From Death Row to DotOne: How Iran's Master Sanctions Evader Rebuilt His Crypto Empire

Iran's IRGC has adapted rapidly to Western sanctions pressure, shifting from oil brokering to crypto infrastructure. The battlefield is now on-chain.

The story of Babak Zanjani reads like something a screenwriter would reject for being too implausible. An Iranian billionaire financier orchestrates the laundering of billions in sanctioned oil revenue for the Islamic Revolutionary Guard Corps. Iran's own judiciary arrests him. A court sentences him to death. He sits on death row for eight years. Then, in a twist that should concern every sanctions official in Washington and Brussels, his sentence is commuted. He repays some of the stolen funds. He walks out of Evin Prison. And within months, according to multiple investigators, he is back in the sanctions evasion business - this time using stablecoins, UK shell companies, and a fictional corporate director built from stock footage.

This is not supposition. It is documented. The U.S. Treasury sanctioned Zanjani and two UK-registered cryptocurrency exchanges linked to him on January 30, 2026. Blockchain analytics firm TRM Labs traced roughly $1 billion in funds connected to the IRGC flowing through those same exchanges. An OCCRP investigation found that the "CEO" of one exchange was a stock-footage model from a Shutterstock video titled "Pretty black woman talking to camera." And yet through all of it, Zanjani publicly positioned himself as a legitimate tech entrepreneur, advising Iran's central bank on blockchain adoption and describing his conglomerate DotOne Holding Group as the future of Iranian finance.

Understanding how this happened requires tracing three interconnected threads: the mechanics of Zanjani's original oil-money laundering network, the architecture of the crypto infrastructure he allegedly built upon his release, and the role that Western corporate registries - specifically the UK's Companies House - played in legitimizing the whole operation.

The Original Sin: Oil, Death Row, and a Calculated Pardon

Babak Morteza Zanjani built his first fortune in the years after 2010, when Western sanctions began closing in on Iran's oil export revenues. As the international financial system started shutting its doors to Iranian crude, Zanjani positioned himself as the man who could move the money anyway. His network spanned Turkey, the UAE, Malaysia, and multiple European banking jurisdictions, shuttling oil revenues through a labyrinth of front companies to keep Tehran's cash flowing despite the sanctions regime.

The scale was staggering. The U.S. Treasury first sanctioned Zanjani in 2013, describing him as someone who had provided the Iranian government with "financial services of significant value" worth hundreds of millions of dollars. EU sanctions followed. His network, according to investigators, moved roughly $2.5 billion in Iranian oil proceeds through the international financial system.

Then came the fall. In 2013, Iran's own government turned on him. The Rouhani administration, seeking to distance itself from the corruption of the Ahmadinejad era, arrested Zanjani. In 2016 an Iranian court sentenced him to death for embezzling approximately $2.8 billion from the National Iranian Oil Company. This was a remarkable piece of prosecutorial theater from a regime that had actively enabled his sanctions evasion work - but there was internal logic to it. Zanjani was useful when he was moving money for the state. When he started keeping too much of it, he became expendable.

He sat on death row for the better part of a decade. But prison records seen by OCCRP suggest he may have been allowed to leave as early as 2019 - two years before his alleged crypto network was established. His formal legal status only changed in April 2024, when his death sentence was commuted. By 2025 he had been formally released, reportedly after repaying a portion of the embezzled funds.

What happened next was, depending on your perspective, either jaw-dropping audacity or entirely predictable logic. Zanjani did not disappear into obscurity. He launched DotOne Holding Group.

Iran's IRGC has built a layered sanctions evasion architecture spanning crypto, logistics, aviation, and telecommunications - all sectors covered by the DotOne conglomerate.

DotOne: The Conglomerate That Covers All the Bases

DotOne Holding Group is not a secretive outfit. Zanjani promotes it openly. Its stated business interests span cryptocurrency, foreign exchange, logistics, transportation, aviation, and telecommunications. TRM Labs noted the particular significance of this breadth in their January 2026 report. These are precisely the sectors required to move value under sanctions: crypto for digital transfers, logistics and transportation for trade-linked settlement, aviation for physical movement of principals and assets, and telecommunications for secure communications infrastructure.

In July 2025, Zanjani posted a statement on X claiming he had advised the governor of the Central Bank of Iran to transition the country's banking system to blockchain-based infrastructure back in 2023. He claimed DotOne had "designed and implemented such a system with approval from Iran's Supreme National Security Council." This is not the language of a reformed criminal trying to stay under the radar. It is the language of a man who considers himself back at the center of Iran's financial architecture.

"The US accusations were merely a pretext for seizing 660 million Tether and extortion." - Babak Zanjani, posting on X following U.S. Treasury sanctions, January 2026

Zanjani's public statement denying the U.S. Treasury's allegations is notable in several ways. He did not deny having any connection to Zedcex or Zedxion. He did not deny the existence of the crypto networks. He disputed the framing of the seizure - specifically objecting to the freezing of what he described as $660 million in Tether stablecoin holdings. That is a curious complaint from a man whose companies' UK filings declared them dormant with no active trading operations.

The gap between those two facts - $660 million in seized crypto assets and officially "dormant" company status - is at the core of what investigators allege. Zedcex and Zedxion were not real companies in any operational sense that UK regulators would recognize. They were vehicles. London registration gave them a veneer of Western respectability. Dormancy filings kept them invisible. And blockchain rails moved the actual money entirely outside any jurisdiction that might be watching.

The Architecture: Ghost Directors, London Shells, and Stablecoin Rails

The mechanics of how Zedcex and Zedxion were constructed reveal a pattern that anti-money laundering experts say has become a standard playbook for sanctions evaders in the crypto era.

Zedxion Exchange Ltd was incorporated in the UK in May 2021. Its founding director was a Dutch national named Mehmet Hasancebi. Five months later, the directorship transferred to a UAE passport-holder named "Babak Morteza" - whose identifying details match those of Zanjani, whose full legal name is Babak Morteza Zanjani. Then in August 2022, directorship transferred again to "Elizabeth Newman," a woman OCCRP was unable to find any evidence of existing in reality. Newman listed a Caribbean address, London's Covent Garden, and a Dubai skyscraper among her correspondence locations.

Zedcex Exchange Ltd was incorporated days later, at the same virtual office address - 71-75 Shelton Street in Covent Garden. Newman was named director and person of significant control from the outset. Both companies filed as dormant every year. Both companies claimed on their websites that Elizabeth Newman was their CEO and founder, a graduate of Turkey's University of Ege - which happens to be Zanjani's own alma mater.

OCCRP's investigation confirmed that the "Elizabeth Newman" appearing in marketing videos was a stock-footage model from Shutterstock. Other supposed employees shown in the promotional material were also taken from stock footage libraries. The woman, the company, and the executive team were theatrical props over a very real financial operation.

The actual exchange infrastructure ran through a separate technical layer. TRM Labs found that Zedcex's operations appeared to be "nested within" infrastructure provided by ChainUp, a Singapore-based provider offering white-label exchange services including custody, wallet management, and trading back-end systems. This hybrid model - outsourced technical infrastructure combined with bespoke wallet architecture for IRGC-linked transactions - allowed the operation to scale rapidly while maintaining operational separation between its commercial-facing functions and its sanctioned activities.

Zedcex operated as what TRM Labs described as a "stablecoin clearing hub" rather than a retail exchange - routing IRGC-controlled funds through USDT on the TRON blockchain.

Following the Money: IRGC, Houthis, and $10 Million to Yemen

TRM Labs' on-chain analysis produced findings that go well beyond simple sanctions evasion. The Zedcex/Zedxion network was not merely moving money for an abstracted "IRGC." It was moving operational funds to specific individuals whom the U.S. has designated as terrorist financiers.

According to TRM Labs, wallets dually attributed to Zedcex and the IRGC directly transferred funds to Sa'id Ahmad Muhammad al-Jamal, identified by the U.S. Treasury as a senior Houthi financial official backed by the IRGC. Al-Jamal is listed as a Specially Designated Global Terrorist. The transfers exceeded $10 million. The Houthis, who control Yemen's capital Sana'a and much of the country's population, have deployed missiles, drones, and naval mines to attack commercial shipping in the Red Sea - operations that require steady operational funding.

The money trail therefore links Zanjani's UK companies, through crypto rails, to attacks on international shipping. This is not a theoretical chain of attribution. TRM's blockchain analysis documents it directly. U.S. authorities confirmed it in their sanctions announcement.

The TRON blockchain was central to the operation. USDT (Tether's dollar-pegged stablecoin) on TRON offers deep liquidity, low transaction fees, and widespread acceptance among brokers in jurisdictions that are willing to work with Iranian counterparties. The choice of TRON over Ethereum reflected deliberate operational planning: TRON's lower fees make it more suitable for high-volume, lower-value operational payments of exactly the type involved in militia financing.

TRM Labs also found that many Zedcex wallets held a proprietary token called "Zedxion" (USDZ), marketed as a dollar-pegged asset. This token was promoted on Persian-language Telegram channels, where users discussed secondary trading and swaps into more established cryptocurrencies. The USDZ token created a parallel layer of financial infrastructure that allowed Zedcex to map its user base and transaction flows - useful for understanding who was using the network and for what purpose.

The Key Figures: A Network Portrait

Western intelligence agencies have been tracking the militarization of Iran's sanctions evasion networks for years. The Zedcex case represents the crypto chapter of a story that began with oil tankers.

Timeline: How the Network Evolved

The UK's Complicity: A Registry Built for Abuse

One of the most uncomfortable implications of the Zedcex case is not about Iran. It is about Britain. The UK's Companies House accepted, year after year, filings that described as "dormant" companies that were processing billions of dollars in stablecoin transactions. It accepted a fictional CEO without any verification of her existence. It registered a company whose stated director turned out to be a stock footage model from an American video platform, and sent that company an official registration certificate under British law.

The UK government has been aware of this structural vulnerability for years. The Economic Crime and Corporate Transparency Act 2023 was specifically designed to address it, requiring directors and persons of significant control to verify their identities. But it came with a long grace period. The deadline for existing directors to comply falls in mid-2026. That gave Zanjani's network several years of uninterrupted operation under the protection of British corporate legitimacy.

"Until these measures were introduced, submitting the name of a fictitious executive to Companies House was actually the easiest thing in the world to do." - Graham Barrow, British anti-money laundering expert, speaking to OCCRP

The UK government has also been notably more cautious than the U.S. in responding to the evidence. Washington sanctioned both Zanjani and the two exchanges on January 30. London sanctioned Zanjani but did not sanction Zedcex or Zedxion. Those UK-registered companies, despite being designated by the U.S. Treasury as IRGC financial infrastructure, remain on the UK corporate register. The "Elizabeth Newman" deadline of May 19, 2026 is approaching with no public indication that Companies House has escalated the matter.

Parliament noticed. MP Alex Sobel, speaking in January 2026, described the situation plainly: the IRGC had used two registered UK cryptocurrency exchanges to move approximately $1 billion since 2023, evading international sanctions. The exchanges were British-registered entities. Their regulatory compliance had been certified by a British government agency. The question of institutional accountability for that failure has not been answered.

The UK parliament's Public Accounts Committee has been asked to examine Companies House reform, but institutional change has lagged behind the pace of sanctions evasion.

Geopolitical Context: The IRGC's Financial War

The Zedcex network does not exist in a vacuum. It is a piece of a much larger Iranian sanctions evasion architecture that has been evolving for over a decade. When traditional banking channels closed after 2012, Iran developed oil-for-goods barter arrangements, front company networks, and correspondent banking chains through sympathetic jurisdictions. When those channels came under pressure, crypto provided the next layer.

TRM Labs' 2026 Crypto Crime Report notes that cryptocurrencies appear to be playing an "increasingly prominent role" in total IRGC-linked financing activity. The shift is structural rather than incidental. Crypto offers irreversibility (confirmed transactions cannot be recalled by third parties), borderlessness (no correspondent bank can be pressured to block a transfer), and - when operated through front companies with dormant UK filings - a veneer of Western legitimacy that makes counterparties more willing to deal.

The Iranian government has publicly leaned into this shift. Zanjani's claim that he advised the Central Bank of Iran on blockchain adoption, if accurate, suggests the crypto transition is not being driven solely by individual entrepreneurs seeking profit. It reflects a state-level strategic decision to build parallel financial infrastructure that sanctions cannot reach.

This matters for the West's Iran policy in a period of acute regional tension. The protests in January 2026 that killed potentially thousands of Iranians - with the IRGC playing a central role in the crackdown - were funded in part through mechanisms that Western financial systems enabled. The crypto rails that moved $619 million for the IRGC in 2024 alone are not theoretical vulnerabilities. They were operational conduits for suppression.

The connection to Houthi financing adds another dimension. The $10 million in transfers to al-Jamal documented by TRM Labs represents a small fraction of total IRGC-linked activity through Zedcex - but it directly implicates the network in attacks on commercial shipping that have disrupted global trade routes. When a container ship is forced to reroute around the Cape of Good Hope because of Houthi drone threats in the Red Sea, some portion of that operational cost traces back through Zedcex to a virtual office on Shelton Street in London's Covent Garden.

What Happens Next: Enforcement Gaps and Open Questions

The U.S. sanctions are meaningful but limited. They freeze any Zanjani or Zedcex/Zedxion assets under U.S. jurisdiction and prohibit U.S. persons from transacting with them. Given that the operation primarily used TRON-based stablecoins, and that Tether - the issuer of USDT - is not a U.S.-regulated entity (it operates from the British Virgin Islands), the sanctions create pressure without guarantee of enforcement.

Tether has blocklisted wallets connected to the network, which is meaningful. Israel's September 2025 seizure order against IRGC crypto wallets created additional chokepoints. But TRM Labs' data shows IRGC-linked activity through Zedcex was already declining in 2025 before these measures, suggesting the network was adapting and diversifying. Sophisticated sanctions evaders do not rely on a single set of infrastructure. They build redundancy.

The DotOne conglomerate remains active. Its aviation, logistics, and telecommunications arms are exactly the kind of multi-sector structure that allows value transfer to be disguised within legitimate commercial activity. Trade-based money laundering - in which over- and under-invoicing of goods allows funds to move between counterparties without touching the banking system - has historically been harder to detect than straight financial transfers, and DotOne's stated sector interests cover the infrastructure required to do it at scale.

"Treasury will continue to target Iranian networks and corrupt elites that enrich themselves at the expense of the Iranian people. This includes the regime's attempts to exploit digital assets to evade sanctions and finance cybercriminal operations." - U.S. Treasury Secretary Scott Bessent, January 30, 2026

Companies House reform is underway in the UK but proceeding slowly. The May 2026 identity verification deadline for existing directors will be a critical test. If "Elizabeth Newman" fails to verify - as she inevitably must, given she does not appear to exist - Companies House will need to decide whether to strike the companies from the register, refer the matter to law enforcement, or allow the deadline to pass without consequence. The outcome will signal whether the UK's corporate transparency reforms are genuine enforcement tools or theater.

Zanjani himself remains active and visible. He has not gone underground. He posts on X. He gives interviews framing himself as a victim of geopolitical rivalry. He runs DotOne openly. For an individual who was sentenced to death and then sanctioned by the world's largest economy, he moves with remarkable confidence. That confidence likely reflects an accurate assessment of the enforcement landscape: sanctions without seizure, designations without prosecution, and corporate registries that accept stock footage CEOs.

For investigators, the Zedcex case has practical implications beyond Zanjani himself. ChainUp, the Singapore-based infrastructure provider whose white-label services appear to have hosted parts of Zedcex's operation, has not been sanctioned or publicly named as a knowing participant. The company likely did not know the full nature of its client's activities - white-label providers rarely do. But the case raises questions about what due diligence obligations apply to crypto infrastructure providers whose services end up embedded in sanctions evasion networks.

And then there is the matter of the purple bell. The cat photograph that linked Solmaz Bani to the Zedxion Telegram channel represents the kind of forensic detail that most money laundering networks do not leave behind. Great financial crimes, as investigators often observe, are unraveled not by the billions but by the small carelessly left traces - a metadata field with the wrong author name, an auto-fill entry in a tutorial video, a distinctive pet photographed in two different contexts. The ghost of Elizabeth Newman haunts the network's filings. The cat with the purple bell haunts its communications. Somewhere in that gap between the constructed fiction and the human reality of the operation, the truth about Zanjani's network is waiting to be fully told.