How illicit Iranian gambling network helped pull off $4b sanctions dodge

Highlights:

• Reuters uncovered $4b Iranian sanctions-evasion network centred on Dubai-based crypto exchange Shelbit
• Investigators linked Shelbit to Iran's central bank, IRGC-connected wallets and illegal gambling
• Authorities say Shelbit processed billions through global crypto markets, including Binance
• UAE regulators are investigating Shelbit over alleged sanctions evasion, money laundering
• Reuters found IRGC allegedly used online gambling networks to move money abroad

One of the world's largest illegal gambling networks sends millions of dollars worth of crypto through an office in Dubai, part of a $4 billion Iranian sanctions evasion operation.

The office, above a budget hotel in an unfashionable neighbourhood, is the listed address of Shelbit, an unlicensed crypto exchange run by an expatriate Iranian, according to data shared by two crypto investigative firms and an independent analyst, and reviewed by Reuters.

Among Shelbit's main customers is a Farsi-language gambling network of more than 2,000 websites, fronted by two flashy Iranian influencers with high-level government connections – one operating from an expensive villa in Madrid and the other, until recently, from a luxury hotel in Hong Kong.

The two men and the Iranian running Shelbit were convicted as partners in crime in an illegal gambling case in Iran in 2023.

Gambling is outlawed in the Islamic Republic, punishable by lashing and prison. Yet, the gambling network identified by Reuters has access to Iran's online payments system, which is closely overseen by the country's central bank.

This is by far the biggest Iranian illegal gambling network ever discovered and one of the biggest in the world.

John Wojcik, former senior threat researcher at Infoblox

Shelbit is the hub of the Iranian money-moving operation, through which the gambling network, the central bank and other sanctioned Iranian entities have access to global crypto markets.

The data on the Shelbit money flows, including the total of at least $4 billion that the exchange has processed since May 2024, were analysed by the two crypto investigative firms and Rich Sanders, an independent blockchain researcher and investigator focused on Iran. The two companies requested anonymity to discuss the sensitive data, which was reviewed by Reuters. Tens of millions of dollars of the gambling network's crypto can be traced through blockchain records to Shelbit.

Shelbit has moved hundreds of millions in currency to some of the most prominent players in crypto, including the world's biggest exchange, Binance.

Shelbit also interacts directly with Iran's central bank; with wallets the Israeli government has linked to the Islamic Revolutionary Guard Corps; and with Nobitex, an Iranian exchange which the  government sanctioned earlier this year after a Reuters investigation revealed its ties to the government. Some of the crypto that has flowed to Shelbit came from what the two crypto investigative companies say is an Iranian bitcoin mining operation, which mints new digital coins.

"It's an IRGC operation, and that's plain as day," Sanders said of Shelbit.

The flows into Shelbit continued in the buildup to the war with the and Israel in February. The crypto kept coming even after the Islamic Republic repeatedly bombed the United Arab Emirates, including a drone that hit less than a kilometre from the exchange's offices.

The revelation of the money-moving network shows the ingenuity behind Iran's ability to weather years of punishing trade and banking sanctions. The IRGC has played a pivotal role in keeping the economy afloat during its on-again, off-again war with the United States and Israel, emerging more powerful than ever.

The Reuters investigation also found that, years ago, the IRGC took control of the largest gambling websites accessible inside Iran and has since used them to move money abroad.

When it comes to gambling, the IRGC learned the Islamic Republic's most lucrative lesson early: declare something illegal, then control both the prohibition and the black market.

Miad Maleki, former associate director of the Office of Foreign Assets Control

Reuters spoke to more than 30 people to uncover the sanctions evasion network, including two formerly affiliated with the Guards, a former government official, two senior Iranian insiders with knowledge of the scheme, and people with direct knowledge of ongoing UAE government investigations into the operation. The gambling websites were identified and their relationships mapped in collaboration with the cybersecurity company Infoblox.

"This is by far the biggest Iranian illegal gambling network ever discovered and one of the biggest in the world," said John Wojcik, a former researcher at Infoblox who spent seven years investigating illegal gambling for the United Nations Office on Drugs and Crime. Wojcik is now a senior analyst at TRM Labs.

It is also one of the biggest Iranian sanctions evasion networks discovered since 2016, when the United States broke up a roughly $20 billion IRGC gold-for-oil operation based out of Turkey.

These screenshots show two of the gambling sites from the vast Farsi-language network promoted by two Iranian influencers. Iran's law forbidding gambling was updated in 2023 to include online games of chance.

Reuters could not determine whether the IRGC had direct control of the gambling network and Shelbit, or who specifically in the Iranian state controlled the sanctions evasion operation. Reuters also could not determine where much of the crypto ultimately ended up.

Dubai's Virtual Assets Regulatory Authority, or VARA, is investigating Shelbit's alleged role in helping Iran launder money and evade sanctions, according to a person with direct knowledge of the case. The exchange's founder Siavash Kayvanpour and the wider network of Iranians involved in crypto-based illegal gambling are also being scrutinised by the agency, the person said.

VARA confirmed that both it and the Dubai Department of Economy and Tourism had taken enforcement action in 2025 against Shelbit for operating without a license. On July 24, soon after Reuters requested comment from the authority, VARA issued a notice saying Shelbit was in violation of money-laundering and terrorism financing laws, ordering it to "cease and desist immediately from all unlicensed Virtual Asset activities."

"The exposure identified by VARA extends beyond consumer protection to more egregious cross-border transactions with the propensity to impact the integrity of the UAE financial system," according to the notice issued on VARA's website.

One of the men fronting the gambling operation, Sasha Sobhani, is the son of a former senior Iranian diplomat and government minister whose father has publicly disavowed him for what he described as un-Islamic behaviour.

Another, Pooyan Mokhtari, is an influencer and singer who moved between luxury hotels in Hong Kong after being expelled in late April from Dubai, where he was arrested and accused by the authorities of financing Iranian terrorist organisations.

The pair flaunt their lavish lifestyles on social media, posting videos of luxury sports cars, yacht parties, and private jets.

Mokhtari denied the allegations levelled against him in Dubai and said he was not part of the IRGC or any Iranian military groups. He did not say whether he had done business with them.

"I'm not part of them, but I wish, I hope one day that I become like them – not to attack anyone, (but) to defend people," he said in an interview in Hong Kong. "I've never used my power and my money and my status on social media to disturb anyone, to damage something for humanity."

Sasha Sobhani, right, and Pooyan Mokhtari, left, were convicted in an Iranian illegal gambling case in 2023. This photo was posted in 2021. Source: Screenshot/Instagram/Reuters

The UAE Ministry of Foreign Affairs did not respond to questions about Mokhtari's arrest, release or visa status.

"The UAE adheres to the highest international standards, maintains strict oversight across all sectors and works closely with international partners to disrupt and deter all forms of illicit financial flows," the ministry said in a statement to Reuters.

Mokhtari told his social media followers in late June that he planned to attend the funeral of the assassinated supreme leader in Iran in early July. Over several days of buildup, Mokhtari posted images of himself with newly bleached hair, in the gym, packing, and shopping for gifts.

"It's a strange feeling. I'm going to the homeland," he wrote on 4 July, alongside a teary-eyed emoji.

Both he and Sobhani denied that the gambling sites they promote were connected to each other. But though many of the domains "were registered at different times, using different names, and exhibiting different brands," they share software and other technical characteristics that link them, Infoblox said.

The two men said they had no knowledge of any Iranian state involvement in their activities, that they did not know Kayvanpour, and that they were unfamiliar with Shelbit.

"I categorically deny any involvement in money laundering, sanctions evasion, terrorism financing or moving funds on behalf of the Iranian government, the Central Bank of Iran, the IRGC or any other Iranian state institution," Sobhani said in an emailed statement to Reuters.

Neither Kayvanpour nor the Iranian government responded to requests for comment. The Dubai police and general prosecutor's office also did not respond to requests for comment. The VARA statement did not mention Sobhani or Mokhtari.

The  Treasury Department's Office of Foreign Assets Control "is aware of these allegations and is taking them very seriously," a Treasury Department spokesperson said. "Since President Trump resumed office, Treasury has aggressively targeted Iranian-regime-linked digital assets."

The data reviewed by Reuters showed Shelbit has processed at least $130 million for just one of the gambling sites linked to the wider network since May 2024, when the exchange appears to have started operations.

"Ideology is the IRGC's branding while profit is its business model," said Miad Maleki, who helped design the  Treasury Department's Iran sanctions evasion policy when he was associate director of the Office of Foreign Assets Control, a post he held until last year. "When it comes to gambling, the IRGC learned the Islamic Republic's most lucrative lesson early: declare something illegal, then control both the prohibition and the black market."

The IRGC is the branch of the Iranian state that safeguards the Islamic Revolution and oversees commercial enterprises worth billions.

Despite the billions that have moved through Shelbit, there is currently no identifiable way for a member of the public to use the exchange. Three people at the address registered as Shelbit's office in the Deira neighbourhood of Dubai told a visiting Reuters reporter they had never heard of the company and had nothing to do with crypto. Online transactions are also impossible, because Shelbit no longer has a website.

Asked about its interactions with Shelbit, Binance said Shelbit had never had a Binance account nor been sanctioned. Binance did not dispute processing hundreds of millions of dollars for Shelbit, saying those transactions were not considered to be high risk.

"When users associated with Shelbit interacted with our platform, our compliance program operated as it should have: it investigated, froze the relevant accounts, and reported them to law enforcement," Binance said in a statement. The company provided no further details.

The takeover

The IRGC's embrace of online gambling is an extension of the stranglehold that it increasingly exerts over the country's economy, both legal and illegal. While suspicions of state involvement in gambling were raised in a 2021 Washington Institute report, among others, Reuters is the first news organisation to detail the IRGC takeover of the lucrative sector.

When online gambling took off in Iran around a decade ago, the IRGC saw an opportunity and took control of it, said Reza Gheibi, a former Iranian government official who left Iran in 2022 and now lives in Britain.

Online gambling also required the collaboration of Iran's central bank, which controls the domestic electronic payments infrastructure, including bank cards and money transfers, Gheibi said.

This screenshot from the gambling site abt90 shows how it offers direct access to Iran's payment system, which is tightly controlled by the central bank.

The IRGC's takeover of gambling in Iran was confirmed by Hamid Nikou, who once advised the Guards as a policy strategist; Mohammad Hossein Torkaman, a former member of an IRGC unit that served as personal protection for the supreme leader and his family; and two other Iranians with direct knowledge of the matter.

"When financial enterprises grow large and operate independently of the ruling establishment and security institutions, the IRGC moves to oversee them," Nikou said. "They used gambling websites as a way to connect financial systems inside and outside the country."

The IRGC co-opted famous Iranian performers and social media influencers to market the websites to their millions of followers, according to Gheibi, Nikou and Torkaman. Their displays of wealth and excess appealed to Iranians suffering through a slumping economy, they said.

Nikou left Iran in 2015 – and his job as a senior strategist at the Andishesh Sazan Noor Strategic Studies Institute, which advises the IRGC on policy. Torkaman left in 2010. Gheibi, Nikou and Torkaman said they maintain state connections inside Iran and speak to them frequently.

Torkaman was arrested in Iran as a security threat and said he fled soon after he was released from prison. Nikou said he left Iran to get a doctorate but dropped out of the program. Gheibi, who worked for years as an economic journalist in addition to his government post, left after repeated interrogations following interviews he gave to foreign news organisations.

Reuters has identified more than 60 Iranian influencers promoting the gambling websites, about half of whom have more than 1 million followers. Three have audiences exceeding 10 million.

'Click and have fun'

With his extensive tattoos and taste for designer labels, Sasha Sobhani, whose given name is Mohammad Javad, is among the most recognisable figures in Iran's online gambling world.

The son of a former ambassador, he has 3.7 million followers on Instagram, where he promotes his music alongside gambling sites. He told Reuters he no longer had contact with his father.

In a 2025 TikTok post by his Spanish girlfriend, he is seen giving her a bright-pink Rolls-Royce for her 18th birthday. Featured prominently at the top of his Instagram profile is a link to one of the gambling websites. Between emojis of winged stacks of cash is a simple instruction: "Click and have fun."

Sobhani posts photos of his multimillion-dollar villa in Madrid, previously owned by a Real Madrid player. In one Instagram video that was reposted dozens of times, Sobhani peels bills off what appears to be a stack of bank notes so they flutter across his hotel suite.

Pooyan Mokhtari built an even larger Instagram following before his account was taken down earlier this year. Now he's on Vatan, a mostly Farsi-language gambling-based social network he says he built, and has a far smaller following. Reuters could not establish why his Instagram account was disabled. Meta, which owns Instagram, did not provide a reason when contacted for comment.

Mokhtari's posts frequently mixed displays of wealth – including a collection of supercars and expensive watches – with music videos and content supportive of the Islamic Republic.

One Instagram post showed him meeting former President Akbar Hashemi Rafsanjani. In a joint live Instagram chat involving Mokhtari and another Iranian, Ahmad Khomeini, grandson of the Islamic Republic's founder Ruhollah Khomeini, joined the conversation briefly.

A post from Mokhtari's now-closed Instagram account shows him meeting former President Akbar Hashemi Rafsanjani (left). Another post shows his car's transformation from gold into pink. Photos: Screenshots/Instagram/Reuters

Mokhtari displayed photos of his Koenigsegg Jesko Attack car worth $3.5 million, showing its transformation from shiny gold into bright pink.

Mokhtari and Sobhani have been working together since at least 2020, when they were prosecuted for starting a network of illegal gambling sites including abt90 and Hazarat, according to Iranian legal filings reviewed by Reuters. They were living abroad at the time and convicted by Iran in absentia three years later and sentenced to two years in prison. Siavash Kayvanpour, the Shelbit founder, received a three-month sentence for assisting them.

Iran issued Interpol red notices for Mokhtari and Sobhani, according to an Iranian court document and a person familiar with the matter. Both were detained in Spain, where they were then living. Mokhtari said he was held for more than a month. The notices were later cancelled by Interpol following a request from the individuals, the person said. Interpol can withdraw red notices if governments fail to provide additional information when they are contested.

Mokhtari told Reuters he had done nothing wrong and that gambling wasn't illegal in Iran.

"In Iran, they don't have any written rules … about this area, which is online prediction market or gambling or what you call it," he said. "It was not illegal basically."

Article 705 of Iran's Penal Code says gambling is punishable by up to six months in prison and 74 lashes. In 2023, the law was amended to include online betting.

But when the Islamic Republic cracks down on a gambling network, it is about taking out competitors rather than protecting the public, said Gheibi, the former Iranian government official.

"It's not because they care about people's welfare or because gambling is forbidden," he said. "This is about eliminating rivals."

In March 2024, Iran's intelligence ministry announced that it had smashed a massive "London-based mafia network" that was operating 54 illegal gambling websites. At the time, the ministry described the "Nitro Bet" network as Iran's largest.

The 2,000-site gambling operation promoted by Mokhtari and Sobhani, which offers games of chance such as slots, blackjack and roulette, is considerably larger than Nitro Bet, and appears to be flourishing, according to the crypto and IT security investigators who spent months analysing their operations.

None of the current or former Iranian officials who spoke to Reuters knew specifically why the network promoted by Mokhtari and Sobhani was allowed to operate. The Nitro Bet site is no longer accessible.

The IRGC "built networks and organisations in which the faces changed over time," Gheibi, the former government official, explained. "Whoever became prominent, IRGC intelligence would position itself behind them and use them to push the operation forward."

An Instagram post from October 2022 shows Sobhani and Mokhtari sitting side by side on a private jet eating a McDonald's meal. Mokhtari posted the comment, "My bro."

The two men are still promoting the sites that featured in their Iranian prosecution.

In his statement, Sobhani noted that the red notice against him was cancelled and the Spanish case was dropped.

"Any suggestion that I cooperate with the same [Iranian] authorities who pursued me is entirely false," he wrote.

He said his involvement in abt90 was limited to paid social media advertising.

"I was never an owner, shareholder, director, manager, employee, operator or decision maker of ABT90 or any related platform," Sobhani said. "I do not know how any such websites accessed Iranian payment systems."

Watches and crypto

Tucked between money exchanges and office buildings in Dubai, Shelbit's office can be reached through the lobby of a budget hotel. From there, a crowded lift takes visitors to the fourth floor and a heavy locked door, fitted with a buzzer and a security camera. The sign next to the door reads "Velorix Watches Trading LLC." Velorix is another business registered to Kayvanpour, the Shelbit founder, according to Dubai corporate filings.

During a visit in early July to the three-room office, a Reuters reporter saw 13 battered watches on display, a cash-counting machine and a desk. One of the three staff, who wore a t-shirt and sandals, said he had never heard of Kayvanpour.

"Who sent you?" another asked.

They said the watches were not for sale.

Sanders and the two crypto investigative firms said they were convinced that all of the $4 billion moving through Shelbit was controlled by the Iranian state because of Shelbit's direct interactions with the central bank and other sanctioned entities, its lack of an online presence and its links to the crypto mining operations.

Shelbit processed at least $125 million from the central bank of Iran, much of it directly, the crypto analysts said. Shelbit also received at least $20 million from the suspected Iranian crypto mining operation via intermediary wallets, which obscure the source of the currency, according to blockchain data reviewed by Reuters.

Mining involves using computers to solve complex maths puzzles to create new digital coins, essentially minting fresh currency. Iran in 2019 legalised the process, requiring miners to obtain government licences.

Mining has since become a cornerstone of Iran's evasion of Western sanctions that cut the country off from hard currency and the global banking system. Bitcoin and other tokens produced in Iran are being sold by the central bank on international crypto markets, according to a 2024 letter from senators Elizabeth Warren and Angus King to senior Biden administration officials.

At least $676 million in crypto has flowed from Shelbit addresses to Binance since May 2024, according to the investigative companies and blockchain data reviewed by Reuters. About $540 million of that moved after VARA, the Dubai regulator, fined Shelbit last year for providing unlicensed exchange services and advertising them.

Sanders, the independent researcher and investigator, said he informed Binance of Shelbit's ties to Iran in October 2025. The funds continued to flow from Shelbit to Binance after Sanders' warning, the data shows.

Binance did not respond to questions about what actions, if any, it took in response.

In its statement, Binance said, "The flows associated with Shelbit to Binance were not deemed high risk by an independent third-party blockchain analytics firm." It did not identify the firm. Binance also said it could not "reconcile" the amount that moved after the VARA fine.

Binance was fined $4.3 billion in 2023 by the United States for breaking anti-money laundering rules, including processing Iranian crypto trades.

In December, Binance secured key regulatory licenses in the UAE for its main trading platform.

In late March, Dubai police arrested Mokhtari for allegedly financing Iranian terrorist groups that were carrying out hostile acts against the UAE, according to two people with knowledge of his detention.

He was held for 35 days and then expelled from the country and forced to forfeit his assets, including the contents of his UAE bank accounts and his $5 million house, they said. In an interview in early May with an Iranian podcaster, Mokhtari discussed the arrest and said he was falsely accused of financing attacks on the UAE.

After Mokhtari's expulsion from Dubai, Reuters tracked him via his social media posts to a $ 2,000-a-night suite in a hotel overlooking Hong Kong's Victoria Harbour. He lamented his treatment by Dubai authorities, who he said had stripped him of everything. He said in a social media post that he'd been arrested after sending $150,000 to friends in Iran.

Mokhtari spoke to Reuters at his hotel in Hong Kong, shortly before he left for Iran. He told his social media followers in late June that he planned to attend the funeral of the assassinated supreme leader. Photo: Reuters

Mokhtari also disclosed that he had been living under an assumed identity in the UAE. He shared a photo of his 10-year golden visa in the name of Patrick Philippe, a citizen of Vanuatu in the South Pacific Ocean.

After two months in Hong Kong, Mokhtari appeared to be preparing for rehabilitation back home. Ahead of his departure, he was interviewed by sympathetic Iranian media outlets who portrayed him as a reformed, God-fearing man who reads the Koran and prays daily.

On 8 July, from Bangkok, he posted a selfie from the foot of the steps leading to his Iran-bound airliner.

"Inshallah I'm in Tehran in less than 24 hours, please pray that I can be helpful and proud in front of God Almighty and the good people in this world," he wrote. By then, the supreme leader's funeral procession in Iran was over.

Mokhtari has not posted since.