What happened
As part of a broad Iran action, Treasury announced designations targeting what it describes as Iranian cyber actors behind critical-infrastructure intrusions and digital-asset theft, a group Treasury says has operated since at least summer 2023 for or on behalf of the Ministry of Intelligence and Security (MOIS). The same OFAC action also updated the record of the IRGC Cyber-Electronic Command (IRGC-CEC), a separate entity entry. The named individuals include Mojtaba Ghal'eh-Kuhi, Behzad Mesri, Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i, and Arman Kahzadian.
Behzad Mesri is a familiar name: OFAC first sanctioned him in 2018, with a further action in 2019. Today's action updates his SDN record and, for the first time, attaches cryptocurrency addresses to it: 12 Ethereum, 2 TRON, and 1 Bitcoin address.
The 30 designated wallets, by person
Counts as listed on OFAC's record for the four individuals carrying addresses. Every Ethereum and TRON address links to its live TrustSniffer screening page.
Behzad Mesri, 15 addresses (12 ETH, 2 TRON, 1 BTC)
- Ethereum: 0x252a8bd2…053bce, 0x1CAb8177…40CbEB, 0x6Fac4D18…4Ab9C0, 0xA40cFBFc…a35F6f, 0x7F03679B…29E881, 0x8ac5381F…4B4bC6
- Ethereum (continued): 0x9697749A…40684c, 0x9DD7fA4B…94Ec08, 0xb5A69Da6…1A7b7c, 0x6B0736Fe…13AbCA, 0xd81414AB…B4fDe5, 0xF45Ecc3a…75Be91
- TRON: TAbbVaBK…1HinQh, TEsxMcVo…WqSpPv
- Bitcoin: 12aNKp2iDKuhEde2YfPdd4DFGenRUTKupL
Keyvan Fayyaz Ghareh Blagh, 10 addresses (5 ETH, 2 TRON, 3 BTC)
- Ethereum: 0x4060cbf8…825279, 0x56de1527…072ba7, 0x8694ed13…dc7423, 0xbd3276f2…521a24, 0xf1c4c44d…04e597
- TRON: TXR4FDAZ…12WWHk, TP3kVtnF…bKNgB6
- Bitcoin: bc1qf6zxs4lkp9umh6hf087mh70w0ymcyt8cunp58r, bc1qr2pwmvkpq5tc5um2g9uh34yyu6wepwx89rts70, bc1q4ktvxxhhvf8qhs9qkdsm9arcxfmmeex6rl7n50
Arman Kahzadian, 3 addresses (2 ETH, 1 BTC)
- Ethereum: 0xeb507efa…459da3, 0xef85a6fa…29ce2a
- Bitcoin: 1JGPiQGK78xTxAVoxA1MjK3Z15M84Rj6BL
Mojtaba Ghal'eh-Kuhi, 2 addresses (1 ETH, 1 BTC)
- Ethereum: 0x1b8579cf…b61e6e
- Bitcoin: 1GXeCkFQq7SYo6B7wdLAPkkri6NFTFB7No
The freezes came before the announcement
This is the detail our own data adds. TrustSniffer's live enforcement feed monitors stablecoin issuer blocklist transactions on-chain, in real time. On the afternoon of 24 August, before OFAC's public posting, our feed recorded Circle executing USDC blocklist transactions against these exact Ethereum wallets, one by one: Blagh's five wallets between 17:54 and 18:05 UTC, then Mesri's, Ghal'eh-Kuhi's and Kahzadian's through 18:44 UTC. Circle mirrored several of the bans on Polygon within seconds of the Ethereum transactions.
The sequence is a window into how modern sanctions enforcement works: issuers are positioned to act on designations at machine speed, and the on-chain record often moves before the paperwork appears. It is also why screening a counterparty wallet minutes before you transact matters; the freeze record updates faster than any news cycle.
What this means if you interact with these addresses
- U.S. persons are generally prohibited from transacting with SDN-designated addresses, and property in U.S. jurisdiction must be blocked. Non-U.S. exchanges and services widely apply the same screening.
- USDC held by the designated Ethereum wallets is already frozen by the issuer; USDT and other assets may be restricted by exchanges on deposit.
- Funds that PASSED THROUGH these wallets carry taint: a full wallet report traces whether your counterparty connects to them, hop by hop.
- If you have received funds you suspect trace to these wallets, document everything and screen the addresses involved before moving anything.
Check any address against the live record for free with our wallet screening, browse all designated and frozen wallets in the directory, or read how issuer freezes propagate in our earlier analysis of wallets flagged before their freezes and the OFAC action against Iran's central bank crypto holdings.
