Mabna Institute crypto wallets linked to $16.8M in Iran-related flows

Blockchain intelligence firm TRM Labs has traced approximately $16.8 million in cryptocurrency flows across 30 addresses linked to members of Iran’s Mabna Institute. The identified wallets utilize Bitcoin, Ethereum, and TRON networks.

Analysis shows a high concentration of activity, with ten addresses controlled by Keyvan Fayaz receiving roughly $15.5 million—representing 92% of the total on-chain volume. TRM Labs suggests Fayaz may have acted as a treasury for the operation. As of the analysis, only about $202,662, or roughly 1% of the total funds, remained in the designated wallets.

The findings follow a 14-count superseding indictment unsealed by the U.S. Department of Justice, which alleges the Mabna Institute conducted cyber intrusions on behalf of the Islamic Revolutionary Guard Corps (IRGC). These operations reportedly targeted 144 U.S. universities and 178 foreign institutions since at least 2013. The wallet designations are part of a broader effort by the U.S. Treasury to expand sanctions against Iran’s digital asset infrastructure and sever its global financial connections.