Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

OFAC sanctions Shelbit crypto network

Regulatory/Legal Action
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

OFAC sanctioned Shelbit, founder Siavash Kayvanpour, and affiliated entities in a move targeting an alleged $6bn illicit crypto network tied to IRGC wallets and sanctions evasion. The action also named Aban Tether and entities across the UAE, Poland, and Georgia. It tightens enforcement pressure on a cross-border blockchain conduit that authorities say was used for illicit finance.

Related Happenings

OFAC sanctions First VPN Service and two individuals

Regulatory/Legal Action
H score27 First: 14.07.2026 11:02 Last: 14.07.2026 11:02 Sources 1

About this happening: OFAC sanctioned First VPN Service (1VPNS), Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling ransomware attacks and helping malicious software...

Open Happening

AudiA6 laundering ecosystem and Dark2Web forum

Threat Actor Meta
H score31 First: 11.06.2026 18:55 Last: 11.06.2026 18:55 Sources 1

About this happening: AudiA6 was disrupted as an industrial-scale cryptocurrency laundering service used by ransomware gangs and other cybercriminal networks. Europol said the ecosystem lau...

Open Happening

OFAC sanctions Nobitex and designates executives

Regulatory/Legal Action
H score21 First: 03.06.2026 23:31 Last: 03.06.2026 23:31 Sources 1

About this happening: OFAC sanctioned Nobitex and designated its executives and founders, freezing covered U.S.-jurisdiction assets and blocking U.S. business with the exchange and its leaders....

Open Happening

First VPN Service as criminal VPN infrastructure for ransomware and fraud operators

Threat Actor Meta
H score18 First: 22.05.2026 20:35 Last: 22.05.2026 20:35 Sources 1

About this happening: First VPN Service functioned as a criminal VPN layer that let ransomware, fraud, and data theft operators hide their identities, expanding the reach and resilience of undergro...

Latest development: 14.07.2026 11:02

The U.S. Treasury Department’s OFAC sanctioned First VPN Service (1VPNS), Ukrainian administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for supporting ransomware actors; Treasury said First VPN Service was used to hide attack origins, deploy malware, and manage exfiltrated data, and that victims included U.S. businesses, financial services companies, hospitals, and municipal governments.

Open Happening

U.S. Treasury sanctions Kok An scam network

Regulatory/Legal Action
H score40 First: 04.05.2026 08:59 Last: 04.05.2026 08:59 Sources 1

About this happening: The U.S. Treasury Department sanctioned Cambodian Senator Kok An and affiliates tied to cyber scam compounds, escalating financial and legal pressure on a network accu...

Open Happening

Timeline

  1. 10.08.2026 03:00 2 articles · 10h ago

    OFAC sanctions Shelbit, Siavash Kayvanpour, and Aban Tether

    Legal Policy Action Update

    The US Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned Shelbit, founder Siavash Kayvanpour, affiliated entities across the UAE, Poland and Georgia, and the Iran-based exchange Aban Tether. Treasury said the action targeted a network tied to money flows into IRGC-controlled wallets and cited more than $6bn in illicit blockchain movement, including transfers to Hamas-controlled wallets and exposure to sanctioned Russian and Central Asian services.

    Show sources
    Open in new tab
  2. 07.08.2026 03:00 1 articles · 3d ago

    TRM Labs traces Shelbit's stablecoin conduit to IRGC wallets

    Initial Disclosure

    TRM Labs published analysis saying Shelbit functioned as a settlement conduit rather than a customer-facing exchange, with inbound and outbound amounts matching to within 0.1% and wallets holding virtually no balances. The analysis said most activity moved on TRON in dollar-pegged stablecoins, wallet infrastructure was rebuilt every one to four months, and flows were tied to IRGC-controlled wallets, A7, Grinex, Rapira, and large online gambling exposure.

    Show sources
    Open in new tab