Dubai’s crypto regulator fined Shelbit, an unlicensed exchange, in January 2025 for operating without a license. The enforcement action did not halt the activity that investigators later trac
Dubai’s crypto regulator fined Shelbit, an unlicensed exchange, in January 2025 for operating without a license. The enforcement action did not halt the activity that investigators later traced through Shelbit-linked wallets. Available reporting identifies substantial transfers continuing after the regulator’s first intervention. The underlying blockchain-analysis figures have not been independently verified by this publication.
Public investigative reporting identifies Shelbit as the hub of a broader $4 billion Iranian sanctions-evasion network, a characterization this piece has not independently verified, and one that outside commentary, separate from the underlying investigation, has compared to a roughly $20 billion IRGC gold-for-oil scheme broken up in Turkey in 2016. Run by Iranian expatriate Siavash Kayvanpour out of an office with no public website, the exchange, according to publicly available records, has processed money tied to more than 2,000 gambling sites, Iran’s central bank, and other sanctioned entities since May 2024.
Kayvanpour’s connection to Iran’s illegal gambling world predates Shelbit. In 2023, an Iranian court is reported to have convicted him in absentia alongside two gambling-network figureheads, Sasha Sobhani and Pooyan Mokhtari, sentencing him to three months for assisting them, a court record the source material reviewed here does not independently verify. Reporting reviewed for this article states that Iran also sought Interpol red notices for Sobhani and Mokhtari; both were reportedly briefly detained in Spain before the notices were cancelled.
The gambling sites Shelbit serviced weren’t obviously connected on paper. Domain records showed different registration dates, different names, different branding. Cybersecurity firm Infoblox found the technical fingerprint underneath: shared software and infrastructure characteristics linking more than 2,000 sites into a single Farsi-language network. That network, and the on-chain data tracing its funds through Shelbit, forms the backbone of the $4 billion figure at the center of the investigation, according to reporting reviewed for this piece.
Dubai’s Virtual Assets Regulatory Authority issued its first cease-and-desist against Shelbit General Trading L.L.C. on January 2, 2025, for operating without a license. The order carried no visible operational consequence: transfers to Binance continued for another year and a half, through the bulk of the $676 million total cited above, before VARA returned with a second, sharper action in July 2026.
PeriodAmount reaching BinanceBefore Jan 2, 2025 (VARA’s first order)~$136 millionAfter Jan 2, 2025~$540 millionTotal, since May 2024$676 millionBinance has said that Shelbit never held an account on its platform, and that the flagged transactions weren’t rated high-risk by an independent analytics firm at the time. The exchange says it has since investigated the linked users, frozen relevant accounts, and reported them to law enforcement. Kayvanpour did not respond to requests for comment, nor did the Iranian government, Dubai police, or the Dubai prosecutor’s office, according to the underlying investigation. Sobhani, one of the gambling-network figureheads, denied any role in money laundering or sanctions evasion in an emailed statement.
Eighteen months after its first action, VARA returned with a formal Notice of Fines, issued, according to the notice itself, on July 24, 2026. That timing, according to the available reporting, follows the regulator having been approached for comment shortly beforehand. The notice cites three specific failures: providing virtual-asset services without a license, skipping mandatory KYC checks, and marketing services in Dubai without authorization. These are cited as breaches of the UAE’s 2025 anti-money-laundering law and its 2022 virtual-asset regulations.
“Cease and desist immediately from all unlicensed Virtual Asset activities.” (VARA’s Notice of Fines against Shelbit General Trading L.L.C.)
Shelbit has now been fined twice by its home regulator and ordered to stop operating. As of this writing, no U.S. sanction, designation, or charge against Shelbit has been reported. Those are two different stages of consequence, and the gap between them is the open story.
VARA’s enforcement history extends beyond Shelbit alone. The regulator issued a similar unlicensed-operations warning against KuCoin in March 2026, ordering several of its affiliated entities to halt marketing to Dubai residents pending licensing.
Treasury has taken that acknowledgment no further. No designation, no SDN listing, no enforcement action against Shelbit has followed it. That’s distinct from the more definitive claim independent investigator Rich Sanders made in his own capacity:
“It’s an IRGC operation, and that’s plain as day.” (Rich Sanders, independent blockchain investigator)
The underlying investigation could not independently confirm that claim.
Shelbit’s case also isn’t isolated: Treasury designated Iran’s Nobitex and three other exchanges in June under its “Economic Fury” campaign, per Treasury’s own June 2 announcement, reviewed directly. Whether Shelbit itself moves from “Treasury is aware” to “Treasury has designated” is the procedural question a fine from Dubai alone hasn’t answered. The wider industry trend runs the other direction BTSE launched a fully licensed exchange in Indonesia through a local joint venture in July, part of a broader pattern of exchanges seeking local authorization rather than operating the kind of unlicensed structure that got Shelbit fined twice.
What is Shelbit?An unlicensed Dubai-based crypto exchange, run by Iranian expatriate Siavash Kayvanpour, described in public reporting as the hub moving money between an Iranian gambling network, Iran’s central bank, and international crypto markets.
Has the U.S. sanctioned Shelbit? Not as of this writing, no designation has been reported. Treasury’s position, stated on the record, is that it’s aware of the allegations and taking them “very seriously.” That’s an agency acknowledging a matter exists, not a designation.
Did Binance do anything wrong?Binance says no, it maintains Shelbit never had an account with it and that it acted once it identified linked users.
