Loading story…
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) designated Iranian cryptocurrency exchange BitBank—also known as BitBank3—under Executive Order 13902 for its alleged role in financier Babak Zanjani’s digital-asset network. Treasury said the exchange transferred hundreds of millions of dollars’ worth of Bitcoin to Iran’s Islamic Revolutionary Guard Corps (IRGC) in June and July 2026, and that sanctioned maritime-services firm Hormuz Safe Marine Services Authority used BitBank to process cryptocurrency payments collected for services in the Strait of Hormuz.
OFAC also sanctioned BitBank developer Pishtaz Simorgh Electronic Trade Company and three executives tied to the Dot One Value Creation Group. The action extends prior measures against Zanjani-linked entities including Zedcex, Zedxion, ZedPay, ZEDX DMCC, BZ Diamond, and other Dot One operations, which include the MyDot platform, DOTO token, Dot One Smart Chain, and exchange services. Treasury’s public announcement did not provide wallet addresses, transaction hashes, counterparties, or other on-chain evidence supporting the stated transfer total.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
OFAC designated Iranian digital-asset exchange BitBank, also known as BitBank3, under Executive Order 13902 as part of Operation Economic Outcast. It also designated BitBank software developer Pishtaz Simorgh Electronic Trade Company and executives Mohammad Mahdi Zaker Hossein, Seyed Adel Heidari/Heydari, and Hossein Ali Zaker Hossein for their roles in Zanjani's network.
The United States sanctioned Hormuz Safe Marine Services Authority, which Treasury described as providing insurance, security, and other vessel services in the Strait of Hormuz and accepting Bitcoin and other cryptoassets as payment.
OFAC designated four additional individuals and nine entities in Zanjani's network, including Dot One Value Creation Group, ZEDX DMCC, ZedPay, BZ Diamond, transportation companies, and associated parties involved in digital-asset, gold-trading, transportation, and financial activities.
Treasury alleged that the Hormuz Safe Marine Services Authority began using BitBank to transfer cryptocurrency payments collected for its Strait of Hormuz maritime services to the Iranian regime.
OFAC designated Babak Zanjani, Zedcex Exchange, and Zedxion Exchange in what was described as the first U.S. sanctions action against digital-asset exchanges for supporting the IRGC.
A TRM Labs investigation identified approximately USD 1 billion in IRGC-linked activity through Zedcex and Zedxion during 2023–2025, with roughly 56% of observed transaction volume assessed as linked to the IRGC.
Treasury stated that Babak Zanjani had advertised BitBank on his social-media accounts since at least 2024.
TRM Labs assessed that IRGC-linked activity through Zedcex and Zedxion peaked at approximately USD 619 million, representing an estimated 87% of observed activity that year.
Zedcex Exchange Ltd was incorporated in the United Kingdom after Zanjani's formal departure from Zedxion. TRM Labs assessed that Zedcex and Zedxion operated as a single exchange operation through multiple legal entities.
Zedxion Exchange Ltd was incorporated in the United Kingdom. Later that year, UK records listed Babak Morteza, identified as a name used by Babak Zanjani in UK filings, as a director and person with significant control.
Treasury alleged that a network associated with Babak Zanjani used BitBank between June and July to transfer hundreds of millions of dollars in Bitcoin to the IRGC. The public Treasury release did not provide wallet addresses, transaction hashes, individual values, or other public on-chain evidence for the claimed total.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury's Office of Foreign Assets Control (**OFAC**) sanctioned four Tehran-based cryptocurrency exchanges—**Nobitex, Wallex, Bitpin, and Ramzinex**—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said **Nobitex**, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the **Islamic Revolutionary Guard Corps (IRGC)**, including IRGC-affiliated ransomware operators and other illicit finance activity. The designations, issued under the Trump administration's **Economic Fury** campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the **SDN** list, while reporting that **Ramzinex** alone processed more than **$2.45 billion** in transactions and that Iran's crypto ecosystem received nearly **$7.8 billion** in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Jun 29, 2026
The U.S. Treasury expanded sanctions against Iranian businessman **Babak Morteza Zanjani** and a broader commercial network accused of helping **Zedcex Exchange Ltd.** and **Zedxion Exchange Ltd.** evade sanctions and move funds for Iran’s **Islamic Revolutionary Guard Corps**. The action designated four individuals and nine entities, including **Bahareh Morteza Zanjani**, **Solmaz Bani**, **Mehdi Rezazadeh**, **Sukhrob Oimakhmadov**, **ZEDX DMCC**, **ZedPay**, **BZ Diamond DMCC**, and multiple **Dot One** companies operating across the UAE, Turkey, and Iran. Treasury said the measures extend beyond the exchanges themselves to target a vertically integrated ecosystem spanning digital assets, payments, gold, transportation, aviation, rail, and travel. Reporting on the sanctions says the network used shared leadership, rotating corporate entities, and persistent digital infrastructure to support the exchanges and related commercial operations. TRM Labs previously said Zedcex and Zedxion processed **tens of billions of dollars** in cryptocurrency transactions, while separate reporting linked the exchanges to more than **$10 million** in transfers to **Sa’id Ahmad Muhammad al-Jamal**, a senior Houthi financial official. The sanctions freeze U.S.-based property and interests of the designated parties, prohibit U.S. persons from dealing with them, and expose foreign firms that continue assisting the network to secondary sanctions risk.
Jul 27, 2026
The U.S. Treasury launched **Operation Economic Outcast**, a sweeping sanctions campaign targeting the Iranian regime and its support network, designating nearly 60 entities, individuals, and vessels and issuing five sectoral sanctions determinations under Executive Order `13902`. Treasury also explicitly identified **digital assets** as a sanctionable Iranian sector, a move that raises secondary-sanctions exposure for exchanges and other firms that facilitate significant transactions involving Iranian digital asset businesses. A key cyber component of the action targeted five individuals tied to the Iran-based **Mabna Institute**, whose members were also charged by the U.S. Department of Justice for an alleged long-running hacking-for-hire operation conducted on behalf of the **IRGC** and other Iranian clients. OFAC published 30 cryptocurrency addresses linked to four Mabna defendants across **Bitcoin, Ethereum, and TRON**; blockchain analysis cited in reporting said the addresses received about **$16.8 million** since 2018, with roughly **92%** of the volume concentrated in wallets attributed to **Keyvan Fayaz**.
Aug 25, 2026