Iran case shows why list-based sanctions screening fails
When convicted Iranian sanctions evader Babak Zanjani claimed he sold cryptocurrency to Iran's Central Bank, publishing stamped letters with wallet addresses on December 21, 2025, Crystal Intelligence investigated the infrastructure behind his allegations.
We found the wallets, and what they reveal is a sophisticated sanctions evasion infrastructure operating at an institutional scale.
Between April and May 2025, two wallets matching Zanjani's description moved $48.9 million in USDT with systematic precision: one routed funds through cross-chain bridges and to Tether-blacklisted wallets, while the other sent 51% directly to OFAC-sanctioned entities. Both received funds from 92-94% uncategorized origins, processed institutional volumes within 15-30 days, then distributed through high-risk infrastructure.
Zanjani's allegations and what blockchain forensics reveal
In tweets posted December 29, 2025, Zanjani claimed he sold "a few million dollars' worth of USDT" to Iran's Central Bank through Informatics Services Company, a state-owned entity providing banking infrastructure. He published what he described as stamped Central Bank letters documenting the transactions-including cryptocurrency wallet addresses he claimed were controlled by Informatics Services Company on behalf of the Central Bank.
Informatics Services Company denied dealing in cryptocurrency. The Central Bank neither confirmed nor denied the allegations.
Zanjani also alleged that shortly after revealing the wallet addresses publicly, they appeared on Israel's sanctions list – suggesting either internal security breaches or external intelligence collection targeting Central Bank operations.
Crystal identified two wallets matching Zanjani's description, with transaction patterns, timing, and volumes consistent with his claims of institutional-scale operations during April and May 2025. For compliance purposes, what matters is how the infrastructure operated and the blind spots that enabled it to function.
What the blockchain shows
Crystal identified two wallets matching Zanjani's description, with timing, volumes, and transaction patterns consistent with his claims of institutional-scale operations during April and May 2025.
Wallet 1: THwJSxR9qREsgEQjX1cpRw4Rw9WbmPSHVh
Volume: $28.5 million USDT
Timeframe: April-May 2025
Activity pattern: 15-30 days
Origin analysis:
- 92.4% from uncategorized sources
- 4.8% from licensed exchanges
- 2.7% from payment processors
Destination analysis:
- Crystal's forensics show strong connections with blocklisted wallets, NBCTF sanctions, and Iranian VASPs
- Additional analysis indicates systematic routing through Bridgers (cross-chain bridge service) and to Tether-blacklisted wallets
- 100% of outbound funds went to high-risk infrastructure categories
This wallet received 70% of its funds from TWnCRk6z6KrwbuszhN6HUkdLRUh4yaVXBh, a wallet that did over 515 million USDT in transactions in less than 2 months between April 21 and June 15, 2025.
The above wallet shows strong connections with OFAC- and NBCTF-sanctioned entities linked to Iran and Russia, Iranian crypto exchanges, and also crypto cash desks located in Dubai, Hong Kong and Turkey.
Obfuscation of source and destination of funds
Our analysis of TRX gas fees for this wallet reveals that it received over 36% of TRX from an NBCTF-sanctioned wallet, providing further evidence that an Iran-linked entity controls the wallet. Furthermore, to obfuscate the on-chain trail, the wallet used two bridges in succession: first, converting USDT-TRX to USDT-ETH using Bridgers, and then converting the same to AEthUSDT using Aave.
Wallet 1: TBaxHwoXQjAmiNZgRKECoA3b6fsrtmoZvB
Volume: $20.6 million USDT
Timeframe: April-May 2025
Activity pattern: 15-30 days
Origin analysis:
- 94% from uncategorized sources
- Remaining 6% from mixed categories including illegal services (0.4%), sanctioned entities (0.11%), and licensed exchanges (5.3%)
Destination analysis:
- 51% sent to OFAC-sanctioned entities
- 37.3% to other categories (primarily Nobitex with IRGC-linked wallet connections, plus Bridgers and FixedFloat)
- 7.3% to uncategorized wallets
- 4.3% to unlicensed exchanges
Three compliance blind spots the infrastructure exploited
The wallet analysis reveals systematic vulnerabilities in sanctions compliance monitoring.
1. Cross-chain bridges sever compliance trails
The THwJS wallet shows systematic routing through cross-chain bridges alongside connections to Tether-blacklisted wallets. Crystal's analysis reveals strong connections with blocklisted wallets, NBCTF sanctions, and Iranian VASPs, with infrastructure deliberately designed to break transaction history across blockchains.
Most compliance systems track activity within a single blockchain. When funds cross chains through bridge services, Virtual Asset Service Providers (VASPs) lose visibility into prior transaction history.
2. Unlicensed exchanges operate outside compliance frameworks
The TBaxH wallet sent 51% of its $20.6 million directly to OFAC-sanctioned entities, with the majority of the funds routing through Nobitex-Iran's largest cryptocurrency exchange, which has over 6 million users. OFAC sanctioned Nobitex in October 2024, but the exchange continues to operate.
3. Behavioral indicators go undetected without forensic context
Both wallets received funds from largely invisible origins: THwJS shows 92.4% from uncategorized sources, TBaxH shows 94%.
To see how Crystal Expert detects what list-based screening missing, book a demo with us today.
