Investigation Report: How an Illicit Iranian Gambling Network Allegedly Helped Move $4 Billion and Evade Sanctions

Investigation Report: How an Illicit Iranian Gambling Network Allegedly Helped Move $4 Billion and Evade Sanctions

A Reuters investigation published on July 31, 2026, reported that an extensive Farsi-language online gambling network, a Dubai-based cryptocurrency exchange called Shelbit, and financial flows involving Iranian state-linked and sanctioned entities formed part of an alleged sanctions-evasion and money-moving operation that processed at least $4 billion in cryptocurrency since May 2024.

The investigation identified Shelbit, reportedly founded by Iranian expatriate Siavash Kayvanpour, as a central financial hub. Blockchain data analyzed by two unnamed crypto investigative firms and independent blockchain researcher Rich Sanders, and reviewed by Reuters, allegedly showed interactions between Shelbit, a gambling network of more than 2,000 websites, Iran's central bank, sanctioned Iranian-linked entities, IRGC-linked wallets, Iranian crypto platforms, and major global crypto exchanges.

The allegations later resulted in significant regulatory action. On August 7, 2026, the United States imposed sanctions on Shelbit and Kayvanpour, alleging that the exchange facilitated transactions benefiting the Islamic Revolutionary Guard Corps (IRGC) and other Iranian-linked entities.

This report should therefore distinguish between three categories:

• Verified regulatory actions, including U.S. sanctions and UAE enforcement;
• Reuters' findings based on blockchain analysis and sources;
• Allegations that have not necessarily been established by a criminal conviction.

1. The Central Entity: Shelbit

According to Reuters, Shelbit operated from an office in Dubai and functioned as an unlicensed cryptocurrency exchange. The investigation identified Iranian expatriate Siavash Kayvanpour as its founder.

Blockchain investigators whose work was reviewed by Reuters estimated that Shelbit processed at least $4 billion in cryptocurrency transactions from May 2024 onward. The reported flows included funds connected to an extensive Iranian-language online gambling ecosystem and transactions involving entities linked to Iran's financial infrastructure.

Reuters described Shelbit as the hub through which several otherwise separate financial systems allegedly gained access to international cryptocurrency markets.

Those systems reportedly included:

• A network of more than 2,000 Farsi-language gambling websites;
• Iranian cryptocurrency infrastructure;
• Iran's central bank;
• Wallets previously linked by Israeli authorities to the IRGC;
• The Iranian exchange Nobitex; and
• Major international cryptocurrency platforms, including Binance.

The critical allegation is not simply that Shelbit processed cryptocurrency. The investigative findings suggested that the exchange may have acted as a financial bridge between Iran's domestic financial ecosystem and international crypto markets, potentially allowing sanctioned or restricted actors to move funds across borders.

2. The $4 Billion Figure

The most significant figure in the investigation is the reported $4 billion processed through Shelbit.

According to Reuters, this amount was derived from blockchain analysis performed by two crypto investigative firms and independent researcher Rich Sanders. Reuters reviewed the underlying analysis but noted that the investigative firms requested anonymity because of the sensitivity of their work.

It is important to interpret this figure correctly.

The $4 billion figure represents reported cryptocurrency flows through Shelbit. It does not necessarily mean that every dollar of the $4 billion was illegal or represented sanctions evasion.

However, investigators identified financial relationships involving:

• Illegal gambling operations;
• Iranian state-linked entities;
• Sanctioned organizations;
• Cryptocurrency mining operations;
• IRGC-linked wallets; and
• International exchanges.

The alleged combination of these activities raised concerns that the platform was being used as part of a larger system for moving Iranian funds outside conventional banking channels.

3. The Iranian Gambling Network

Reuters identified a vast Farsi-language gambling operation consisting of more than 2,000 websites.

The network reportedly offered activities such as:

• Online casino games;
• Slot machines;
• Blackjack;
• Roulette; and
• Other forms of online betting.

Gambling is illegal in Iran, yet Reuters reported that the network had access to Iran's domestic electronic payment infrastructure, which is closely regulated by the country's financial authorities.

This created one of the investigation's most striking contradictions: a gambling operation that was illegal under Iranian law allegedly operated at enormous scale while maintaining access to payment mechanisms within the country.

According to Reuters and researchers cited in the investigation, the network was promoted by more than 60 Iranian influencers, with many possessing audiences of more than one million followers.

4. Sasha Sobhani and Pooyan Mokhtari

Two prominent figures associated with the promotion of gambling websites were identified as Sasha Sobhani and Pooyan Mokhtari.

Reuters reported that the two influencers denied that their gambling platforms were connected to one another or that they knew Siavash Kayvanpour or Shelbit.

Sobhani specifically denied involvement in:

• Money laundering;
• Sanctions evasion;
• Terrorism financing; and
• Moving money on behalf of Iranian government institutions or the IRGC.

Reuters also reported that Sobhani, Mokhtari, and Kayvanpour had previously been convicted in Iran in absentia in connection with an illegal gambling case in 2023. The reported case should be distinguished from the later allegations concerning sanctions evasion and the alleged $4 billion crypto network.

Their role in the wider financial system remains important because investigators reportedly found technical and operational links between hundreds or thousands of gambling websites promoted by different individuals.

5. The Alleged Connection to the IRGC

One of the most serious aspects of the Reuters investigation involved alleged links to the Islamic Revolutionary Guard Corps.

Blockchain researchers reportedly identified transactions between Shelbit and wallets that Israeli authorities had previously associated with the IRGC.

Former Iranian officials, former IRGC-linked individuals, and other sources told Reuters that the IRGC had allegedly moved to exert control over Iran's online gambling industry after recognizing its potential as a source of revenue and a mechanism for moving money internationally.

However, Reuters also reported an important limitation:

The investigation could not determine whether the IRGC directly controlled the gambling network or Shelbit, or identify exactly which Iranian state actors controlled the alleged sanctions-evasion operation.

That distinction is essential. The evidence reported by Reuters established alleged financial links and interactions, but did not conclusively prove direct operational control of the entire network by the IRGC.

6. Iran's Central Bank and Domestic Payment Infrastructure

Reuters reported that Shelbit interacted directly with wallets associated with Iran's central bank.

The investigation also examined the apparent ability of the gambling network to access Iran's domestic payment infrastructure.

This was significant because Iran's financial and electronic payment systems are tightly regulated. According to sources cited by Reuters, the ability of such a large gambling network to operate and move funds suggested possible protection, cooperation, or oversight from powerful actors.

However, the precise level of involvement by specific Iranian government officials was not established in the Reuters report.

The investigation therefore supports describing the situation as an alleged connection between the gambling and cryptocurrency network and Iranian state financial infrastructure, rather than asserting that every Iranian government institution knowingly participated in criminal activity.

7. The Role of Cryptocurrency Mining

Another component of the alleged financial ecosystem involved cryptocurrency mining.

According to the blockchain analysis described by Reuters, some cryptocurrency flowing into Shelbit came from Iranian Bitcoin mining operations.

This is significant because cryptocurrency mining can create newly issued digital assets that can then be transferred internationally without relying on conventional cross-border banking systems.

Investigators reportedly viewed the mining activity, combined with the exchange's interactions with gambling operations and state-linked entities, as evidence of a larger system for generating and transferring digital value.

The precise ownership and control of every mining operation identified in the reporting, however, was not publicly established.

8. Shelbit's Connection to Binance

Reuters reported that hundreds of millions of dollars moved from Shelbit-linked cryptocurrency addresses to Binance.

Blockchain data reviewed by Reuters reportedly showed more than $676 million flowing from Shelbit-linked wallets to Binance since May 2024.

This does not mean Binance was accused of intentionally participating in the alleged Iranian sanctions-evasion operation.

Binance stated that when users associated with Shelbit interacted with its platform, its compliance systems investigated the activity, froze relevant accounts, and reported matters to law enforcement.

Binance also stated that the relevant flows were not initially assessed as high-risk by an independent blockchain analytics firm, according to Reuters.

The case demonstrates an important feature of cryptocurrency investigations: transactions can move through major global exchanges even when the original source of funds is disputed, concealed, or difficult to identify.

9. Dubai and the UAE Regulatory Response

Shelbit's operations attracted the attention of Dubai regulators.

Reuters reported that Dubai's Virtual Assets Regulatory Authority (VARA) and the Dubai Department of Economy and Tourism took enforcement action against Shelbit in 2025 for allegedly operating without the required authorization.

Following Reuters' inquiries, VARA issued a notice stating that Shelbit had allegedly violated requirements relating to:

• Money laundering controls;
• Terrorism financing controls; and
• Unlicensed virtual-asset activities.

VARA ordered the company to cease unlicensed virtual-asset activities, according to Reuters.

The regulator reportedly regarded the alleged activities as presenting potential risks to the integrity of the UAE financial system.

10. U.S. Sanctions Against Shelbit and Siavash Kayvanpour

The investigation was followed by a major development on August 7, 2026.

The United States imposed sanctions on Shelbit and its founder, Siavash Kayvanpour, alleging that the exchange had facilitated millions of dollars in transactions benefiting the IRGC and other Iranian-linked entities.

This is one of the strongest official actions connected to the network.

The U.S. sanctions action means that Shelbit's alleged activities were not only the subject of journalistic investigation but also became the subject of direct U.S. government enforcement.

The sanctions action should still be legally distinguished from a criminal conviction. A sanctions designation is an administrative or economic restriction imposed by the government and does not necessarily represent a criminal court verdict.

11. How the Alleged Network May Have Functioned

Based on the Reuters investigation, the alleged financial ecosystem can be summarized as follows:

Iranian users and gambling platforms
↓
Funds entered or circulated through Iran's domestic payment and cryptocurrency systems
↓
Cryptocurrency wallets and exchanges
↓
Shelbit in Dubai allegedly acted as a financial hub
↓
Funds could move through international cryptocurrency markets
↓
Transactions reached major exchanges and wallets outside Iran

At the same time, investigators reported additional interactions involving:

• Iran's central bank;
• IRGC-linked wallets;
• Iranian crypto exchanges;
• Bitcoin mining operations; and
• International crypto platforms.

The alleged value of this structure was its ability to move funds outside traditional banking channels, where sanctions screening and financial oversight can be more centralized.

12. Key Individuals and Entities

Siavash Kayvanpour

Founder of Shelbit, according to Reuters. He was later sanctioned by the United States in connection with allegations involving transactions benefiting Iranian-linked entities. Reuters reported that he did not respond to requests for comment before publication.

Shelbit

Dubai-based cryptocurrency exchange identified by Reuters as the central hub of the alleged network. The company was the subject of UAE regulatory action and later U.S. sanctions.

Sasha Sobhani

Iranian influencer associated with the promotion of gambling platforms. He denied involvement in money laundering, sanctions evasion, terrorism financing, and transactions for Iranian state institutions.

Pooyan Mokhtari

Iranian influencer and gambling-site promoter identified in the Reuters investigation. He denied wrongdoing and disputed allegations concerning the legality of his online activities.

Islamic Revolutionary Guard Corps

The Reuters investigation identified alleged links between the financial network and wallets associated with the IRGC. However, Reuters said it could not establish direct operational control of the entire network by the IRGC.

Iran's Central Bank

Blockchain investigators identified reported interactions between Shelbit and the Iranian central bank's cryptocurrency infrastructure. The reporting did not establish that all such interactions constituted illegal activity.

Nobitex

Iranian cryptocurrency exchange previously sanctioned by the United States and identified in the financial relationships examined by Reuters.

Binance

Major global cryptocurrency exchange that received reported flows from Shelbit-linked addresses. Binance said its compliance procedures investigated and reported relevant activity. Reuters did not report that Binance was accused of knowingly participating in the alleged network.

13. Main Investigative Findings

The available reporting and subsequent regulatory actions support the following conclusions:

1. Shelbit reportedly processed at least $4 billion in cryptocurrency transactions since May 2024, according to blockchain analysis reviewed by Reuters.
2. A Farsi-language gambling network involving more than 2,000 websites was identified as a significant customer or user of the financial network.
3. Blockchain investigators reported financial interactions involving Iranian state-linked entities, IRGC-associated wallets, and international crypto platforms.
4. Dubai regulators took action against Shelbit for allegedly operating without authorization and identified concerns involving anti-money-laundering and terrorism-financing requirements.
5. The United States later sanctioned Shelbit and Siavash Kayvanpour, alleging support for Iranian-linked sanctioned entities and the IRGC.
6. Reuters could not conclusively determine who controlled the entire alleged operation or where much of the cryptocurrency ultimately ended up. This remains a major unresolved question.

The alleged $4 billion Iranian sanctions-evasion network represents a complex intersection of illegal online gambling, cryptocurrency, cross-border financial transfers, state-linked entities, and international sanctions.

The central allegation is that Shelbit functioned as a bridge between a massive Iranian gambling ecosystem, cryptocurrency infrastructure, and global digital-asset markets, potentially allowing sanctioned or restricted actors to move funds beyond Iran's borders.

The Reuters investigation provided the initial detailed public mapping of the alleged network, while subsequent enforcement actions by UAE regulators and the United States added official regulatory weight to concerns surrounding Shelbit.

However, several critical questions remain unresolved. Public reporting has not conclusively established who controlled the entire network, whether the IRGC directly managed the gambling operation, or the ultimate destination of a significant portion of the cryptocurrency involved.

Newer Post Older Post