The US Treasury named digital assets a sanctionable sector of the Iranian economy on Monday and said a shadow-fleet broker had processed over $100 million in cryptocurrency payments for oil sales on behalf of the Islamic Revolutionary Guard Corps-Qods Force, in an action covering nearly 60 individuals, entities, and vessels.
What the Determination Changes
The Office of Foreign Assets Control issued five sectoral determinations under Executive Order 13902, covering digital assets, technology, gold, aviation and shipping. Treasury said the effect is that OFAC can now sanction any person, wherever located, operating in those sectors of the Iranian economy.
On digital assets specifically, Treasury said the regime increasingly turns to cryptocurrency as a tool for sanctions evasion, supporting transactions linked to the IRGC and regime insiders.
Every previous US action against Iranian crypto infrastructure worked entity by entity. OFAC designated Zedcex and Zedxion in January, Nobitex in June, and Shelbit and Aban Tether on August 7, each under a finding that the specific firm operated in the financial sector of the Iranian economy.
The determination inverts that sequence. Exposure attaches to the activity rather than to a name already on a list, meaning a foreign exchange, custodian or infrastructure provider with Iranian nexus can carry secondary sanctions risk before any designation naming it exists. Treasury said the determinations build on earlier ones covering Iran’s financial and petroleum sectors.
Treasury Secretary Scott Bessent said the campaign, named Operation Economic Outcast, aims to “sever every economic lifeline that sustains this tyrannical regime.”
The $100 Million Broker
Ivan Obukhov, a Ukrainian national based in the UAE, has brokered Iranian shadow-fleet vessels for years and facilitated oil shipments for the Iranian military and its proxies, according to Treasury. Since 2023, OFAC said, he has processed over $100 million worth of cryptocurrency payments to facilitate oil sales on behalf of the IRGC-Qods Force.
Obukhov owns UAE-based Foscom FZE, purchased in 2022, and worked with Syrian national Mohammad Ahmed Suhil Fattouh to buy vessels later used in sanctions evasion, OFAC said. Both were designated under the counterterrorism authority rather than the new digital asset determination.
The figure is the largest crypto sum attached to an individual in the action and situates stablecoin and crypto rails inside the oil logistics chain rather than in a separate exchange-based track.
The Cyber Group and the Addresses
OFAC designated four members of a cyber group it said operates on behalf of Iran’s Ministry of Intelligence and Security, adding 16 digital currency addresses in the process.
Treasury said the group has been led since at least summer 2023 by Mojtaba Ghal’eh-Kuhi and Behzad Mesri. Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, and Mohammad Reza Kadkhoda’i conduct most of its network compromise activity and, since late 2023, have exfiltrated data from US energy companies, defense contractors, healthcare institutions, IT firms, and financial institutions, along with local, state, and federal government offices, in summer 2024.
Arman Kahzadian focused on digital asset heists, OFAC said, gaining control in summer 2023 of a wallet holding over $30,000 in bitcoin. He was designated under the cyber authority’s provision covering misappropriation of funds through cyber-enabled means.
Blagh carries ten addresses across Bitcoin, Ethereum, and Tron. Ghal’eh-Kuhi carries two, and Kahzadian carries three. OFAC separately amended Mesri’s existing listing, adding 15 addresses to an entry that previously carried none. Mesri was first designated in March 2018 over the attempted extortion of a US media company.
Treasury said the action was coordinated with the FBI, which announced on August 18 the unsealing of a superseding indictment charging 17 Iranian cyber actors, four of whom were designated Monday.
Treasury also noted that the group’s members are motivated by personal enrichment to a degree that has led some to target Iranian companies—in spring 2025, Ghal’eh-Kuhi and Balujeh compromised and exfiltrated data from an Iranian telecommunications firm.
Licences Suspended
OFAC suspended General Licence F, covering services supporting sports exchanges, and General Licence G, covering academic exchanges and educational services, both effective August 24. A new General Licence BB authorizes wind-down of previously permitted transactions through September 8.
OFAC also updated its alert on sanctions risks tied to Iranian demands relating to Strait of Hormuz passage — the scheme in which, as The Crypto Times reported in July, two Iranian firms were designated for collecting mandatory passage insurance in bitcoin.
The Running Total
OFAC expanded its Central Bank of Iran designation with additional wallet addresses in April, with Tether freezing roughly $344 million in associated USDT. By the August 7 action, cumulative Tether freezes tied to OFAC-identified central bank addresses had reached approximately $475 million.
The sectoral logic also tracks legislative movement. The Senate’s Russia sanctions package, advanced in July, wrote crypto evasion explicitly into its definition of sanctionable activity — the same shift from naming firms to naming conduct.
Monday’s action moved in the opposite direction elsewhere. The State Department rescinded Syria’s designation as a State Sponsor of Terrorism, and OFAC removed Hay’at Tahrir al-Sham from the SDN list.
Also Read: Pakistan Opens Crypto Licensing Despite Economic Gaps, Terror-Financing Risks
