Iran's Mabna Institute Transfers $16.8 Million via Crypto Addresses
The Block reports that TRM Labs has revealed that Iran's Mabna Institute transferred approximately $16.8 million through 30 Bitcoin, Ethereum, and TRON addresses, with activities traceable back to 2018.
The institute is accused of conducting coordinated hacking-for-hire activities on behalf of the Islamic Revolutionary Guard Corps and other Iranian clients. TRM's analysis shows that 10 addresses controlled by one defendant received about $15.5 million, accounting for 92% of the total.
The U.S. Department of Justice has recently expanded its indictment, charging 17 Iranians linked to Mabna with stealing over 31TB of data from universities, companies, and government entities. OFAC has simultaneously sanctioned the related crypto addresses.
The address balance is now approximately $200,000, with most funds having been transferred or used. Some transactions indicate layered operations leading to centralized exchanges.
In light of these events, sanctions and on-chain tracking have intensified monitoring of crypto flows related to Iran, with funds moving from hacking proceeds to marked addresses. Beneficiaries include blockchain analysis and law enforcement cooperation, while affected parties are the related networks and sanction evasion channels.
Source: Public Information
ABAB AI Insight
Mabna Institute has been operating since around 2013 and is described by U.S. authorities as a cyber-hiring organization that has long provided intrusion services to the IRGC and others, targeting global universities and businesses. The expansion of the indictment in 2026, including sanctions on crypto addresses, indicates that law enforcement is extending from traditional hacking charges to on-chain fund flows.
In terms of capital pathways, hacker proceeds are managed through multi-chain addresses, with resources converted from data theft to crypto asset storage and transfer. The motivation is to utilize crypto anonymity to evade sanctions while achieving centralized control over funds. TRM tracking reveals a highly concentrated holding structure.
Similar to other cases of state-supported hacking organizations using crypto, or early North Korean related on-chain tracking; this is currently occurring during the U.S. phase of expanding crypto sanctions and prosecutions against Iran.
Essentially, this represents a regulatory shift. On-chain analysis directly links traditional cybercrime with crypto funds, with the mechanism being through address clustering and inflow analysis, extending sanctions from physical assets to digital assets, thereby compressing the monetization space for hackers-for-hire.
ABAB News · Law of Cognition
- Hacker proceeds will ultimately leave on-chain traces.
- Centralized addresses expose the core of fund control.
- Sanctions escalate, striking simultaneously at individuals and currencies.