TRM Labs has traced about $16.8 million across 30 cryptocurrency wallets linked to people sanctioned by the United States for ties to Iran. The finding adds a new layer to the growing focus on crypto use by sanctioned groups and people.
The addresses were designated by the U.S. Treasury’s Office of Foreign Assets Control, known as OFAC. TRM Labs said the wallets were linked to four defendants tied to Iran’s Mabna Institute.
The 30 addresses had received about $16.8 million in total since January 2018. The funds moved across Bitcoin, Ethereum, and TRON. The figure covers past activity linked to the addresses. It does not mean that the wallets still hold $16.8 million today.
This difference matters for banks, crypto firms, exchanges, and other companies that must follow sanctions rules. A wallet can receive a large amount over several years and later hold only a small balance. A simple check of the wallet’s current balance would not show its full history.
Only About $202,662 Remained
TRM Labs found that the 30 addresses held only about $202,662 at the time of its analysis. This is far below the $16.8 million that passed through the wallets.
The gap shows why transaction history can be as important as a current balance. Money can move from one wallet to another, pass through a crypto service, or reach another person or business. If a compliance team checks only what an address holds at one point in time, it may miss earlier exposure.
For sanctions teams, this can create a difficult task. They may need to look at old deposits, withdrawals, transfers, and links between wallets. They may also need to review whether a customer or service had contact with a designated address before the latest sanctions action.
Most of the Money Came Through Ten Addresses
The activity was not spread evenly across all 30 wallets. TRM Labs said ten addresses linked to Keyvan Fayaz accounted for about $15.5 million.
That amount made up about 92% of the total $16.8 million. This concentration gives investigators a useful place to start.
The data also shows why wallet-by-wallet review can miss the bigger picture. A group may use many addresses, but a small number of those wallets can handle most of the funds. Blockchain analysis can help connect these addresses and show how money moved between them.
For a compliance team, such links can help create a clearer view of possible exposure. A single wallet alert may look limited on its own. A wider review of connected addresses may show a much larger pattern.
Why Transaction History Matters
Sanctions screening often starts with names, companies, and wallet addresses. Crypto adds another problem because funds can move between many addresses in a short time.
A sanctioned wallet does not need to hold funds for a long period to create a compliance concern. A transfer into or out of that address can become important even after the money has moved elsewhere.
TRM Labs has advised firms to check transaction history for exposure to the designated addresses. This means a company may need to ask whether it received funds from one of these wallets, sent funds to them, or had another type of connection.
Such checks can also help firms find older exposure. A customer may have had a crypto transfer with a sanctioned address months or years before a new sanctions designation. Without a review of past transactions, that link may remain hidden.
The Iran Crypto Link
The case also fits into a much wider concern about crypto activity tied to Iran. TRM Labs estimates that about $10 billion in Iranian crypto activity took place in 2025.
Its research also estimates that illicit activity made up just over $580 million of that amount. These figures do not mean that all Iranian crypto activity is illegal or subject to sanctions. Iran has a wider digital asset market, and lawful activity can exist alongside activity that raises sanctions or crime concerns.
The larger figures do, however, show why U.S. authorities and financial crime teams continue to pay close attention to crypto flows connected to Iran.
The Mabna Institute case is also notable because it shows how crypto can remain part of a wider financial network. Digital assets can offer speed and access across borders, while blockchain records can also leave a public trail that investigators can study.
What It Means for Compliance Teams
The new data may push compliance teams to take a broader approach to sanctions screening. A basic address match is useful, but it may not be enough.
Firms may need to examine the history of transactions connected to designated wallets. They may also need to review related addresses and check whether funds moved through known crypto services.
The key question is not simply whether a customer holds funds linked to a sanctioned wallet today. The more useful question can be whether the customer ever had a relevant financial connection to that wallet.
This can be especially important for crypto exchanges and other digital asset firms. A platform may have processed a transaction before a wallet became subject to a new sanctions action. A later review could reveal that the platform had historical exposure that was not clear at the time.
A Challenge for Sanctions Enforcement
The case also shows the changing nature of sanctions enforcement. Traditional financial systems often rely on banks and other regulated institutions to identify suspicious activity. Crypto adds a public blockchain layer where investigators can follow transfers across addresses.
That transparency can help authorities trace funds. At the same time, the large number of wallets and transactions can make the task difficult. Funds may pass through several addresses before they reach another service or person.
This creates a need for better tools and stronger review processes. Blockchain analytics can help connect addresses, identify transaction patterns, and show where funds moved. Human review is still important because a transaction link does not automatically prove that a person or company broke sanctions rules.
The $16.8 Million Needs Context
The $16.8 million figure is important, but it needs the right context. It represents the total value that the 30 designated addresses received since January 2018, not the amount they held when TRM Labs reviewed them.
Only about $202,662 remained across the wallets at that time. Ten addresses linked to Keyvan Fayaz accounted for about $15.5 million, or 92% of the total.
These details change how the data should be read. The main value of the finding may not be the money that remains in the wallets. Instead, it may be the record of past transfers and the links that those transfers create.
What Comes Next
The TRM Labs findings could give compliance teams another reason to review historical crypto activity tied to sanctioned Iran-linked addresses. Firms may need to look beyond current balances and examine the full path of funds.
For regulators and investigators, the data can also provide leads for further review. A wallet that received funds years ago may connect to other addresses, services, or customers that are not obvious from a simple sanctions list check.
The case shows one of the central challenges in modern sanctions enforcement. Digital assets can move quickly across borders, but their blockchain records can also leave a lasting trail. The task for compliance teams is to understand that trail and decide whether a transaction creates a real sanctions concern.
As U.S. sanctions pressure on Iran’s financial and crypto networks continues, findings such as this are likely to receive more attention. The $16.8 million traced by TRM Labs is therefore more than a single transaction figure. It is a reminder that sanctions risk can remain visible on the blockchain long after the original funds have moved.
ALSO READ: Crypto Market Cap Hits $2.75T as Bitcoin Leads Rally
