms that acted before designation are not automatically liable, but they face scrutiny over whether they had reason to know. That is the same mechanism that produced account freezes across the industry after previous designations, including the court-ordered freezes stablecoin issuers have executed this year.
For businesses holding assets on centralized platforms, the exposure is operational rather than theoretical. A frozen account tied to an upstream counterparty three hops away still stops payroll. Chainalysis put Iranian crypto activity at $7.78 billion in 2025 with IRGC-linked inflows above $3 billion, which suggests Shelbit is one node rather than the whole network.
VARA’s action also creates a record Dubai cannot reverse. The emirate has spent several years recruiting crypto firms, and a cease-and-desist citing terrorism financing is a sharper instrument than the licensing warnings it usually issues. Other jurisdictions have moved the opposite way this year, with New York granting Circle a state trust charter in July. Kayvanpour’s 2023 conviction and the documented Nobitex link give US prosecutors a jurisdictional argument if they choose to pursue one. The next Treasury press release will show whether they do.
Frequently asked questions
Did Binance knowingly process Iranian sanctions funds?
Binance says no. It told Reuters that Shelbit never held an account and that the flows were not flagged as high risk by its compliance systems. OFAC’s standard does not require knowledge, though. Liability attaches to the wallet address, so the question regulators will ask is whether real-time screening caught those addresses.
What is a cease-and-desist from VARA?
VARA is Dubai’s Virtual Assets Regulatory Authority, the licensing body for crypto firms in the emirate. A cease-and-desist orders a company to stop all regulated activity immediately. VARA’s July 24 order against Shelbit also carried monetary fines and cited money laundering and terrorism financing.
Could customer funds on Binance be frozen because of this?
Only funds in accounts connected to designated addresses. Binance said it already froze and reported accounts it identified as linked to the network. If OFAC designates additional Shelbit-related wallets, exchanges holding balances traceable to those addresses are legally required to block them.
Sources
Reporting by The Block, Crypto Briefing and TFTC, based on the Reuters investigation published July 31, 2026. Sanctions background from the US Treasury.
