Loading story…
The U.S. Treasury expanded sanctions against Iranian businessman Babak Morteza Zanjani and a broader commercial network accused of helping Zedcex Exchange Ltd. and Zedxion Exchange Ltd. evade sanctions and move funds for Iran’s Islamic Revolutionary Guard Corps. The action designated four individuals and nine entities, including Bahareh Morteza Zanjani, Solmaz Bani, Mehdi Rezazadeh, Sukhrob Oimakhmadov, ZEDX DMCC, ZedPay, BZ Diamond DMCC, and multiple Dot One companies operating across the UAE, Turkey, and Iran. Treasury said the measures extend beyond the exchanges themselves to target a vertically integrated ecosystem spanning digital assets, payments, gold, transportation, aviation, rail, and travel.
Reporting on the sanctions says the network used shared leadership, rotating corporate entities, and persistent digital infrastructure to support the exchanges and related commercial operations. TRM Labs previously said Zedcex and Zedxion processed tens of billions of dollars in cryptocurrency transactions, while separate reporting linked the exchanges to more than $10 million in transfers to Sa’id Ahmad Muhammad al-Jamal, a senior Houthi financial official. The sanctions freeze U.S.-based property and interests of the designated parties, prohibit U.S. persons from dealing with them, and expose foreign firms that continue assisting the network to secondary sanctions risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-24, the U.S. Treasury's Office of Foreign Assets Control expanded sanctions against Babak Zanjani and the Dot One commercial network, broadening prior action beyond the Zedcex and Zedxion exchanges into gold, payments, transportation, travel, and other sectors. The action designated multiple UAE-, Turkey-, and Iran-linked entities and individuals, including ZEDX DMCC, ZedPay, BZ Diamond DMCC, several Dot One companies, and ZedPay CEO Mehdi Rezazadeh.
An earlier OFAC action sanctioned Zedcex Exchange Ltd and Zedxion Exchange Ltd, which TRM Labs describes as the first digital asset exchanges designated for supporting the IRGC. The references do not provide a specific date for that earlier action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
occrp.org
Open sourcetrmlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury's Office of Foreign Assets Control (**OFAC**) sanctioned four Tehran-based cryptocurrency exchanges—**Nobitex, Wallex, Bitpin, and Ramzinex**—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said **Nobitex**, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the **Islamic Revolutionary Guard Corps (IRGC)**, including IRGC-affiliated ransomware operators and other illicit finance activity. The designations, issued under the Trump administration's **Economic Fury** campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the **SDN** list, while reporting that **Ramzinex** alone processed more than **$2.45 billion** in transactions and that Iran's crypto ecosystem received nearly **$7.8 billion** in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Jun 29, 2026
The U.S. Treasury sanctioned two Iranian firms—**HormuzSafe Marine Services Authority** and **Persian Gulf Marine Insurance Company**—for allegedly supporting an IRGC-backed extortion scheme targeting commercial shipping in the Strait of Hormuz. Treasury said the companies sold maritime insurance that benefited or was approved by the Islamic Revolutionary Guard Corps, including coverage against vessel seizure risks created by Iran itself, and accepted digital assets such as **Bitcoin** to help evade sanctions. The action was issued under **Executive Order 13902** as part of broader pressure on Iran’s petroleum, petrochemical, and financial sectors. OFAC also sanctioned eight shipping companies in China, Hong Kong, and the Marshall Islands and blocked eight vessels tied to Iran’s shadow fleet for transporting Iranian crude and petroleum products, largely to China and in some cases the UAE. Treasury said more than 100 vessels linked to Iran’s shadow fleet have been sanctioned since the start of the year, while maritime risk reporting separately described heightened regional tensions, including increased IRGC small-boat activity in Hormuz and signs of disrupted export operations around key Iranian and regional energy shipping routes.
Jul 30, 2026
The U.S. Treasury Department’s Office of Foreign Assets Control expanded sanctions on the **Central Bank of Iran** by adding four cryptocurrency wallet addresses as identifiers under an existing designation that also covers the **National Development Fund of Iran**. Treasury had previously sanctioned the bank and fund for providing financial support to the Islamic Revolutionary Guard Corps-Qods Force and other activities tied to Iran’s regional operations. Blockchain analysis cited in reporting said the newly listed wallets received more than **$165 million** in stablecoins, and **Tether** froze about **$131 million** linked to those addresses after the designation update. The action highlights U.S. efforts to disrupt alleged sanctions evasion through digital assets, with reporting stating that wallets attributed to the Central Bank of Iran have been used to move funds to regional partners including **Hezbollah** and that Tether has now frozen nearly **$475 million** tied to OFAC-identified Central Bank of Iran addresses.
Jul 16, 2026