Global Ledger traces USD 229.73M in source of funds and USD 229.09M in use of funds across five Canadian crypto exchanges linked to OFAC’s Iran designations.
On 6 November 2026, the US Treasury's Office of Foreign Assets Control (OFAC) designated eight Canadian money services businesses for helping move Iranian money through crypto.
OFAC's allegations point to individual transfers worth hundreds of thousands of dollars. Global Ledger traced the TRON wallets of five of these businesses and found a far larger picture: USD 229.73M in source of funds and USD 229.09M in use of funds between March 2022 and November 2026.
Three findings stand out.
Two exchanges, Million Exchange and Farah Exchange, account for almost 90% of the volume. More than 80% of it moved in just 17 months, from October 2024 to February 2026, before activity collapsed in March 2026. And the money did not stay in shadowy corners: the single largest counterparty on both sides of the flow is a licensed centralised exchange.
Who Was Designated and Why
OFAC acted under Executive Order 13902 as part of Operation Economic Outcast, a Treasury campaign against Iran's financial lifelines launched in August 2026. According to OFAC, the eight businesses exchanged Iranian rials and other currencies for crypto to enable international transactions involving Iran. These are allegations and have not been adjudicated.
The action extends the sanctions perimeter beyond Iran itself. Earlier in 2026, OFAC designated the Iranian exchanges Nobitex, Wallex, Bitpin and Ramzinex (2 June) and Aban Tether and Shelbit (7 August). This time, the targets are the foreign intermediaries that connect those exchanges to the rest of the market. Several of them, OFAC says, operated openly and changed names and addresses to avoid detection.
Global Ledger's analysis below covers the five businesses with traceable TRON wallets: Million Exchange, Farah Exchange, Amin Exchange, Cryptoyal and Darvish Exchange.
Two Exchanges Moved Almost 90% of the Money
Million Exchange alone accounts for 65.5% of the combined volume, and Farah Exchange for another 24.0%. The other three businesses are small by comparison.
Global Ledger chart: Million Exchange and Farah Exchange account for 89.5% of the analysed volume, with source-of-funds values by business.
Million Exchange processed over USD 150M in about 18 months, roughly USD 8M a month on average. Farah Exchange is the veteran of the group: it is the only one active before October 2024, with USD 42.18M of incoming funds between March 2022 and September 2024.
It is also the only one still moving money right up to the designation. Its last recorded flow is dated 5 November 2026, one day before OFAC acted.
A 17-Month Surge, Then Silence
USD 186.68M, or 81.2% of all incoming funds, moved between October 2024 and February 2026. That surge began when Million Exchange and Darvish Exchange went live in October 2024, and Amin Exchange and Cryptoyal joined in 2025.
The peak came in January 2026, with USD 21.49M in and USD 21.56M out. November 2025 (USD 16.21M) and September 2025 (USD 15.26M) were the next-largest months.
Then the flows stopped almost overnight. Incoming funds fell from USD 6.93M in February 2026 to USD 0.65M in March.
From March to November 2026, the five businesses received just USD 0.86M combined, eight months before OFAC published the designation. On-chain data alone cannot tell us why. It does tell investigators that the activity probably did not disappear, and that it is worth checking where it went.
Where the Money Came From, and Where It Went
The biggest single counterparty was not an Iranian exchange but a licensed centralised exchange. It supplied USD 44.42M (19.3%) of incoming funds and received USD 59.41M (25.9%) of outgoing funds.
Across the board, centralised exchanges outside the sanctions lists sent USD 131.83M (57.4%) to the five businesses and received USD 147.36M (64.3%) from them. Exchanges our system classifies as low-risk alone accounted for USD 75.91M (33.0%) in and USD 95.10M (41.5%) out.
Counterparty exposure is not evidence of wrongdoing by these platforms. It does show that sanctioned flows reached mainstream liquidity, and that the screening burden now sits with them. The eight largest exchange counterparties, ranked by combined volume:
The direct sanctions link is visible too.
Sanctioned exchanges sent USD 21.81M (9.5%) to the five businesses, including USD 5.33M from Shelbit, designated by OFAC in August 2026. Only USD 4.72M (2.1%) flowed the other way. Money arrived from sanctioned exchanges at more than four times the rate it went back, which fits the role OFAC describes: a bridge out of Iran's sanctioned venues into the wider market.
Two more categories deserve attention.
USD 24.46M (10.7%) of outgoing funds went to blacklisted wallets, against USD 5.52M (2.4%) received from them. And around 11–15% of the flow on each side passed through unidentified wallets, OTC desks and services, the part of the trail that still needs investigation.
What This Means For Compliance Teams
- Screen the intermediaries, not only Iranian exchanges. Checks limited to Nobitex, Wallex and similar venues would miss Canadian MSBs operating under several trade names. Add the designated TRON addresses, legal names, aliases and Canadian MSB numbers to your screening lists.
- Look back, not only forward. Most of the volume moved between October 2024 and February 2026. Exchanges that served these wallets should review historical exposure now, since OFAC has not announced a general licence or wind-down period.
- Watch the next hop. Volume fell sharply in March 2026, eight months before the designation. When a network goes quiet before a listing, the flows have often moved to new wallets or new businesses. Counterparties of the designated addresses are the natural place to look.
- Expect secondary-sanctions questions. OFAC warns that non-US institutions may face exposure for dealing with blocked persons. Exchanges with large counterparty volumes, such as those in the table above, are the most likely to be asked about it.
Research Methodology
Global Ledger analysed nine TRON addresses attributed to five of the designated businesses, covering 25 March 2022 to 9 November 2026.
Source of funds and use of funds are measured in USD across all counterparties, with volumes classified by counterparty type and owner. NIA Nations Currency is not included in this analysis. Balances are as of 9 November 2026; all five businesses' wallets are now effectively empty.
Activity dates come from TronScan; dates in the per-business table above are the first and last flows in Global Ledger's reports.
