A ghost exchange in Dubai moved $4 billion in Iranian crypto over 13 months through a web of gambling sites and intermediary wallets. Investigators traced $676 million of that to Binance, the world’s largest crypto exchange, with the bulk arriving after regulators first intervened.
The network kept operating for 18 months after Dubai’s Virtual Assets Regulatory Authority issued a cease-and-desist. The gap between detection and shutdown now exposes exchanges worldwide to sanctions liability, whether they knew the funds’ origin or not.
On January 2, 2025, Dubai’s Virtual Assets Regulatory Authority told a company called Shelbit General Trading to cease all unlicensed crypto activity. Over the next 18 months, $540 million in Iranian sanctions-linked funds kept moving through Binance anyway.
Shelbit operated from a mail drop. It had no office, no licence, and no corporate presence beyond a name on a door. Yet blockchain investigators now trace at least $676 million from its wallets to Binance since May 2024 — and $540 million of that arrived after the regulator’s order.
Investigators traced the money to flows from Iran’s central bank, a suspected bitcoin mining operation, and over 2,000 Farsi-language gambling sites that funnelled domestic payments into crypto. The network was sophisticated enough to survive a public cease-and-desist. What it could not survive, investigators say, is a formal US sanctions designation — and that may now be close.
The flows that outran the regulator
The Virtual Assets Regulatory Authority (VARA) first acted on January 2, 2025, ordering Shelbit General Trading L.L.C. to stop all unlicensed virtual-asset activity. On July 24, 2026, it issued a notice of fines for continued violations. In the 18 months between those two dates, the network kept converting Iranian funds into crypto and routing them to major exchanges.
John Wojcik, senior analyst at TRM Labs, the blockchain analytics firm that traced the transactions, puts the total moved at “At least $4 billion in cryptocurrency since May 2024.” That figure includes flows through dozens of wallets and intermediaries, not just the sums that reached Binance.
Investigators documented $125 million moving from Iran’s central bank to Shelbit-controlled wallets. Another $20 million arrived from an Iranian bitcoin mining operation. According to investigators, the network aggregated deposits from gambling sites, converted the funds, and pushed them through Shelbit as a single funnel.
The gap between detection and shutdown is easier seen than read.
Binance told investigators that Shelbit never held a formal account on its platform. The exchange did not dispute that $676 million in Shelbit-linked transactions moved through user accounts. Binance said related accounts were investigated, frozen, and reported. The US Office of Foreign Assets Control (OFAC) is now reviewing whether to designate Shelbit-linked wallet addresses — a step that would make any exchange that processed those funds liable under strict liability rules, regardless of intent.
| Entity | Current status | Regulatory action | Effective date |
|---|---|---|---|
| Shelbit General Trading | Unlicensed virtual-asset activity | VARA cease-and-desist order | Jan 2, 2025 |
| Shelbit General Trading | Continued unlicensed activity | VARA notice of fines | Jul 24, 2026 |
| Binance | Processed Shelbit-linked user funds | Internal account investigation, freezing | Ongoing |
| OFAC | No designation of Shelbit wallets | Reviewing potential wallet address designation | Pending |
| Source: Reuters, VARA, TRM Labs | |||
Two regulatory speeds, one enforcement problem
The structural problem is not discovery. It is the gap between local enforcement and global sanctions risk. Dubai’s VARA can order an unlicensed operator to stop. It cannot freeze assets outside the UAE or force exchanges elsewhere to block funds. That power sits with OFAC, and it has not yet been exercised.
OFAC’s review of Shelbit-linked addresses is the next pivot point. A formal designation would expose any exchange that processed those funds to sanctions liability, triggering compliance reviews and potential penalties. Without one, the case stays at the level of investigative reporting and UAE fines — a sharp warning, but not a global shutdown.
The scale makes the latency harder to dismiss. TRM Labs estimates Iran’s annual crypto ecosystem at $8 billion to $10 billion; blockchain investigators allege a substantial portion is tied to Islamic Revolutionary Guard Corps-connected activity. Each successive sanctions-evasion node is built faster, scales faster, and is identified faster than its predecessor.
For a compliance officer at a mid-sized exchange, the $540 million figure is not a headline — it is the difference between a routine screening and a potential OFAC enforcement action. Western expats in Dubai using crypto rails to move money should expect tighter source-of-funds checks and keep salary, transfer, and ownership records ready. The practical consequence is not a ban on lawful use, but a higher chance of account review when transfers touch virtual-asset firms under VARA scrutiny.
Beyond the headline
The Response Gap
Regulatory latency, not discovery, is the core problem. VARA identified the network, but the 18 months between the cease-and-desist and the fines notice allowed $540 million to move through the pipeline. Shortening that interval is now the central enforcement challenge.
The Money Trail
The financial logic relies on high-friction sectors that generate disposable cross-border cash — in this case, online gambling. That makes the network less dependent on a single exchange than on a repeatable conversion pipeline, one that can regenerate even after the current node is exposed.
The Reach
Binance’s position in the flow path may convert a local evasion structure into a global compliance event. Once a major exchange is implicated, the risk extends beyond reputation: it forces account reviews, exchange-wide screening changes, and downstream pressure on other venues that interact with the same wallets.
The compliance overhang spreads
With OFAC reviewing whether to designate Shelbit-linked wallet addresses, the exposure is no longer theoretical. Four groups face decisions now.
- Western crypto investor with Binance exposure
Your assets on Binance could face freezing or enhanced review if linked to designated wallets. Monitor OFAC announcements for Shelbit-linked designations and be prepared for potential account restrictions or document requests within days of any action.
- Western expat or business owner in Dubai using crypto
Expect tighter source-of-funds checks on virtual-asset transfers. Keep deposit and withdrawal histories, salary records, and wallet ownership documents ready to avoid delays or restrictions on your accounts.
- Compliance officer at a global crypto exchange
Screen proactively for any wallet addresses that may be linked to Shelbit or the broader Iranian sanctions-evasion network. The strict-liability standard means your platform could face enforcement even without knowledge of the funds’ origin. Prepare for potential OFAC actions now.
- Policy professional tracking sanctions effectiveness
Analyse the Shelbit case for the enforcement latency it exposes. The gap between VARA’s January 2025 order and the July 2026 fines is a measurable window that other jurisdictions will study — and that hostile networks will exploit until the response time shortens.
FAQ
Can an exchange freeze my funds if it later appears in a sanctions case?
According to OFAC guidance and precedent from prior enforcement actions, exchanges can freeze or restrict accounts while investigating exposure to sanctioned addresses. The trigger can be direct ownership of tainted funds, commingling, repeated interaction with flagged wallets, or a request from the exchange’s compliance team or law enforcement.
What records should I keep to prove a clean source of funds?
Keep deposit and withdrawal histories, wallet addresses, bank transfer references, pay slips or invoice records, and screenshots of exchange account statements. If a platform requests enhanced due diligence, those documents help prove origin and reduce the chance of prolonged account restriction.
What happens if a Dubai exchange loses its VARA authorization?
You may still log in temporarily, but the provider can be ordered to stop unlicensed activity. This often means freezing onboarding, limiting transfers, or closing services while compliance questions are resolved. Check whether the firm is licensed and whether any enforcement notice specifically mentions trading, custody, or advertising restrictions.
Explainer
- Shelbit General Trading
- A Dubai-registered company that operated an unlicensed cryptocurrency exchange from a mail-drop address. Investigators traced at least $4 billion in Iranian crypto flows through its wallets between May 2024 and mid-2025. The firm has no known physical office and was subject to a cease-and-desist from Dubai’s Virtual Assets Regulatory Authority in January 2025.
- VARA
- The Virtual Assets Regulatory Authority, Dubai’s dedicated crypto regulator, established in 2022. It licenses and supervises virtual-asset service providers, enforces anti-money laundering rules, and can penalise unlicensed operators. Its enforcement tools include cease-and-desist orders and fines, but it cannot freeze assets outside the UAE.
- OFAC
- The Office of Foreign Assets Control, part of the US Treasury Department, administers and enforces economic and trade sanctions. It can designate individuals, entities, or wallet addresses, making transactions with them a sanctions violation under strict liability. An OFAC designation creates global compliance risk for any financial institution that processed the designated funds.
- IRGC
- The Islamic Revolutionary Guard Corps, an Iranian military force with extensive economic interests, designated as a foreign terrorist organisation by the US. It is alleged to use cryptocurrency networks to move funds outside the formal banking system. Blockchain analytics firms estimate a substantial share of Iran’s $8–10 billion annual crypto flow is IRGC-connected.
RELATED STORIES
