Mabna Institute Crypto Moves Fuel Scrutiny on State-Sponsored Hacks

Summary

• US Treasury sanctions nearly 60 Iran-linked targets including 30 crypto addresses tied to the Mabna Institute
• TRM Labs traces $16.8 million in flows since 2018 across sanctioned Iran-linked wallets
• Four of five people named charged in the Justice Department's expanded Mabna Institute case

US Treasury sanctioned nearly 60 Iran-linked targets on August 25, 2026. They included 30 cryptocurrency addresses tied to the Mabna Institute. The sanctions hit hackers behind state-sponsored attacks and crypto laundering.

It follows new blockchain tracing that connects those addresses to millions in illicit flows. This action shows stronger enforcement against Iran sanctions violations in crypto.

The sanctions come alongside reports of a governance exploit at Term Finance.

"TRM Labs traced $16.8 million across 30 sanctioned Mabna Institute crypto wallets, with 92% held by one defendant."

, TRM Labs (finance.yahoo.com)

Context

Iran has long tied the Mabna Institute to government cyber operations against critical infrastructure. US authorities have chased the group for years with indictments and sanctions. Now the latest measures zero in on cryptocurrency that moves and launders the proceeds.

Blockchain data reveals the full scale.

TRM Labs spotted activity on Bitcoin, Ethereum, and TRON addresses linked to the defendants. This evidence backs the new designations under Iran sanctions rules.

Details

TRM Labs analysis covered 30 addresses connected to Mabna Institute members. Roughly $16.8 million entered those wallets since 2018. One defendant controlled 92 percent of the identified holdings according to the tracing data.

Four of the five individuals named in the Treasury action were also charged last week in the Justice Department's expanded Mabna Institute case.

The charges cover cyber attacks on critical infrastructure and related financial crimes. A separate $8.5 million governance exploit at Term Finance occurred around the same period but shows no confirmed link to state actors.

The Treasury action names nearly 60 targets in total. It directly addresses crypto laundering channels used by the Iranian group.

Investigators continue to monitor remaining funds across the sanctioned addresses. The Term Finance incident remains under separate review as a possible unrelated DeFi exploit.

Officials have not tied it to the Mabna operations. Regulators and analytics firms will watch for new laundering patterns tied to state-sponsored hacks.