OFAC Sanctions Zedcex and Zedxion in First-ever Designation of an IRGC-linked Digital Asset Exchange
Key takeaways
- OFAC sanctioned Zedcex, Zedxion, and Babak Zanjani, marking the first designation of an IRGC-linked digital asset exchange.
- Treasury also designated six major exchange-attributed wallet addresses, reflecting a focus on operational crypto infrastructure.
- TRM analysis previously connected the exchanges to approximately USD 1 billion in IRGC-linked stablecoin flows, largely in USDT on TRON, with IRGC-associated activity comprising the majority of observed volume at its peak.
- The case illustrates how lightly regulated corporate structures can obscure beneficial ownership and control of crypto exchange infrastructure across jurisdictions.
- The enforcement frontier in crypto sanctions is increasingly about platform governance, ownership, and infrastructure-level control, not simply tracing individual transactions after the fact.
{{horizontal-line}}
Today, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Zedcex Exchange Ltd, Zedxion Exchange Ltd, and Iranian sanctions-evasion financier Babak Morteza Zanjani, marking a major escalation in the use of sanctions authorities to disrupt illicit crypto infrastructure.
In its press release, Treasury described the action as the first designation of an IRGC-linked digital asset exchange, underscoring the growing role of cryptocurrency platforms in Iran’s sanctions evasion and proxy financing ecosystem.
Zanjani and the Zedcex Network
OFAC also announced new sanctions targeting Iranian officials responsible for the regime’s brutal crackdown on its own people. Among those designated is Babak Zanjani, a notorious Iranian financier long tied to some of the regime’s most significant corruption and sanctions evasion schemes.
TRM Labs analysis previously surfaced Zedcex and Zedxion as UK-registered front companies that facilitated stablecoin flows linked to Iran’s Islamic Revolutionary Guard Corps (IRGC).
Today’s action represents a significant disruption of that network. As TRM has previously identified, Zanjani has longstanding connections to the broader Zedcex ecosystem, underscoring his enduring role as a financial facilitator for the Iranian state and its sanctions-evasion infrastructure.
Zanjani previously embezzled billions of dollars in Iranian oil revenue that rightfully belonged to the Iranian people, funds that were never fully recovered. According to Treasury, he was freed from imprisonment in order to launder money on behalf of the regime and has since provided financial backing for major projects supporting the IRGC and the Iranian government more broadly.
Sanctions move beyond entities to infrastructure
OFAC also sanctioned six high-volume wallet addresses associated with the exchanges, targeting not only corporate entities but the operational infrastructure through which value moved.
These designations reflect a broader shift in crypto enforcement. The primary risk is increasingly not just illicit transactions moving through exchanges, but sanctioned actors quietly operating exchange-branded infrastructure itself.
The IRGC and the evolution of sanctions evasion through crypto
Iran’s Islamic Revolutionary Guard Corps (IRGC) remains a central pillar of Iran’s military and security establishment and has been designated by the United States and other governments for its role in terrorism, regional proxy activity, and systemic sanctions evasion.
For years, the IRGC and its affiliated commercial networks relied on familiar tools to move value under sanctions pressure: front companies, shadow banking arrangements, offshore intermediaries, and complex trade-based schemes designed to obscure Iranian state-linked financial activity.
In recent years, stablecoins and digital asset infrastructure have increasingly become part of that same toolkit. Crypto markets can offer sanctioned actors access to deep global liquidity, rapid cross-border settlement, and reduced reliance on the traditional correspondent banking system. Just as importantly, they provide operational flexibility through offshore exchange infrastructure that can be branded, reconstituted, and scaled quickly outside of conventional oversight.
The Zedcex and Zedxion network represents one of the clearest observed examples of this evolution: exchange-branded stablecoin infrastructure embedded directly within an IRGC-linked ecosystem, illustrating how sanctioned actors are no longer just using crypto, but increasingly seeking to operate and control the platforms themselves.
Two UK companies, one exchange operation
Zedcex and Zedxion were incorporated in the United Kingdom and publicly presented as conventional cryptocurrency trading platforms. On paper, they resembled lightly regulated fintech ventures operating through standard corporate structures.
However, TRM analysis identified significant indicators that the two entities functioned as a single enterprise rather than independent exchanges. Rather than representing distinct platforms, the corporate footprint suggested a coordinated structure designed to sustain continuity of operations across multiple legal shells.
UK corporate filings revealed patterns inconsistent with legitimate high-volume exchange activity. These included repeated dormant account filings, the use of virtual office addresses, nominal or straw-person directors, overlapping successor leadership, and coordinated timing of incorporation and control changes.
Zedxion Exchange Ltd was incorporated in May 2021, and corporate records indicated that Babak Morteza Zanjani was initially listed as a director. Zedcex Exchange Ltd was incorporated in mid-2022, shortly after Zanjani’s formal exit from Zedxion, and shared key structural similarities, including the same address and a successor control structure.
Taken together, the sequencing and overlap strongly suggested operational continuity rather than separation, reflecting a model in which exchange-branded infrastructure is distributed across multiple corporate entities to obscure ownership, reduce exposure, and preserve access under sanctions pressure.
Babak Zanjani and the continuity of state-aligned financial networks
OFAC’s designation of Babak Morteza Zanjani is particularly notable. Zanjani is not a typical crypto entrepreneur. He has long been associated with Iranian sanctions evasion and was previously sanctioned for laundering billions in oil-linked revenue on behalf of regime entities, including the IRGC.
Treasury described Zanjani as a criminal investor who was freed from imprisonment in order to launder money for the regime and provide financial backing for major IRGC-linked projects.
As TRM detailed in our reporting on the Zedcex and Zedxion network, the corporate and on-chain connections linking Zanjani to exchange-branded stablecoin infrastructure underscore a critical point: this activity is not opportunistic crypto abuse. It reflects the continuation of a well-established, state-aligned financial network adapting to new rails. The same actors and facilitation structures that historically moved oil revenue and sanctions-evasion flows through front companies and shadow intermediaries are now reconstituting in digital asset form, leveraging offshore exchanges and stablecoin liquidity to operate at scale.
What the blockchain revealed: Stablecoin clearing infrastructure for IRGC
TRM’s on-chain analysis connected wallets attributed to Zedcex directly to IRGC-linked counterparties, including addresses designated by Israeli authorities and blocklisted by stablecoin issuers. Rather than functioning as a neutral trading venue, the exchange infrastructure appeared to serve as a stablecoin clearing layer embedded within a broader sanctions-evasion ecosystem.
The activity was conducted overwhelmingly in USDT on the TRON blockchain, a network that is frequently leveraged in sanctions-evasion contexts because of its low transaction costs, high transaction throughput, deep broker liquidity, and widespread regional adoption.
Across 2023 through 2025, TRM observed approximately USD 1 billion in flows linked to IRGC-associated activity routed through Zedcex infrastructure, underscoring the scale at which exchange-branded stablecoin rails can be used to support sanctioned networks.
At its peak, IRGC-linked flows accounted for the majority of observed activity through the exchange network.
Rather than functioning primarily as a retail trading venue, Zedcex operated as a stablecoin clearing hub embedded within a broader sanctions-evasion ecosystem.
Designation of operational wallet infrastructure
A particularly significant aspect of today’s OFAC action was the designation not only of the corporate entities, but also of six high-volume wallet addresses associated with the exchanges.
This reflects an important evolution in sanctions enforcement. Authorities are increasingly targeting the operational wallet infrastructure that enables sanctioned actors to move value at scale, rather than focusing solely on abstract corporate entities.
For compliance teams, the implication is clear. Risk does not reside only in the name of an exchange, but in the broader wallet networks and liquidity infrastructure that may function as the financial plumbing for sanctioned ecosystems. Monitoring exchange-attributed on-chain activity is becoming just as critical as monitoring the platforms themselves.
Integration into Iran’s domestic crypto economy
Zedcex-linked activity did not exist in isolation. TRM’s on-chain tracing showed that funds routed through offshore Zedcex infrastructure later interacted with Iran’s domestic crypto ecosystem, including large local exchanges and payment services.
This pattern reflects a recurring feature of Iran-linked financial activity. Retail crypto usage and regime-aligned transactions often coexist on the same rails, creating a blurred operational environment that complicates enforcement, compliance segmentation, and risk visibility. The same stablecoin infrastructure that supports everyday economic activity can also be leveraged by sanctioned networks moving value under state direction.
Direct proxy financing: Transfers to a Treasury-designated Houthi financier
TRM analysis also identified activity linking the Zedcex network to direct terrorist financing flows.
In late 2024, more than USD 10 million in USDT was transferred from a wallet attributable to both Zedcex infrastructure and IRGC-linked entities to addresses associated with Sa’id Ahmad Muhammad al-Jamal, a Treasury-designated financier who has provided material support to the Houthis.
Notably, these transfers did not pass through mixers or intermediary aggregation layers. The absence of obfuscation underscores the role of exchange-linked infrastructure as an active funding rail for proxy networks, rather than an incidental or downstream touchpoint.
A broader shift: Sanctions enforcement moves toward infrastructure
OFAC’s designation of Zedcex and Zedxion marks an inflection point in the crypto sanctions landscape. This is not simply a story about illicit flows moving through an exchange. It is a story about sanctioned actors operating exchange infrastructure, offshore corporate shells obscuring control, stablecoin liquidity enabling repeatable value transfer, and operational wallet networks functioning as clearing rails within a sanctions-evasion ecosystem.
Most importantly, it reflects an enforcement shift. Authorities are increasingly targeting not only the transactions, but the platforms and infrastructure themselves.
The key question for regulators and compliance teams is no longer only where the funds went. It is increasingly who controls the infrastructure through which value is moving.
Conclusion
Today’s OFAC action against Zedcex, Zedxion, Babak Zanjani, and associated wallet infrastructure represents a major disruption of IRGC-linked stablecoin financing activity. It also reflects the next phase of crypto sanctions enforcement: identifying, attributing, and disrupting illicit financial infrastructure before it becomes normalized at scale.
TRM will continue supporting government agencies, financial institutions, and digital asset businesses in detecting and disrupting sanctions evasion networks operating through stablecoins, exchanges, and offshore crypto infrastructure.
{{horizontal-line}}
Frequently asked questions (FAQs)
1. What are Zedcex and Zedxion, and why were they sanctioned?
Zedcex Exchange Ltd and Zedxion Exchange Ltd were designated by OFAC for facilitating stablecoin flows tied to Iran’s Islamic Revolutionary Guard Corps (IRGC). TRM Labs analysis linked the two UK-registered entities to roughly USD 1 billion in IRGC-related activity, primarily using USDT on TRON.
2. Who is Babak Morteza Zanjani and what is his connection to the case?
Babak Morteza Zanjani is a long-sanctioned Iranian financier known for laundering billions in oil revenue for the regime. He was directly tied to the Zedcex/Zedxion network, serving as a director and financial backer. OFAC described him as a central figure supporting the IRGC’s financial infrastructure.
3. What makes this OFAC action significant in the context of crypto?
This is the first time OFAC has designated a digital asset exchange explicitly linked to the IRGC. It marks a shift in enforcement from individual transactions to targeting the ownership and infrastructure behind crypto platforms used for sanctions evasion.
4. How were stablecoins like USDT used in this case?
The designated exchanges operated as stablecoin clearing hubs rather than retail platforms. Most observed activity was conducted in USDT on TRON, which offers low fees and high throughput — attributes that make it attractive for illicit cross-border transfers under sanctions pressure.
5. What should compliance teams take away from this designation?
The case highlights the need to monitor not just exchange names but their attributed wallet infrastructure and ownership. Risk now extends to offshore corporate shells, stablecoin liquidity rails, and operational wallets used to support state-aligned illicit finance networks.
