Summary
- As part of the Treasury’s newly launched Operation Economic Outcast, OFAC issued a first-ever sectoral determination covering Iran’s digital assets sector.
- OFAC additionally set forth detailed guidance on the sanctions risks of paying “tolls” to Iran for Strait of Hormuz passage.
- OFAC also designated a cyber espionage group within the Ministry of Intelligence and Security and included multiple cryptocurrency addresses for several of its members.
- The U.S. Department of State also revoked the designation of al-Nusrah Front, also known as Hay’at Tahrir al-Sham (HTS), as a Specially Designated Global Terrorist (SDGT) organization. Affiliated individuals, including Farrukh Furkatovitch Fayzimatov, were delisted.
On August 24, 2026, the U.S. Department of the Treasury launched Operation Economic Outcast, an economic campaign against the Islamic Republic of Iran and its enablers. Framed by Treasury Secretary Scott Bessent as an “economic D-Day,” the operation aims to sever the financial lifelines, increasingly including crypto payment rails, that sustain the Iranian regime and the Islamic Revolutionary Guard Corps (IRGC).
One of the most sweeping components of the package is a first-of-its-kind sectoral determination that allows OFAC to sanction anyone globally that operates in or supports Iran’s digital assets sector. OFAC additionally targeted individuals supporting Iran through crypto-enabled trade payments and theft.
A first-ever sectoral determination for Iran’s digital assets sector
A sectoral determination under Executive Order 13902 authorizes OFAC to sanction any foreign person determined to operate in a designated sector of the Iranian economy, without needing to establish a separate nexus to terrorism, weapons proliferation, or another sanctioned party. OFAC has previously designated crypto-related actors tied to Iran under other authorities, but today’s action is the first time it has applied this sectoral tool to digital assets.
The practical effect is an expansion of secondary sanctions exposure. Foreign exchanges, OTC desks, infrastructure providers, and other crypto businesses that knowingly facilitate transactions supporting Iran’s digital asset sector now risk designation themselves, as well as potential loss of access to the U.S. financial system.
MOIS Hacks leave cryptocurrency footprint
OFAC targeted a group within Iran’s primary intelligence agency, the Ministry of Intelligence and Security (MOIS) for hacking U.S. critical infrastructure on behalf of the regime.
Group co-leader Behzad Mesri and members Keyvan Fayyaz Ghareh Blagh and Arman Kahzadian all have Bitcoin, Ethereum and TRON wallets flagged by OFAC Monday. They’re part of a larger contingent within MOIS that has been targeting U.S. interests through data theft, attacks against corporations and U.S. government offices. According to OFAC, although some of the group’s intrusions were MOIS-directed, members of the group also acted in their own interests, perhaps benefiting financially.
For example, according to OFAC, Kahzadian also stole cryptocurrency, and some members actually compromised Iranian entities. One wallet belonging to Blagh receives a $2,000 payment in BTC from a Russian-speaking Initial Access Broker. It’s possible that Blagh resold access from MOIS-directed intrusions to underground cybercriminals and pocketed the profits.
We have also identified Blagh making cryptocurrency deposits to at least two separate Bulletproof Hosting Providers, underscoring these infrastructure providers’ role in criminal and nation-state malicious cyber activity. Our research into the MOIS group shows that Blagh also conducted ransomware attacks himself. Blagh received a ransom payment directly through one of the cryptocurrency addresses sanctioned Monday.
A DOJ superseding indictment unsealed on August 18 charged several of the group’s members with cybercrimes connected to the Iran-based hacking-for-hire organization the Mabna Institute. It also accused Mesri, the MOIS group co-leader, of attempting to extort HBO for approximately $6 million worth of Bitcoin in a 2017 hack.
Ivan Obukhov: $100M+ in crypto payments for IRGC-Qods Force oil sales
Iran has long relied on cryptocurrency to settle oil sales, pay proxies, and channel revenue to the IRGC, with the IRGC itself becoming a dominant force in Iran’s crypto economy. Chainalysis research has previously found that IRGC-associated addresses accounted for over 50% of total value received in Iran’s crypto economy in Q4 2025, with volumes surpassing $3 billion in 2025 alone.
Today’s designation of UAE-based Ukrainian national Ivan Obukhov fits within that pattern. According to the Treasury, Obukhov has for years served as a broker for Iranian shadow fleet vessels, facilitating oil shipments for the Iranian military and its proxies. Since 2023, he has processed more than $100 million in cryptocurrency payments to facilitate oil sales on behalf of the IRGC-QF. He also coordinated with fellow designee Mohammad Ahmed Suhil Fattouh, a UAE-based Syrian national and shadow fleet broker known as “Captain Hamzah,” to purchase vessels later used for sanctions evasion.
What this means for compliance teams
The new digital assets sectoral determination substantially broadens the population of persons that could face OFAC designation and creates fresh secondary sanctions risk for global crypto businesses whose services could be interpreted as supporting Iran’s digital asset sector. Compliance teams should review exposure to Iran-nexus counterparties — particularly OTC brokers, exchanges, and payment intermediaries operating in jurisdictions frequently used to facilitate Iranian oil trade — and expect an accelerated pace of enforcement.
FAQs
What is Operation Economic Outcast?
Operation Economic Outcast is a whole-of-government economic campaign launched by the U.S. Treasury on August 24, 2026, targeting the Iranian regime and its enablers. As part of the operation, OFAC sanctioned nearly 60 entities, individuals, and vessels and issued five new sectoral determinations under Executive Order 13902.
Why is the digital assets sectoral determination significant?
For the first time, OFAC has designated digital assets as a sector of the Iranian economy subject to secondary sanctions under E.O. 13902. This means OFAC can now sanction any foreign person, anywhere in the world, that operates in or provides support to Iran’s digital asset sector, expanding secondary sanctions exposure for global crypto businesses.
Who is Ivan Obukhov?
Ivan Obukhov is a UAE-based Ukrainian national designated by OFAC for serving as a broker for Iranian shadow fleet vessels. Since 2023, he has processed over $100 million in cryptocurrency payments to facilitate oil sales on behalf of the IRGC-Qods Force.
What is the connection between today’s cyber designations and the FBI indictment?
Today’s designations of MOIS-linked cyber actors, including Arman Kahzadian, were taken in close coordination with the FBI’s August 18, 2026 superseding indictment charging 17 Iranian cyber actors. Four of those indicted individuals were designated by OFAC today.
What should compliance teams do?
Compliance teams should review exposure to Iran-nexus counterparties, particularly OTC brokers, exchanges, and payment intermediaries in high-risk jurisdictions. Chainalysis has labeled the relevant addresses associated with today’s designations in its product suite.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
