NOMINIS has identified further examples of networks linked to Iran’s Islamic Revolutionary Guard Corps using UK crypto infrastructure to move funds, adding to concerns that British-based financial and digital systems remain exposed to exploitation by hostile state-linked actors.
The above image shows NOMINIS forensic analysis demonstrating funds being sent from a UK based VASP to wallets belonging to the IRGC, Gaza Brokers, Extortion Services, and Syrian or Iranian Over-The-Counter Desks.
The findings come at a particularly sensitive moment. In North London, counter-terrorism police are investigating the torching of four ambulances belonging to Hatzalah, the Jewish volunteer emergency medical service, in Golders Green, after a group calling itself Harakat Ashab al-Yamin al-Islamia claimed responsibility.
Police have not publicly authenticated the claim, but the alleged link has widened attention beyond vandalism or hate crime alone and towards the possibility of Iran-linked hostile activity on British soil.
For security officials and compliance specialists, the issue is no longer simply whether IRGC-linked actors can move money through opaque international networks, but whether they are able to exploit UK-connected infrastructure in ways that can support, enable or sustain the kinds of operations seen in incidents such as the Golders Green attack. The conjunction of the two issues is likely to deepen pressure on ministers, regulators and law enforcement agencies already under scrutiny over sanctions enforcement and domestic security.
According to NOMINIS, the latest cases point to further use of UK crypto rails in transactions associated with IRGC-linked networks. That is likely to raise fresh questions about whether British enforcement has kept pace with the speed, complexity and cross-border nature of digital asset flows.
For governments and financial crime specialists, the central question is whether apparently legitimate platforms, service providers or corporate structures can be used as transit points for sanctioned actors seeking not only to obscure the movement of funds, but to channel resources into the wider ecosystem that underpins intimidation, disruption and politically motivated attacks.
The timing is especially striking because the attack in Golders Green has resonated far beyond the immediate damage. The ambulances belonged to Hatzolah, a volunteer emergency service that operates in the capital’s Jewish community and responds to medical incidents free of charge. The arson caused significant alarm but no reported injuries. Early reporting described the case as an antisemitic attack; however, the emergence of a claim from a group described in several reports as pro-Iranian or Iran-linked has added a more explicitly geopolitical and counter-terror dimension to the investigation.
NOMINIS founder Snir Levi described the terrorist use of UK-connected infrastructure as the exact methodology for the funding of the attacks, such as the attack on the ambulances belonging to the Jewish EMT group in Golders Green,
For policymakers, the bigger concern is cumulative. In isolation, suspicious crypto flows can be treated as a sanctions-enforcement problem. An attack on emergency vehicles serving a Jewish community can be treated as extremist violence. But taken together, they suggest a broader operating picture in which UK-based systems, both digital and physical, may be vulnerable to actors linked directly or indirectly to Iran’s security apparatus.
That is the argument likely to gain traction in Westminster and Whitehall: that Britain should stop viewing these incidents as separate compliance, policing or community-security problems, and instead treat them as different expressions of the same strategic challenge. If IRGC-linked networks can move funds through UK-connected crypto infrastructure while affiliated or sympathetic groups threaten targets in London, the question for the British state is not whether the threat exists, but whether the response is sufficiently joined-up.
NOMINIS findings therefore feed into a wider concern that sanctions evasion, financial opacity and intimidation are not parallel phenomena but interconnected ones. For ministers, regulators and law enforcement agencies, the pressure will be to show that Britain is not an easy jurisdiction in which hostile actors can both route money and create the conditions for attacks that generate fear.
.png)
%20.jpg)