US Broadens Iran Crypto Sanctions and Targets Broker Linked to $100M Oil Payments

Broader sanctions risk for Iran-linked crypto activity

Treasury’s latest package expands an enforcement drive that had previously centered on named exchanges and specific transactions involving sanctioned Iranian parties. With the new action, foreign crypto firms face wider sanctions risk when handling business connected to Iran-linked actors.

The step follows earlier designations in June, when OFAC sanctioned four major Iranian crypto exchanges. Treasury said at the time that Nobitex accounted for more than half of Iran’s digital asset inflows during 2025, underscoring how significant the crypto sector had become in the country’s financial flows.

Broker accused of processing oil-sale payments

A central target in the Aug. 24 measures is Ivan Obukhov, a Ukrainian national based in the United Arab Emirates. Treasury accused Obukhov of facilitating oil shipments for Iran’s military and its proxies and said he processed more than $100 million in cryptocurrency payments tied to those sales beginning in 2023.

According to Treasury and Chainalysis, the payments supported oil transactions for the Islamic Revolutionary Guard Corps-Qods Force. The allegation places crypto within a larger network of oil revenue and financial channels that U.S. authorities say benefit sanctioned Iranian organizations.

Hormuz transit demands and payment methods under scrutiny

Treasury also updated guidance for maritime service providers on Iranian demands for transit fees in the Strait of Hormuz, revising an OFAC alert first issued on May 1. The guidance says companies can face penalties even if no cash payment is made, including by accepting insurance arrangements or responding to demands for safe-passage guarantees from three Iranian bodies designated since May.

The department said the requested tolls can take many forms, including fiat money, digital assets, informal swaps or donations routed through Iranian charities and embassy accounts. Chainalysis had previously described these crypto-related toll demands as a possible milestone in state use of digital assets, and said stablecoins were likely to be more practical than bitcoin for high-volume transactions.

Cyber designations add named crypto wallets

OFAC also designated a cyber espionage group within Iran’s Ministry of Intelligence and Security, alleging that it hacked U.S. critical infrastructure on behalf of the regime. Sanctioned property included bitcoin, ether and TRON wallets linked to co-leader Behzad Mesri and member Keyvan Fayyaz Gareh Blagh, as well as bitcoin and ether addresses tied to member Arman Kahzadian.

Treasury said some members also pursued personal financial gain. Chainalysis traced a ransomware payment directly to one of the newly sanctioned addresses, while Blagh was said to have sent crypto deposits to at least two bulletproof hosting providers, services often used by criminal and state-backed hacking operations.

The cyber action followed a superseding indictment unsealed on Aug. 18 that named 17 members of the Iran-based hacking-for-hire operation Mabna Institute as defendants. Four of those defendants were among the people OFAC designated on Aug. 24. The indictment describes alleged involvement by several defendants in the 2017 HBO hack, while Mesri had already been charged separately with attempting to extort the company for about $6 million in bitcoin.

What comes next for investigators and compliance teams

The new sanctions come after earlier U.S. action involving far larger Iran-linked crypto volumes. Treasury Secretary Scott Bessent said in May that authorities had seized about $1 billion in Iran-linked cryptocurrency through a broader campaign aimed at sanctioned wallets, oil revenue and financial networks associated with the Iranian government and the IRGC.

For enforcement and compliance teams, public blockchain data remains a key tool. Once authorities link specific wallets to sanctioned actors, investigators can use blockchain explorers to review addresses, balances and transaction histories and then trace potential exposure across connected transfers.