概要
- A group of Canadian OTCs have helped move millions for Iranian illicit financial networks: On Friday, OFAC designated eight Canadian over-the-counter (OTC) money service businesses for facilitating financial transactions on behalf of the Iranian regime. Our analysis has identified millions of dollars in inflows to these OTCs from IRGC-linked wallets, Iranian exchanges, and other sanctioned actors.
- The same OTCs have also enabled major drug trafficking networks: These OTCs also sent funds to major criminal networks, including more than $8.8 million sent to the Ryan Wedding Criminal Enterprise and over $2.5 million to other cartel-linked money laundering wallets. These transactions reveal the OTCs’ role in converting illicit cash into USDT for criminal organizations.
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated eight Canadian money services businesses for facilitating financial transactions on behalf of the Iranian regime. The designations mark a first-of-their-kind focus on Canadian crypto and OTC providers as part of Iran’s illicit financial infrastructure.
Our analysis shows, however, that these services cater to a far broader criminal clientele. Beyond helping Iranian regime-linked actors move crypto, these OTCs also provide the liquidity needed to launder illicit cash for some of the world’s most notorious drug traffickers.
How Canadian OTCs serve a wide array of international illicit networks
Our analysis reveals a consistent pattern across these designated OTCs: a large portion of inflows originated from IRGC and other sanctioned actors, while outgoing transfers flowed to illicit criminal enterprises, including affiliates of the Canada-based Wedding Criminal Enterprise, which was led by former Olympic snowboarder Ryan Wedding. Wedding was arrested in January on murder and drug trafficking charges.
This pattern reflects two complementary uses of the same OTC infrastructure. Iranian crypto holders and their intermediaries can use these services to move crypto and obscure their origins, while drug trafficking organizations can use them to convert bulk cash proceeds into stablecoins. So while these Canada-based OTCs advertise in Farsi and look to attract Iranian customers, they also attract enterprise-level criminal organizations operating in the same region.
Ultimately, these OTCs serve as financial intermediaries between distinct illicit economies.
How the OTCs moved millions in cryptocurrency from Iran’s sanctioned exchanges and IRGC-linked actors
The scale of activity by these OTCs is significant. We identified more than $6 million in inflows originating from sanctioned jurisdictions, alongside $3.7 million from sanctioned entities. An additional $2.3 million came from wallets we attribute to terrorist-financing actors, including networks linked to the IRGC, Hamas, and the Houthis.
The Reactor graph above illustrates how five sanctioned OTCs received funds from wallets identified on both the NBCTF Seizures List and the OFAC sanctions list, as well as sent funds to OFAC sanctioned entities. The incoming transfers varied significantly in value, ranging from several hundred dollars to hundreds of thousands of dollars in cryptocurrency.
And the Iranian connections run deep. Among the sanctioned entities appearing in the transaction flows were Aban Tether Exchange, Nobitex, Ramzinex, and Wallex, all Iranian exchanges. The OTCs also received funds from wallets linked to sanctioned Iranian individuals, including financier Arash Estaki Alivand and Keyvan Fayyaz Gharen Blagh, an alleged cyber threat actor working on behalf of the IRGC.
As shown below, we uncovered links between the newly sanctioned Million Exchange and Fayyaz. Fayyaz’s reported activities offer a glimpse into the significance of these connections. An employee of the Iran-based Mabna Institute, he was involved in hacking and extortion operations targeting a U.S. entertainment and media company at the behest of the IRGC. He also participated in cyberattacks against several U.S. defense companies, a U.S. communications technology provider, a Saudi energy company, and other targets.
The OTCs also received hundreds of thousands of dollars from laundering networks associated with Iranian state oil proceeds, alongside funds from Iranian OTC services. Among the more striking counterparties we identified was an Al-Qassam Brigades Money Mover, a financial facilitator associated with Hamas’s military wing.
How the OTCs served Ryan Wedding, one of the world’s most wanted drug traffickers
Our analysis identified millions of dollars in outflows to the Wedding Criminal Enterprise (the Wedding Cartel).
Arrested in January, Wedding is known by the alias “El Jefe.” He faces multiple charges, including drug trafficking, witness intimidation, and murder-for-hire. U.S. authorities allege that he led a sophisticated transnational criminal enterprise responsible for moving massive quantities of cocaine from Colombia through Mexico and into the United States and Canada.
Prosecutors state that Wedding operated under the protection and collaboration of Mexico’s Sinaloa Cartel, moving approximately 60 metric tons (around 60,000 kilograms) of Colombian cocaine through Mexico and Southern California into the U.S. and Canada. U.S. and federal investigators state the organization generated roughly $1 billion annually. His organization is also accused of using violence and intimidation to protect its operations, eliminate rivals, and obstruct law enforcement investigations, including the murder of a potential witness.
Wedding’s organization allegedly laundered billions of dollars in drug proceeds through money exchange businesses operating in the Vancouver and Toronto areas, as outlined by OFAC. The operation reportedly relied on a cash-to-digital-asset pipeline: couriers delivered bulk cash to exchange businesses, which converted the proceeds into digital assets before transferring the funds overseas.
Our own analysis provides a closer look at how these funds moved through this network. As illustrated in the Reactor graph below, Farah, one of the sanctioned OTC exchanges, sent funds to multiple intermediary wallets that subsequently transferred funds to the Wedding Cartel. Farah also sent a sum of 2 million USD directly to wallets associated with the organization. Further, two additional Canada-based, Farsi-language OTCs that Chainalysis has independently identified have ties to the Enterprise via the same intermediary wallets.
The designations expand efforts to disrupt Iranian crypto networks
Uncovered is a financial ecosystem in which the same intermediaries can serve the interests of the Iranian regime, terrorist-financing networks, and powerful drug trafficking organizations. These actors may have different objectives, but they increasingly rely on overlapping financial infrastructure to move and obscure their money.
The lesson is clear: illicit financial networks do not operate in silos. Disrupting one requires understanding the broader ecosystem around it. And as this designation demonstrates, following the money can expose connections between criminal enterprises that might otherwise appear to have nothing in common.
The action builds on previous OFAC designations of Iranian exchanges accused of moving funds for the regime, including Nobitex, Wallex, Bitpin, and Ramzinex in June 2026, and Aban Tether Exchange and SHPS Shelbit in August 2026. By targeting Canadian businesses connected to these exchanges, OFAC is extending its reach beyond these exchanges themselves to the intermediaries facilitating cross-border transactions.
よくある質問
Why did OFAC sanction Canadian cryptocurrency OTCs?
OFAC sanctioned eight Canadian money services businesses for allegedly facilitating cryptocurrency transactions on behalf of the Iranian regime and other sanctioned actors. The businesses were identified as part of Iran’s broader illicit financial infrastructure, helping move funds through cryptocurrency networks and cross-border intermediaries.
How were the Canadian OTCs connected to Iran’s Islamic Revolutionary Guard Corps (IRGC)?
Blockchain analysis identified millions of dollars in inflows to the OTCs from wallets linked to the IRGC, sanctioned Iranian individuals, and Iranian cryptocurrency exchanges. These connections included wallets associated with alleged IRGC cyber threat actors and other entities involved in Iran’s illicit financial networks.
How much cryptocurrency did the sanctioned Canadian OTCs receive from illicit sources?
The analysis identified more than $6 million in inflows originating from sanctioned jurisdictions, approximately $3.7 million from sanctioned entities, and an additional $2.3 million from wallets attributed to terrorist-financing actors, including networks linked to the IRGC, Hamas, and the Houthis.
How were the Canadian OTCs connected to Ryan Wedding’s criminal organization?
Blockchain analysis identified more than $6.8 million in transfers to the Ryan Wedding Criminal Enterprise, also known as the Wedding Cartel. The funds moved through direct transactions and intermediary wallets connected to Canadian OTC providers, including Farah.
How do drug trafficking organizations use cryptocurrency OTC services to launder money?
Drug trafficking organizations can use OTC services to convert bulk cash proceeds into digital assets such as USDT (Tether). Couriers deliver cash to exchange businesses, which convert it into cryptocurrency and transfer it to intermediary wallets or overseas destinations. This process can make it harder to trace the origins and movement of illicit proceeds.
What is the significance of the connection between Iranian networks and international drug cartels?
The findings demonstrate how seemingly unrelated criminal organizations can rely on overlapping financial infrastructure. Iranian regime-linked actors, terrorist-financing networks, and international drug trafficking organizations may have different objectives, but they can use the same cryptocurrency intermediaries to move funds and obscure their origins.
本ウェブサイトには、Chainalysis, Inc. およびその関連会社（以下、総称して「Chainalysis」）の管理下にない第三者のサイトへのリンクが含まれています。当該情報へのアクセスは、Chainalysis が当該サイトまたはその運営者との提携、支持、承認、または推奨を行っていることを意味するものではなく、Chainalysis は、当該サイトで提供される製品、サービス、その他のコンテンツについて一切の責任を負いません。
本資料は情報提供のみを目的としており、法律、税務、財務、または投資に関する助言を提供するものではありません。受領者は、こうした決定を行う前に、各自のアドバイザーに相談してください。Chainalysis は、受領者が本資料を利用したことに起因する、つながり におけるいかなる決定、その他の作為または不作為についても、一切の責任を負いません。
Chainalysis 当社は、本報告書に記載された情報の正確性、完全性、適時性、適合性、または有効性を保証するものではなく、当該資料のいかなる部分における誤り、欠落、またはその他の不正確さに起因するいかなる請求についても責任を負いません。
