The number is $676 million. That is what moved from Shelbit, an unlicensed Dubai exchange with no website and a locked office door, onto Binance since May 2024. Reuters traced it. The smaller number is $540 million — the portion that moved after Dubai regulators ordered a crackdown in January 2025. The smallest number is the date that matters most: October 2025. That is when Rich Sanders, an independent blockchain researcher who tracks Iranian financial networks, says he warned Binance about Shelbit. The funds kept flowing after the warning.
The ledger remembers what the market forgets. The market will cite Binance's $4.3 billion guilty plea and move on. The ledger records the sequence: a government-mandated compliance monitor, and six months later, an offshore exchange routing hundreds of millions in Iranian betting revenue into the world's largest liquidity pool.
This is not a story about one exchange. It is a stress test of the entire entity-based compliance architecture. The test is failing.
The Architecture of Evasion
Shelbit is not an exchange in any conventional sense. It has no public interface. Its registered Dubai address sits behind a locked door. The sign reads "Velorix Watches Trading LLC," a firm owned by Shelbit's founder, Siavash Kayvanpour. Reuters visited the three-room office in July. Inside: thirteen battered watches, a cash-counting machine, and three staff members who had never heard of Kayvanpour. The watches were not for sale.
What happened there was not retail trading. Investigators traced at least $4 billion through Shelbit since May 2024. Roughly $125 million came directly from Iran's central bank. Shelbit also moved funds for wallets that Israel links to the Islamic Revolutionary Guard Corps. Its counterparties included Nobitex, Iran's largest exchange, which Washington sanctioned in June under the legal authority reserved for terrorist financiers. Treasury estimated Nobitex handled more than half of Iran's crypto inflows in 2025.
Shelbit did the same job from outside Iranian jurisdiction. That is the architectural detail most coverage will flatten into a headline. Do not flatten it.
The pipeline starts with gambling. Shelbit's largest customers were more than 2,000 Farsi-language betting sites. Gambling is illegal in Iran, punishable by prison and lashes. The law was extended to online betting in 2023. Those sites still plug directly into Iran's domestic payment system — the system controlled by Iran's central bank. Reuters mapped the network with the cybersecurity firm Infoblox. The conclusion is structural: the Islamic Republic declares the activity illegal, then controls both the prohibition and the black market. As Miad Maleki, former associate director at OFAC, put it: the IRGC learned the Islamic Republic's most lucrative lesson early.
The Defense That Is Not a Defense
Now add Binance to the flow. The exchange's defense has three parts. Shelbit never held a Binance account. Shelbit has never been sanctioned. An outside analytics firm — unnamed — did not flag the flows as risky. Binance said its compliance program "investigated, froze the relevant accounts, and reported them to law enforcement" when users associated with Shelbit interacted with the platform.
That defense is technically true and structurally irrelevant. The correct response is not a statement. It is a question: what exactly was the compliance program looking for?
The answer exposes the flaw. Entity-based sanctions screening matches names against watchlists. Shelbit was not in that database. It is a routing node. The sanctions regime lists designated persons and addresses. Shelbit was neither — until journalists traced it. The funds moving through it were not attributable to a sanctioned name at the time of transfer. They were Iranian-origin liquidity, sourced from a central bank that itself was not yet designated in the relevant flows, inbound to a platform operating under a court-ordered compliance monitor.
Binance's record makes the pattern legible. In November 2023, the exchange pleaded guilty to breaking US money-laundering and sanctions laws. It paid $4.3 billion, one of the largest corporate penalties in American history. Prosecutors found that Binance had allowed more than $898 million in trades between US and Iranian users between January 2018 and May 2022. The plea deal carried a condition: an independent compliance monitor for three years. Shelbit began operating roughly six months into that term.
The timeline deserves courtroom weight. A monitorship is designed to catch second-order evasion. It is not a fine. It is a supervisory mechanism with access to internal data, transaction monitoring logs, and compliance decisions. If the monitor's mandate included reviewing sanction-related risk — and it did — then the Shelbit flow is not an external blind spot. It is an internal audit failure.
What the Forensic Layer Actually Shows
Based on my audit experience, the betting-site plumbing is the most under-analyzed component of this story. The off-ramp gets the attention. The on-ramp is the vulnerability. Two thousand Farsi-language betting sites wired into Iran's domestic payment rails means the rial-to-crypto conversion happens inside the jurisdiction, before the chain even sees the value. By the time the funds reach Shelbit, they are already clean risk-assessed crypto. No exchange analytics tool flags provenance it cannot see.
The same limitation applies to the analytics firm Binance invoked. A firm screening for sanctioned entities would find nothing, because Shelbit was not sanctioned. A firm screening for behavioral patterns — high volume, no KYC, an unregulated Dubai shell, connections to Iranian betting infrastructure — would have found everything. The "no risk flag" defense depends entirely on the scope of what was screened. That scope is the product. Nobody has revealed it.
Reuters could not establish who inside Iran controlled Shelbit. It could not say where most of the crypto ended up. Blockchain records show routes, not drivers. This is the eternal gap between attribution and correlation. On-chain forensics can reconstruct a path with millimetric precision and still cannot tell you who held the keys. The route is public. The identity is not.
The Unreported 83 Percent
Here is the part the headlines will miss. The $676 million that reached Binance is about 17 percent of the $4 billion Shelbit moved. The dominant narrative will spend thousands of words on Binance's moral failure. The more uncomfortable data point: no one has identified the remaining 83 percent. The destination of the majority of the flow is unquantified, unclaimed, and unexamined in the public record.
That is the actual enforcement gap. Binance is the visible target because it is a named company with a guilty plea. But the Shelbit flow demonstrates something larger: unlicensed OTC desks are the systemic leak in global sanctions architecture, and they are structurally invisible to the compliance tools that exchanges purchase and regulators approve.
Power lies in the code, not the community. The compliance industry has inverted this into a photograph-and-listing game. It treats sanctions lists as code and treats inference as optional. The ledger does not care about the distinction. It records every hop.
What Comes Next
Pressure is building. Washington pushed Binance on Iran in May. OFAC designations this year have triggered stablecoin freezes within hours of publication. Treasury says it is taking the Shelbit claims seriously. If Shelbit itself is designated — and the accumulating evidence makes that increasingly likely — the question becomes retroactive. Every transfer that touched Binance becomes a look-back event. The $676 million becomes a test of whether the monitor-appointed compliance regime can handle a sanctions designation applied backwards against a flow it already processed.
Watch the stablecoin issuers. They freeze faster than any exchange. They are the real enforcement layer now. A sanctions list is a photograph. The ledger is a live feed. The market will move on from this story within a week. The ledger will not — and if the designation comes, neither will the freeze.
The takeaway is not that Binance is uniquely reckless. The takeaway is that the global compliance architecture is still matching names when it should be tracing value. A shell company with a watch shop sign, a cash-counting machine, and no website moved $4 billion. The next one already has its sign up.
