On Aug. 24, the U.S. Treasury Department launched what the report calls an "economic expulsion" action against Iran, expanding secondary sanctions to five sectors: aviation, cryptocurrency, gold, shipping, and technology. Treasury said the measures are meant to cut off economic channels that sustain the Iranian regime and the Islamic Revolutionary Guard Corps. Nearly 60 Iran-linked entities, individuals, and vessels were added to the sanctions list, with Treasury saying they helped Iran obtain nuclear technology, oil revenue, and conduct cyber operations.
Treasury said Iran has been using cryptocurrency to evade sanctions, gold to hedge inflation, aviation networks to transport weapons and funds, and shipping networks to move oil illegally. Under Executive Order 13902, Treasury designated five key sectors of Iran's economy for secondary sanctions, adding to earlier measures that already covered the financial and oil and petrochemical sectors.
Five sectors brought into the sanctions framework
For digital assets, the U.S. said Iran is making growing use of cryptocurrency to bypass sanctions, especially in activity tied to the IRGC and insiders, and that such transactions will be targeted.
For technology, Treasury said Iran has sought advanced civilian technologies for integration into domestic weapons programs, putting the sector under close scrutiny.
For gold, the department said Iran's formal financial system had collapsed and that the regime used gold to stabilize the rial and hedge hyperinflation, making gold trade sanctionable.
For aviation, Treasury said Iranian state-owned airlines, many controlled by the regime and the IRGC, have been used to move fighters, weapons, sensitive technology, and hard-currency gold, bringing related services into scope.
For shipping, Treasury said Iran's national shipping company regularly transported missile precursors and weapons components, while the national tanker company trafficked oil illegally. Parties operating in that sector are also exposed to sanctions.
According to the report, a sector determination under Executive Order 13902 authorizes the Office of Foreign Assets Control to sanction foreign persons found to be operating in designated sectors of Iran's economy without separately establishing links to terrorism, weapons proliferation, or other sanctioned parties. Foresight said this is the first time that sector determination has been applied to the digital asset industry, meaning individuals or entities doing business in, or providing support services to, Iran's digital asset sector can be sanctioned.
Crypto-related cases named in the action
Among the crypto-related cases disclosed in this round, Ukrainian-born freight broker Ivan Obukhov, who is based in the United Arab Emirates, was placed on the sanctions list. The U.S. accused him of handling more than $100 million in cryptocurrency payments since 2023 to facilitate Iranian oil sales for the Islamic Revolutionary Guard Corps-Qods Force, or IRGC-QF, and of working with others to buy tankers used to evade sanctions.
Another set of names came from a cybercrime group directed by Iran's Ministry of Intelligence, or MOIS. Behzad Mesri, Keyvan Fayyaz Ghareh Blagh, and Arman Kahzadian were tagged by OFAC. The U.S. accused them of harming U.S. interests through cryptocurrency theft, data theft, and attacks on companies and U.S. government agencies.
On-chain review of 37 sanctioned addresses
Foresight cited Beosin as saying the sanctions package includes 37 cryptocurrency addresses, all tied to members of an Iranian cybercrime team. Beosin said it used its Beosin KYT anti-money laundering platform and Beosin Trace investigation tool to analyze the main addresses on the list.
Behzad Mesri: BTC, ETH, and TRON flows
On the Bitcoin network, the address 12aNKp2iDKuhEde2YfPdd4DFGenRUTKupL was identified by Beosin as a Binance user address. The firm said the address showed notable fund concentration activity from the third quarter to the fourth quarter of 2023 and again in the first half of 2026. Upstream addresses had multiple transfers with the Iranian exchange Nobitex, and the main sources of funds were ChangeNOW and Cryptomus.
On Ethereum, the related addresses were 0x252a8bd2319d8a555b872990601221b3a2053bce, 0x1CAb8177ACe78b1B6B1c393371F4f2dCAE40CbEB, 0x6Fac4D18c912343BF86fa7049364Dd4E424Ab9C0, 0xA40cFBFc8534FFC84E20a7d8bBC3729B26a35F6f, 0x7F03679B56d8772530EFA516b58Bb83d4829E881, 0x8ac5381FCD9e7395D14e02986c344aADA84B4bC6, 0x9697749A9e8D6C119D8EEb0d6268a1b99C40684c, 0x9DD7fA4B4950154F7e75BdD8A77266B99b94Ec08, 0xb5A69Da691670F62510793F79a9B36c7db1A7b7c, 0x6B0736Fed0634e15E19CC57fBA19cd179c13AbCA, 0xd81414ABc631C6CADAe1C6198b0c2b15a9B4fDe5, and 0xF45Ecc3a59C7911181C659cE9115854c6175Be91.
Beosin said the funds came from addresses flagged as scams and from exchange hot wallets tied to HitBtc, CoinEx, and Binance. After moving through those addresses, about 100,000 USDT was sent to CoinEx, 62,000 USDT to BingX, and 98,000 USDT to Binance. About 44.34 ETH remains at 0xd81414abc631c6cadae1c6198b0c2b15a9b4fde5.
On TRON, the related addresses were TAbbVaBKgH4VBLXgWqACuwoKF4cH1HinQh and TEsxMcVocweTM82Mdmc5diKC6qyCWqSpPv. The main transaction address was TEsxMcVocweTM82Mdmc5diKC6qyCWqSpPv, with transaction volume of about 534,000 USDT. Beosin said most of the funds came directly or indirectly from Trust Wallet user addresses, and that some transfer timing and traits may be related to a Trust Wallet security incident.
Keyvan Fayyaz Ghareh Blagh: exchange inflows across chains
On Ethereum, the related addresses were 0x4060cbf80734193f521a3cc6fd4e985df2825279, 0x56de1527136f76a809e5b14ded6103eecd072ba7, 0x8694ed130432be2cd3efff2e4d9dc52351dc7423, 0xbd3276f265b83b5e828c05f46cde9d10a1521a24, and 0xf1c4c44d2dcbcfa704349e3b57628dbd8404e597. Beosin said the main Ethereum transaction address was 0x56de1527136f76a809e5b14ded6103eecd072ba7. It was active from September 2019 to July 2021 and sent about 2.41 M USDT into Binance.
On TRON, the related addresses were TXR4FDAZZLDSvuRxveW9aBMybbaS12WWHk and TP3kVtnFgDSoSqzw178nLJtGWNjrbKNgB6.
The address TXR4FDAZZLDSvuRxveW9aBMybbaS12WWHk was active from December 2025 to August 2026. Part of its funds came from the sanctioned exchange Swapuz, and the funds mainly flowed to WhiteBit, Binance, Kucoin, and Bybit, concentrated in July and August this year.
The address TP3kVtnFgDSoSqzw178nLJtGWNjrbKNgB6 was active from June 2023 to August 2026 and moved about 8.36 M USDT, mainly to CoinEx and Binance. Beosin said its high transaction frequency and roughly 21% repeat counterparties indicate it functioned as a liquidity aggregation and cross-platform transfer address.
Compliance risks highlighted in the report
Foresight said the sanctions action blocks key sectors of Iran's economy and cuts financial channels, while also showing the continued overlap between U.S. sanctions enforcement and crypto anti-money laundering work. For virtual asset service providers, the report said, involvement in crypto business tied to Iran or its funding networks creates a high risk of losing access to the U.S. financial system or becoming sanctioned themselves.
The article also said that building blockchain anti-money laundering systems, identifying Iran-linked entities, assessing wallet risk, and tracing crypto fund flows have become compliance tasks that virtual asset service providers need to handle.
Beosin said in the article that its 24/7 real-time transaction monitoring platform, Beosin KYT, provides on-chain AML compliance tools for VASPs, including pre-transaction counterparty address risk reviews, historical transaction analysis, and risk checks designed to help firms avoid exposure to assets coming from sanctioned addresses, known high-risk addresses, or suspicious transaction paths.
The original article also carried a disclaimer stating that markets involve risk, the piece does not constitute investment advice, and users should decide whether any opinion, view, or conclusion fits their own circumstances and bear responsibility for investment decisions made on that basis.
