Treasury's Crypto Chokepoint Strategy: Inside the July 10 Strike on Iran's Shadow Exchange Network

The US Treasury's July 10 sanctions against financier Ali Ansari and three Iranian currency exchange houses mark a deliberate pivot from oil-sanctions plumbing to the crypto rails that let Tehran's shadow banking system survive — and TRM Labs data shows the stakes are now measured in the billions, not millions.

Executive Summary

OFAC sanctioned three Iranian exchange houses on July 10 — Mohammad Darbani and Partners, Lavasani and Partners, and Khandan Exchange — that collectively hold hundreds of millions of dollars on behalf of sanctioned Iranian banks, with Khandan alone sitting on more than $117 million.
This is a distinct escalation from the July 8 action, which revoked Iran's temporary oil-waiver and blocked over $130 million in Central Bank of Iran-linked digital wallets; the July 10 strike instead targets the human financier (Ali Ansari) and the exchange-house infrastructure that launders proceeds for the IRGC and Supreme Leader's office.
TRM Labs data puts the scale of Iran's crypto-enabled evasion at $8–10 billion in transaction volume last year, with CoinEx alone identified as a $3.84 billion conduit and Zedcex/Zedxion processing roughly $1 billion tied directly to the IRGC.
Enforcement is increasingly stablecoin-centric: TRM Labs traced a scheme dubbed "National–Tether," in which roughly $67 million from the Central Bank of Iran moved through CoinEx addresses via a multi-chain laundering structure run by the National Iranian Exchange between June 2025 and June 2026.
Watch General License X1's July 17 wind-down deadline — the expiration of authorized oil-transaction wind-down activity will likely trigger a fresh wave of both oil and crypto-adjacent designations as Treasury closes remaining sanctions-relief windows.

Background & Market Context

This report is a follow-up to prior coverage of the July 8, 2026 action, in which Treasury revoked Iran's temporary oil-sales waiver following drone and projectile strikes on three vessels transiting the Strait of Hormuz, sanctioned more than 50 entities including shipping companies and digital wallets, and blocked over $130 million tied to the Central Bank of Iran. That action was fundamentally about physical trade — oil tankers, shipping intermediaries, and the "shadow fleet" — with crypto wallets appearing mainly as a secondary blocking target. The July 10 action covered here is different in kind: it is the first in this cycle to name a specific human financier (Ali Ansari) and to go after the exchange-house layer of Iran's shadow banking system that has, for years, functioned as the bridge between sanctioned Iranian banks and the global financial and crypto system.

The timing is not incidental. Iran's brief ceasefire-adjacent thaw — codified in a June 2026 interim memorandum of understanding that produced General License X, authorizing limited Iranian oil sales through August 21 — collapsed after the Strait of Hormuz tanker attacks. Treasury responded by revoking General License X and issuing General License X1, a strictly bounded "wind-down" authorization that expires July 17, 2026. Every transaction that relied on the temporary oil-sales relief must now be unwound within that ten-day window, which means the sanctions apparatus is reverting to maximum-pressure mode precisely as this crypto-exchange enforcement action lands. In practice, Washington is squeezing Iran's revenue on two fronts simultaneously: closing the legal oil channel and dismantling the informal financial network — exchange houses, front companies, and crypto intermediaries — that keeps hard currency flowing to the regime when formal channels are blocked.

The macro backdrop matters for crypto markets specifically because Iran has become one of the most sophisticated state-level users of digital assets for sanctions evasion. Chainalysis estimated Iranian crypto holdings at $7.8 billion in 2025, with the IRGC alone accounting for roughly half. TRM Labs separately put total Iran-linked on-chain transaction volume at $8–10 billion for the past year. That scale — comparable to a mid-sized national crypto market — is why Treasury's Office of Foreign Assets Control (OFAC) has shifted from occasional wallet blocklisting toward systematic targeting of the exchange infrastructure itself, following the same "financial chokepoint" doctrine it has long applied to correspondent banking.

The exchange houses named on July 10 are not crypto platforms per se — they are traditional currency exchange businesses — but they sit at the exact junction where crypto-derived and fiat-derived sanctions evasion converge. Ansari's network moved wealth through European real estate and offshore corporate structures; the exchange houses moved liquidity for sanctioned banks through layers of shell companies. Treasury's public framing links both to the same goal: preventing Iran's regime elites and the IRGC from monetizing oil revenue and crypto flows into usable hard currency abroad.

Key Developments

October 30, 2025 — UK sanctions Ali Ansari. The UK government first designated Ansari, freezing assets, imposing a travel ban, and issuing a director disqualification order tied to his role as principal shareholder in Ayandeh Bank, which collapsed the same month with roughly $5 billion in debts. His European property empire was valued at approximately €400 million ($440 million), spread across Marbella, Germany, and the UK.

January 31, 2026 — First-ever US sanctions on Iran-linked crypto exchanges. OFAC designated UK-registered Zedcex and Zedxion, marking the first time Treasury directly sanctioned crypto exchanges for enabling Iran's financial sector. One of the two platforms had processed over $94 billion in total transactions since 2022.

February 3, 2026 — TRM Labs confirms broader Treasury probe. TRM Labs disclosed that Treasury was actively investigating additional crypto exchanges for facilitating Iran sanctions evasion, with Zedcex alone linked to roughly $1 billion in IRGC-connected transactions — 56% of its total volume, spiking to 87% in 2024.

May 30, 2026 — Treasury announces ~$1 billion in crypto seizures. As part of "Operation Economic Fury," Treasury Secretary Scott Bessent disclosed that the US had seized approximately $1 billion in Iranian crypto from exchanges and wallets since the start of the broader campaign against Iran.

June 2, 2026 — Nobitex, Wallex, Bitpin, and Ramzinex sanctioned. OFAC blacklisted Iran's largest domestic crypto exchange, Nobitex, alongside Wallex, Bitpin, and Ramzinex, citing links to IRGC-connected transactions, ransomware payments, and asset movement out of Iran following US bombing operations earlier in 2026.

June 25, 2026 — TRM Labs flags CoinEx as Iran's primary international exit ramp. TRM Labs traced more than $3.84 billion in blockchain-verified flows between Seychelles-registered CoinEx and over 60 sanctioned Iranian entities since 2019, including a "National–Tether" scheme that moved roughly $67 million in Central Bank of Iran funds through CoinEx addresses between June 2025 and June 2026. CoinEx publicly disputed the figures as "inaccurate."

July 7–8, 2026 — Oil waiver revoked, $130M in wallets blocked. Treasury revoked General License X after Strait of Hormuz tanker strikes, sanctioned more than 50 entities (shipping companies, vessels, wallets, individuals), and blocked over $130 million in Central Bank of Iran-linked digital wallets. General License X1 authorized a wind-down window through July 17.

July 10, 2026 — Ali Ansari and three exchange houses sanctioned by OFAC. Treasury designated Ansari directly for the first time in the US, alongside Mohammad Darbani and Partners, Lavasani and Partners, and Khandan Exchange — currency exchange houses moving billions annually for sanctioned Iranian banks through shell-company layers. Khandan alone was found holding over $117 million in foreign currency for sanctioned bank customers.

Technical Analysis

The mechanics of Iran's exchange-house-to-crypto pipeline follow a now well-documented three-layer architecture. At the base layer, sanctioned Iranian banks — cut off from SWIFT and correspondent banking since 2018 — deposit rial or dollar-denominated balances with domestic currency exchange houses like Darbani, Lavasani, and Khandan. These exchange houses function as informal hawala-adjacent intermediaries: they hold foreign-currency balances on behalf of the banks and settle obligations through networks of shell companies registered in jurisdictions like the UAE, Cyprus, and the UK, rather than through direct wire transfers that would trip sanctions screening.

At the second layer, those shell companies interface with crypto on- and off-ramps. TRM Labs' CoinEx findings illustrate the mechanism precisely: the "National–Tether" scheme routed Central Bank of Iran-linked funds through a multi-chain structure — converting rial-denominated value into stablecoins (primarily USDT), moving those stablecoins across multiple blockchains to obscure the trail, and ultimately cashing out through CoinEx's Seychelles-domiciled infrastructure into usable foreign currency. This is functionally identical to how Zedcex operated for the IRGC — presenting as a conventional retail crypto exchange while in fact serving as dedicated laundering infrastructure, with IRGC-linked volume peaking at 87% of total throughput in 2024.

At the third layer sits domestic Iranian crypto exchanges — Nobitex, Wallex, Bitpin, Ramzinex — which aggregate retail and institutional crypto demand inside Iran and feed liquidity into the international shell-company network. Treasury's sanctions against these platforms in June specifically cited their role in moving assets out of Iran following US military strikes, suggesting the domestic exchanges function as an emergency capital-flight valve for regime-linked wealth during periods of acute pressure.

What makes the July 10 action technically significant is that it attacks the human and corporate layer rather than the blockchain layer. Where the January and June designations targeted crypto exchanges directly — assets that can, in theory, be blocked at the protocol or custodian level — the Ansari and exchange-house designations target the fiat-side plumbing that crypto ultimately has to interface with to become spendable dollars, euros, or real estate. This reflects Treasury's recognition that blocking crypto exchanges alone doesn't stop evasion if the fiat off-ramp (property purchases in Marbella, corporate structures in Cyprus) remains open. It's the sanctions equivalent of attacking both the pipe and the reservoir.

flowchart TD
    A[Sanctioned Iranian Banks] -->|deposit FX balances| B[Exchange Houses<br/>Darbani / Lavasani / Khandan]
    B -->|shell company layering| C[Offshore Front Companies<br/>UAE, Cyprus, UK]
    C -->|stablecoin conversion| D[Domestic Crypto Exchanges<br/>Nobitex / Wallex / Bitpin]
    D -->|cross-chain routing| E[International Exit Exchanges<br/>CoinEx / Zedcex-Zedxion]
    E -->|cash-out| F[Hard Currency Abroad]
    F -->|acquires| G[Real Estate & Assets<br/>Ansari's €400M portfolio]
    H[IRGC / Supreme Leader's Office] -.beneficiary.-> B
    H -.beneficiary.-> D
    I[OFAC Designations] -->|blocks| B
    I -->|blocks| D
    I -->|blocks| E
    I -->|freezes| G

On-Chain & Market Data

Metric	Value	Change	Source
Iran total crypto transaction volume (trailing 12mo)	$8–10 billion	New estimate	TRM Labs / Chainalysis
CoinEx flows tied to sanctioned Iranian entities (since 2019)	$3.84 billion	New disclosure (Jun 25, 2026)	TRM Labs
Zedcex volume linked to IRGC	~$1 billion (56% of total, peak 87% in 2024)	New disclosure (Feb 2026)	TRM Labs
Central Bank of Iran funds via "National–Tether" scheme	$67 million (Jun 2025–Jun 2026)	New scheme identified	TRM Labs
Total crypto seized under Operation Economic Fury	~$1 billion	Cumulative since war onset	US Treasury (Bessent, May 30, 2026)
Digital wallets blocked, July 8 action	$130+ million	New (Jul 8, 2026)	US Treasury
Khandan Exchange FX holdings for sanctioned banks	$117+ million	New designation (Jul 10, 2026)	US Treasury press release
Ansari's overseas property portfolio	~$440 million (€400M)	Frozen (UK, Oct 2025; US exposure pending)	Cryptobriefing / UK sanctions filing

The data shows a clear scaling pattern: what began as isolated exchange-level designations in January 2026 (Zedcex/Zedxion, $94 billion cumulative volume since 2022) has evolved into a systemic mapping of Iran's entire crypto-fiat conversion pipeline, now quantified in the high single-digit billions annually. The CoinEx and Zedcex figures are particularly notable because they represent identified illicit share of exchange volume — TechTimes reported CoinEx's illicit Iran-linked share at roughly 8% of total flows, meaning the $3.84 billion figure sits atop a much larger legitimate business, which is precisely why enforcement against these exchanges is diplomatically and legally contentious (CoinEx has publicly disputed TRM Labs' figures).

The $117 million figure at Khandan Exchange is small relative to CoinEx's billions, but it matters because it's a seizable, US-jurisdiction-adjacent balance tied directly to named sanctioned banks — unlike crypto flows, which are harder to freeze once off-chain. This is likely why Treasury is now running parallel tracks: freezing what can be frozen in traditional finance (exchange house balances, real estate) while building the evidentiary and designation infrastructure to pressure crypto exchanges through reputational and correspondent-banking risk rather than direct asset seizure, which is far harder to execute against offshore-domiciled platforms like CoinEx (Seychelles) or the former Zedcex/Zedxion (UK).

U.S. sanctions Nobitex, other Iranian crypto exchanges amid ongoing war

Competitive Landscape

CoinEx now sits at the center of enforcement scrutiny as the largest identified international exit ramp, with $3.84 billion in flagged flows — but its Seychelles domicile and public denial of TRM Labs' figures illustrate the jurisdictional arbitrage problem: OFAC designation carries reputational and correspondent-banking consequences, but enforcement teeth depend on cooperation from non-US regulators, which Seychelles has historically not provided robustly.

Zedcex/Zedxion represent the "caught early" case study — UK-registered, sanctioned in January 2026, and functionally shut down as a going concern once designated, since UK registration meant direct exposure to coordinated US-UK enforcement (mirroring the Ansari precedent, where the UK acted first in October 2025 and the US followed in July 2026).

Nobitex and Iran's domestic exchange bloc (Wallex, Bitpin, Ramzinex) operate under a fundamentally different risk model: they are already fully cut off from Western correspondent banking and crypto liquidity, so OFAC designation is more symbolic than operationally crippling — it formalizes what was already true in practice, though it does complicate any bridge liquidity these platforms had via intermediary exchanges.

Binance, while not directly named in the July 10 action, remains the shadow benchmark against which all these cases are measured: its 2023 $968.6 million OFAC/FinCEN settlement for sanctions violations (including Iran exposure) established the compliance bar every major exchange now cites defensively. The absence of Binance from this round of designations suggests its post-settlement geofencing and KYC remediation have — at least publicly — kept it outside the current enforcement wave, a competitive advantage over exchanges like CoinEx that have not undergone equivalent remediation.

Stakeholder Analysis

Investors and funds with exposure to CoinEx, or counterparties that route liquidity through it, face growing secondary-sanctions risk; any US person or entity processing transactions with a formally designated exchange house or its shell-company network could face enforcement exposure even without direct Iran dealings, given OFAC's 50% rule on entities owned by blocked parties.

Retail users in Iran are the most immediate casualties — each domestic exchange designation (Nobitex, Wallex, Bitpin, Ramzinex) further isolates ordinary Iranians from global crypto liquidity, pushing them toward peer-to-peer and unregulated channels with worse pricing and higher fraud risk, even though the sanctions are nominally targeted at regime elites and the IRGC.

Exchange developers and compliance teams globally now have a concrete new due-diligence signal: TRM Labs' "National–Tether" methodology (tracing structured multi-chain stablecoin flows to specific state-linked programs) is likely to become a template other compliance vendors replicate, raising the bar for what "reasonable" sanctions-screening looks like industry-wide.

Regulators and policymakers outside the US — particularly the UK (which sanctioned Ansari nine months before Washington did) and EU — are being pulled into tighter coordination, but the Seychelles/UAE/Cyprus jurisdictions where much of this shell-company activity is domiciled remain the weak link, and neither this action nor prior ones has produced enforcement cooperation from those jurisdictions.

Risk Assessment

Jurisdictional arbitrage undermines enforcement — CoinEx's Seychelles domicile and public rejection of TRM Labs' findings shows that OFAC designation alone doesn't guarantee operational disruption when the platform sits outside US/UK/EU legal reach. Severity: High. Probability: Already occurring.
Stablecoin-specific evasion (the "National–Tether" pattern) is likely underreported — if $67 million moved through one identified scheme over 12 months, the true scale of stablecoin-based Iran sanctions evasion is almost certainly a multiple of publicly disclosed figures, since TRM Labs' methodology only captures flows it can trace. Severity: High. Probability: High.
Collateral impact on legitimate CoinEx/Binance-adjacent users — broad-based exchange designations risk freezing or delaying access for non-Iranian users incidentally routed through flagged liquidity pools, creating compliance friction across the broader crypto industry. Severity: Medium. Probability: Medium.
General License X1 expiration (July 17) could trigger a fresh escalation spiral — as wind-down authorizations lapse, Treasury is likely to issue additional oil and crypto-adjacent designations in rapid succession, creating volatility risk for any crypto assets or exchanges with residual Iran exposure. Severity: Medium-High. Probability: High (base case, given the pattern from June–July).

CoinEx processed $3.8 billion in Iran-linked funds, acting as crypto gateway: TRM Labs | The Block

Investment & Strategic Implications

For funds and institutional allocators, the practical takeaway is that counterparty due diligence now needs to extend beyond direct Iran exposure to second-order exposure via exchanges like CoinEx that process large volumes of legitimate business alongside flagged Iran-linked flows — an 8% illicit share, as TRM Labs estimated, is enough to trigger secondary-sanctions risk for connected entities even when the platform itself isn't yet formally designated. Funds with any CoinEx, Nobitex-adjacent, or Seychelles/UAE-shell-company counterparty exposure should be running enhanced screening now, not waiting for a formal SDN listing.

For protocols and stablecoin issuers, the "National–Tether" scheme is a wake-up call specific to Tether and comparable dollar-pegged stablecoins: Treasury and TRM Labs' ability to trace $67 million through a structured multi-chain laundering operation demonstrates that stablecoin transparency, while enabling this kind of forensic tracing, has not yet stopped the underlying evasion — it has only made it detectable after the fact. Issuers should expect continued pressure to implement more proactive, real-time screening against known Iran-linked address clusters rather than relying on retrospective freezes (as Tether did with its $344 million freeze referenced in April 2026 coverage).

For builders and exchange compliance teams, the shift from January's exchange-only designations to July's exchange-house-plus-financier designations signals that OFAC is building a full-network map of Iran's crypto-fiat conversion infrastructure — implying more, not fewer, designations are coming as Treasury connects additional nodes (shell companies, correspondent exchange houses, secondary crypto platforms) in the network TRM Labs and Chainalysis have been documenting. Exchanges that proactively geofence and screen against this expanding designation list will be better positioned than those reacting to each new SDN addition individually.

Outlook: 30 / 180 / 365 Days

30 days: Expect at least one additional OFAC action tied to the July 17 General License X1 wind-down deadline, likely combining renewed oil-sector designations with further crypto exchange or wallet blocks, given the pattern of paired oil/crypto actions on July 8 and July 10.
180 days: TRM Labs or Chainalysis will likely publish a follow-up report quantifying whether CoinEx's Iran-linked volume declined post-designation-pressure or migrated to a new, less-scrutinized offshore exchange — the Zedcex-to-CoinEx succession pattern suggests displacement rather than elimination is the more probable outcome absent Seychelles-level enforcement cooperation.
365 days: The precedent set by targeting exchange houses and individual financiers (rather than exchanges alone) will likely become the template for other sanctions programs (Russia, North Korea, Venezuela), pushing global stablecoin issuers and major exchanges toward standardized, TRM-Labs-style forensic screening as a baseline compliance requirement rather than a differentiator.