For nearly a year, we tracked one of the most sophisticated IRGC-linked crypto laundering operations ever documented. We watched it move, mapped its architecture, and traced its money across borders and blockchains months before any of it reached the public record. Today, for the first time, we are putting a name to the network and a face to the man at its center.
In ongoing court cases and media reports, this network has been known as ‘Entity A’, however, we have officially put a face to the entity - IRGC VIP financier Shahram Zakeri.
Who is Shahram Zakeri?
Shahram Zakeri (National Iranian ID: 2649613580) is, on paper, a ghost, and barely exists. There is no official IRGC designation and hardly comes up in Iranian records. Suggested images exist, but the name appears nowhere in publicly known sanctions lists. For a man who moved hundreds of millions of dollars, he left remarkably little behind.
Our investigation, which began over a year ago before any of this surfaced in the news. We combined on-chain evidence with exclusive data from the Iranian opposition, and identified Zakeri as the key figure, sitting in the middle of it all, coordinating fund flows between Iran’s intelligence agencies and Nobitex, Iran’s largest crypto exchange. He was the bridge: routing hundreds of millions of dollars in illicit funds between the IRGC’s financial networks and the exchange’s rails.
His status at Nobitex made this role possible, as while every other user on the platform is required to complete KYC (Know Your Customer) verification, Zakeri operated with no identity checks, no source-of-funds verification, and no scrutiny. This intentional oversight was accommodated by Nobitex to provide cover for the man routing terrorist funds through its infrastructure, while ordinary Iranian users faced tightening restrictions.
The Architecture of the Zakeri Network
The Zakeri network is not a handful of wallets, but a layered architecture with consistent behavioral patterns across multiple addresses. Its source of funds connects directly to actors already designated on sanctioned lists.
Hexa Whale and Blessed Trust, both of which have featured prominently in recent reporting, appear as upstream sources. But two additional figures have not previously been reported: Chinese national Ju Wintu, and a second, 38 year old VIP account holder. Ju Wintu is a business partner of Wu Junliang, whose company is registered at the same address as the Blessed Trust. The Chinese connection to this network is deeper than has been publicly acknowledged.
When we follow the money downstream, to its destinations, the strategic picture comes fully into focus. Hundreds of millions of dollars were split between two endpoints. The first was Nobitex itself. The second was a set of sanctioned wallets tied to the A7A5 infrastructure, a financial channel already understood to function as a major artery in the Russia-IRGC corridor. The funds moving through the Zakeri network therefore touch Iran's intelligence services, Chinese commercial actors, and Russian-linked sanctioned infrastructure, all within a single coordinated system.
A new name: Mohsen Fahad
This is another previously unreported figure in this network.
Mohsen Fahad, 44 years old, Iranian national, holds a Dominica ID listing Iran as his birthplace. He was named in a 2020 UN Security Council report as a gold trader facilitating Iran's settlement of balance-of-payments obligations with North Korea in gold. In 2024, Fahad sent the equivalent of $100 in TRX to an Entity A wallet. A transfer of this kind, since the amount is small, functions less like a payment than like a handshake, a confirmation of an operational relationship between the parties involved. With that single transaction, the network now confirmed as Entity A is tied directly to the same gold-based sanctions-evasion machinery that the United Nations flagged years earlier, drawing a line that connects on-chain crypto activity to one of the regime's most established offline evasion methods.
The OFAC Smoking Gun
There is one further detail, and it has not appeared anywhere in the public record until now..
Wallets within the Zakeri network received funds directly from wallets sanctioned by OFAC, including addresses linked to Alireza Derakhshan, a designated individual. This is not a matter of distant association or proximity to several hops removed along the chain. It is a direct financial line running from OFAC-sanctioned actors into the network that we can now confirm operated as Entity A.
What does our investigation mean?
Entity A was referenced in media reporting and cited in a letter from Senator Richard Blumenthal to the U.S. Senate. The label has been in circulation for months, but until now, the name behind it has not been publicly identified.
Shahram Zakeri is Entity A.
The network he operated moved hundreds of millions of dollars on behalf of Iran's intelligence apparatus. It relied on the country's largest cryptocurrency exchange as a willing and knowing partner. It drew in Chinese nationals connected to Blessed Trust, maintained an operational relationship with a gold trader already designated by the United Nations, and received funds directly from wallets sanctioned by OFAC. Each of these findings would be significant on its own. Together, they describe a single network functioning as a hub where the financial interests of Iran, China, and Russia intersect.
Nominis is continuing its investigation, and additional findings will follow.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
%20thumbnail%20.jpg)