TRM Labs Identifies $16.8 Million Flow into 30 Iran‑Linked Crypto Wallets

Blockchain analytics company TRM Labs reported that about $16.8 million was transferred into 30 cryptocurrency addresses linked to members of Iran’s Mabna Institute. The addresses were later listed by the U.S. Treasury as part of a broader sanctions action against Iran.

Key Wallet Activity

The designated addresses span Bitcoin (BTC), Ethereum (ETH) and TRON (TRX). Four of the 17 defendants named in a superseding indictment filed by the Department of Justice are associated with these wallets. Activity on the addresses dates back to January 2018.

Concentration of Funds

TRM Labs identified Keyvan Fayaz as controlling ten of the addresses. Those wallets received a combined $15.5 million between January 6 2018 and August 20 2026, representing 92 % of the total on‑chain volume for the network. The firm suggests Fayaz may have acted as a treasury for the operation.

Other Participants

Addresses linked to Behzad Mesri show layered transfers between his own wallets, with hundreds of thousands of dollars eventually moving to a deposit address at a large centralized exchange. As of the latest analysis, the residual balance across all 30 wallets is about $202,662, roughly 1 % of the total value that passed through them.

Legal and Regulatory Context

The Department of Justice unsealed a 14‑count superseding indictment on August 18, alleging that the Mabna Institute conducted cyber intrusions for the Islamic Revolutionary Guard Corps since at least 2013, targeting U.S. and foreign universities. The Office of Foreign Assets Control (OFAC) designated nearly 60 Iran‑linked targets, expanding sanctions to the digital‑assets sector under Executive Order 13902.

Secretary of the Treasury Scott Bessent stated that the U.S. is pursuing an “economic onslaught” to cut financial lifelines to the Iranian regime.